LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-20-2004, 05:26 AM   #1
b0uncer
LQ Guru
 
Registered: Aug 2003
Distribution: CentOS, OS X
Posts: 5,131

Rep: Reputation: Disabled
enough is enough... >:(


spam is one hell of a problem these days, but today I got too much. normal spam can be filtered (and my firefox has been trained well for that, I can say), but today I got right in the morning six emails with attachments inside - each one of them comes from an unknown address to me (that doesn't exist, I have studied this on my own), and they don't have any common sender, subject, body or anything. the only thing they do have in common is that they try to resemble something normal (like a mail delivery system that tells of failure) and they have an attachment, that is masked as if it was a zip, piff, diff, hiff, whatever, but is truly a win32/msdos executable. not that they'd work in my linux, but it gets me annoyed to get these and remove these, because the attachments slow down my mail (I'm using a dialup modem, you see) if they start coming in ten-packs.

now what I'd like to do is to get something out of these messages, so that I could filter them to be deleted from the server before downloading them. luukku.com provides the chance to filter mail from server by sender, subject or anything, but for that purpose I'd really need to know something. I can't use subject or body, because they resemble normal activities (mail delivery subsystem; error; returned mail etc.) nor sender, because they change from message to message....so:

is there a way to get the _real_ sending address? I mean, there has to be one, or what? at least I've imagined so. or something that could identify these damn messages from the others, so that they could be deleted once and for all..I know it won't stop the spams but I'd like to get these out of the way now.

the other option is of course to change the mail provider...but I wouldn't like to do that, because firstly I'd have to get all my friends change their addressbooks (which would cause quite a lot of work to do) and secondly, I know it wouldn't take that long when the spams would be back.

so, is there a way to "decode" the message sender or something so that certain messages can be filtered even tough their senders seem to change all the time?
 
Old 05-20-2004, 08:48 AM   #2
ac1980
Member
 
Registered: Aug 2003
Location: Trento, Italy
Distribution: Debian testing
Posts: 394

Rep: Reputation: 30
Every mail server shuld attach its domain name to the mail header, so the source would be traceable.
Actually some relay servers simply throw away any information about the incoming messages. This is not always bad, since it allows anonymous/untraceable exchanges weakening the chance for a "big brother", a single omniscent superpower; however, as a side-effect, it makes spamming easier.
Also, keep in mind that most spam actually comes from high-traffic infected servers (that often are not even mail servers), not from mail client, so filtering it out may make you unreachable by some domains.

There are only 2 ways to avoid spam:
1. keep your private address private, never post it on web forms/pages/forums. You should have another "spam-dedicated" address for these tasks.
2. discard any unencrypted mail from unknown people, and make your public key available in an automatic answer: somebody willing to contact you will then encript and re-send the mail. The drawback is that many people doesn't know how to handle encryption.
 
Old 05-20-2004, 10:15 AM   #3
b0uncer
LQ Guru
 
Registered: Aug 2003
Distribution: CentOS, OS X
Posts: 5,131

Original Poster
Rep: Reputation: Disabled
these just are my problems... :/

1. this address is my "private" address, which I don't use anywhere. the point is, I don't even know how it got "public", as I only use it to communicate between people I trust, to/from their private addresses. I suspect, though, that it has got out when somebody that has my address, has got a worm or something on his/her machine, that has taken advantage of the addresses and in that way spreaded my address..I'm not sure, but that's the only way I can think of.

2. the vast majority of the people I send/receive mail with this address use programs that can't handle encryption, or then send the mails from a web-based mailbox rather than from a program. I'd like to use encryption, but for this reason I can't...

still, if it was possible to see some information about the message/sender that isn't shown on normal "view mail" -screen on any mail app, how was it done? I use Firefox myself as my mail reader, and the only things I can get out of an email with it is subject, sender (faked in these messages) and recipient (myself, or sometimes something else)..so like there is "view source" for webpages, is there a similar way to see "inside" a mail message?

thanks for enlightening the whole thing to me...looks like I'm going to have to drop the address once again and change it. it's just that on this particular address I have more space than on any else address (over 20 megs) so it's quite useful sometimes....

damn spammers
 
Old 05-20-2004, 11:07 AM   #4
ac1980
Member
 
Registered: Aug 2003
Location: Trento, Italy
Distribution: Debian testing
Posts: 394

Rep: Reputation: 30
If you use firefox, i.e. web based client, then you can only search for a "show full headers" on the web page...
If you use mozilla thunderbird (the former firebird "twin"), you can select View->headers->All
 
Old 05-20-2004, 01:49 PM   #5
b0uncer
LQ Guru
 
Registered: Aug 2003
Distribution: CentOS, OS X
Posts: 5,131

Original Poster
Rep: Reputation: Disabled
ac1980, gee thanks! that helped me a bit onwards..though it doesn't solve the problem, I can see something about through where the mails come from and so on...perhaps tell them what's going on and possibly ask them to remove my address from any addressbooks (mailworms often seem to spread by using addressbooks' addresses)
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:51 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration