Worm storms

[Julian V. Noble]

Dear C Mavens,

Anyone here getting hosts of spam with nefarious attachments,
purporting to be from M$ or its lackeys, into your mailbox?

I neglected to spoof my header, and since Hurricane Isabel
I have gotten well over 10K such messages.
--
Julian V. Noble
Professor Emeritus of Physics
jv*@lessspamfor mother.virginia .edu
^^^^^^^^^^^^^^^ ^^^
http://galileo.phys.virginia.edu/~jvn/

"Science knows only one commandment: contribute to science."
-- Bertolt Brecht, "Galileo".

[Ravi]

On Wed, 24 Sep 2003 19:22:05 +0300, Ian Tuomi <ia*******@co.j yu.fi> wrote:

Julian V. Noble wrote:

Dear C Mavens,

Anyone here getting hosts of spam with nefarious attachments,
purporting to be from M$ or its lackeys, into your mailbox?

I neglected to spoof my header, and since Hurricane Isabel
I have gotten well over 10K such messages.

Yes. I am getting ~200/day but I made mozilla identify them as spam and
not download any attachments bigger than 50k so they are quickly deleted

Are you saying that inspite of mangling your address with nospam you get the spam messages?

--
main(){char s[19]="SbwjCAUpvhiHv z/ofu";
int i;for(i=0;i<18; putchar(s[i++]-1));}

[Jason]

> Dear C Mavens,

Anyone here getting hosts of spam with nefarious attachments,
purporting to be from M$ or its lackeys, into your mailbox?

I neglected to spoof my header, and since Hurricane Isabel
I have gotten well over 10K such messages.

I get about 100 mails every day :(

[Christopher Benson-Manica]

Christian Bau <ch***********@ cbau.freeserve. co.uk> spoke thus:

1. If you use a pointer like "int * restrict p", then it is undefined
behavior if you modify an object through an expression that is derived
from the value of p, and access it through a different pointer; and it
is also undefined behavior if you access an object through an expression
that is derived from the value of p, and access it modify it through a
different pointer. This is important for an optimising compiler. Example: int *restrict p;
int *q; int x = *q, y;
*p = 2;
y = *q;
(I'm assuming you ommitted the calls to malloc() for simplicity...)
The compiler can assume that y == x because the assignment to *p cannot
change *q (if it did you would have violated the first rule).
So basically the restrict keyword means that p may not share write access to a
given area of memory with another pointer?
2. If you use a pointer like "const int * restrict p", then it is
undefined behavior if you modify an object that is accessed through an
expression that is derived from the value of p. In other words, *p
cannot be modified as long as the pointer p exists. Usually, if you have
a const* pointer then the object pointed to can still be modified by
other means, or by casting the const-ness away. Not if it is a const
*restrict pointer.

So restrict is a way of forcing strict const-ness?

--
Christopher Benson-Manica | Jumonji giri, for honour.
ataru(at)cybers pace.org |

[Philip Ludlam]

On 24 Sep, in message <87************ ***@lucien.drea ming>
bk**@elektrubad ur.se (Björn Lindström) wrote:

Ian Tuomi <ia*******@co.j yu.fi> writes:

Julian V. Noble wrote:

Anyone here getting hosts of spam with nefarious attachments,
purporting to be from M$ or its lackeys, into your mailbox? I
neglected to spoof my header, and since Hurricane Isabel I have
gotten well over 10K such messages.

Yes. I am getting ~200/day but I made mozilla identify them as spam
and not download any attachments bigger than 50k so they are quickly
deleted

For me, these two procmail rules got the signal/noise ratio down to
levels manageable by Gnus.

[snip]

From Message-ID <bk**********@n ntp0.reith.bbc. co.uk> on
comp.sys.acorn. misc the following procmail recipe will catch the virus
itself, but not the faked bounces - I've had none since installing it on
my ISPs server.

:0
* > 140000
* < 165000
{
:0 BD
* b3IAAABBZG1pbgA AAEdFVCBodHRwOi 8vd3cyLmZjZS52d XRici5jei9iaW4v Y291bnRlci5naWY v
/dev/null
}

FYI: that string contains a base64-encoded URL of a vanity counter that
the virus apparently has hard-coded in it

Yours,

Phil L.
--
http://www.philipnet.com http://director.sourceforge.net
The From address is valid, but anything over 32k is deleted by the server
i ou a uea i e a o ie e a o a a oue oae

[Christian Bau]

In article <bk**********@c hessie.cirr.com >,
Christopher Benson-Manica <at***@nospam.c yberspace.org> wrote:

So basically the restrict keyword means that p may not share write access to a
given area of memory with another pointer?

Slightly more. As you said, only one pointer is allowed to write in that
area. But if one of the pointers writes, then the other pointer is not
even allowed to read from the same area.

That allows an optimising compiler to reorder read and write accesses
through both pointers.

2. If you use a pointer like "const int * restrict p", then it is
undefined behavior if you modify an object that is accessed through an
expression that is derived from the value of p. In other words, *p
cannot be modified as long as the pointer p exists. Usually, if you have
a const* pointer then the object pointed to can still be modified by
other means, or by casting the const-ness away. Not if it is a const
*restrict pointer.

So restrict is a way of forcing strict const-ness?

By using const + restrict, _you_ guarantee to the compiler that nothing
will try to change an object, as long as the const+restrict pointer
variable exists. As soon as the const+restrict pointer variable
disappears, you are allowed to modify the object again, unless it is
really const, of course. For example, if a function argument is a
const+restrict pointer, and you pass the address of an object to that
function, then you can modify the object again after the function call
is finished.

[those who know me have no need of my name]

in comp.lang.c i read:

Dear C Mavens, Anyone here getting hosts of spam with nefarious attachments,
purporting to be from M$ or its lackeys, into your mailbox?

I neglected to spoof my header, and since Hurricane Isabel
I have gotten well over 10K such messages.

I get about 100 mails every day :(

a spoofed from header is against my custom. things have calmed down a
little, so i only get around 150 per minute of these swen worms.

--
a signature

[Joe Wright]

those who know me have no need of my name wrote:

in comp.lang.c i read:

Dear C Mavens, Anyone here getting hosts of spam with nefarious attachments,
purporting to be from M$ or its lackeys, into your mailbox?

I neglected to spoof my header, and since Hurricane Isabel
I have gotten well over 10K such messages.

I get about 100 mails every day :(

a spoofed from header is against my custom. things have calmed down a
little, so i only get around 150 per minute of these swen worms.

I get about 50 an hour. Apparently Verisign is doing it to us. They
handle the DNS for .com and .net domains for the entire Internet. Sven
is emailed from non-existent domains and used to be effectively blocked
by anti-spam software which would look up Sven's domain, not find it and
therefore reject the email. Now that no longer works. Verisign's DNS
returns 'found' signal for all domains since early last week. Part of
their SiteFinder feature.

They are being sued. They have to be stopped.
--
Joe Wright mailto:jo****** **@earthlink.ne t
"Everything should be made as simple as possible, but not simpler."
--- Albert Einstein ---

[those who know me have no need of my name]

in comp.lang.c i read:

[re: the swen worm and it's bounces]

I get about 50 an hour. Apparently Verisign is doing it to us.

only indirectly. the worm doesn't synthesize a (potentially non-existent)
domain, it uses the domains present in e-mail addresses it finds in msoe's
local cache, some of which will be invalid yet within .com or .net, so some
of the messages might have been rejected by some mta's were it not for the
wildcard.

--
a signature

[Christian Bau]

In article <m1************ *@usa.net>,
those who know me have no need of my name <no************ ****@usa.net>
wrote:

in comp.lang.c i read:

Dear C Mavens, Anyone here getting hosts of spam with nefarious attachments,
purporting to be from M$ or its lackeys, into your mailbox?

I neglected to spoof my header, and since Hurricane Isabel
I have gotten well over 10K such messages.

I get about 100 mails every day :(

a spoofed from header is against my custom. things have calmed down a
little, so i only get around 150 per minute of these swen worms.

I was thinking about doing lots of posts with forged sender address of
ab***@freeserve .com. Maybe if they get 100 or so 150KB emails per minute
they will figure out that there is a problem and what to do.

My ISPs idea is that whenever I get an Swen32 email I should complain
about it at their "abuse" email address, in which case they would then
find out who sent it (fat chance since the address is forged anyway) and
then probably do nothing about it because it's just a guy with an
infected PC.

What they could do quite easily: Find out which ones of _their own
customers_ are infected. That is quite simple; they only let you access
the Internet through their servers if you call from the right phone
number. So if one of their customers connects and starts sending 150 KB
emails, then some simple programming would direct that customer to a
webpage telling them their computer is infected the next time they try
to connect to any webpage. Install that software with every ISP, and
within a week Swen is gone.

You would think they would come up with something like that, because it
is their money too. Actually, it is only their money, it costs me only
time and nothing else.

[Christian Bau]

In article <m1************ *@usa.net>,
those who know me have no need of my name <no************ ****@usa.net>
wrote:

in comp.lang.c i read:

[re: the swen worm and it's bounces]

I get about 50 an hour. Apparently Verisign is doing it to us.

only indirectly. the worm doesn't synthesize a (potentially non-existent)
domain, it uses the domains present in e-mail addresses it finds in msoe's
local cache, some of which will be invalid yet within .com or .net, so some
of the messages might have been rejected by some mta's were it not for the
wildcard.

I found a few messages that told me that a virus sent from _my_ email
address was caught and not delivered. Since I use a Macintosh I am quite
sure that my computer is not infected; since there are emails going it
with my address as the sender I know that the virus uses real, but
forged, email addresses.

That doesn't mean that Verisign's land grab isn't disgusting and must be
stopped. By the way, the guys are already convicted for sending forged
letters to domain owners where they claim a domain name is up for
renewal (which it usually isn't), and if you fill out the forms and send
them back then you just transferred your domain to Verisign which
charges more than your old name registrar.