Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #240983

Re: You have been removed from the list (repeatedly)

Show all headers | View raw

Hi,

Greg Wooledge wrote:
> The "forged bounce messages" (for lack of a better term) are coming
> from someone who *is* subscribed.  They've set up some sort of auto-responder
> which is generating one of these messages every time they receive a
> message from the list.

This would be a novel application of mail Bounce Attack aka Backscatter,
which is normally used to smuggle spam content around the filters.
If so, then not you get spoofed but rather the Debian list server is
too credulent towards DSN messages.

This would also explain why the headers of the quoted message from
postmaster@vps268904.ovh.net do not look like a message that was
resent from debian-user. Instead it was payload of a forged bounce
message.


Have a nice day :)

Thomas

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

You have been removed from the list (repeatedly) Greg Wooledge <greg@wooledge.org> - 2021-10-05 22:50 +0200
  Re: You have been removed from the list (repeatedly) piorunz <piorunz@gmx.com> - 2021-10-05 23:10 +0200
  Re: You have been removed from the list (repeatedly) "Thomas Schmitt" <scdbackup@gmx.net> - 2021-10-05 23:40 +0200
  Re: You have been removed from the list (repeatedly) Cindy Sue Causey <butterflybytes@gmail.com> - 2021-10-05 23:50 +0200
  Re: You have been removed from the list (repeatedly) Andy Smith <andy@strugglers.net> - 2021-10-06 00:10 +0200
  Re: You have been removed from the list (repeatedly) Reco <recoverym4n@enotuniq.net> - 2021-10-06 07:30 +0200
    Re: You have been removed from the list (repeatedly) Greg Wooledge <greg@wooledge.org> - 2021-10-06 13:40 +0200
      Re: You have been removed from the list (repeatedly) "Andrew M.A. Cater" <amacater@einval.com> - 2021-10-06 13:50 +0200
        Re: You have been removed from the list (repeatedly) Reco <recoverym4n@enotuniq.net> - 2021-10-06 14:10 +0200
          Re: You have been removed from the list (repeatedly) Dan Ritter <dsr@randomstring.org> - 2021-10-06 16:30 +0200
        Re: You have been removed from the list (repeatedly) Bret Busby <bret@busby.net> - 2021-10-06 15:40 +0200
          Re: You have been removed from the list (repeatedly) Greg Wooledge <greg@wooledge.org> - 2021-10-06 15:50 +0200
            Re: You have been removed from the list (repeatedly) "Thomas Schmitt" <scdbackup@gmx.net> - 2021-10-06 19:50 +0200
            Re: You have been removed from the list (repeatedly) Dan Ritter <dsr-onetimeonlytalktome@randomstring.org> - 2021-10-08 19:30 +0200
      Re: You have been removed from the list (repeatedly) Reco <recoverym4n@enotuniq.net> - 2021-10-06 14:00 +0200

csiph-web