Re: IRC -> smtp worm?

From: Eric Chien (ecchienat_private)
Date: Wed Dec 18 2002 - 10:53:31 PST

Next message: Gordon Chamberlin: "hpd, afb, sc, and sn"

Previous message: Matt Zimmerman: "Re: DNS help"
In reply to: Joao Gouveia: "IRC -> smtp worm?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

--- Joao Gouveia <tharbadat_private> wrote:
> Here is a sample (IRC user data changed):
> <quote>
> HELO x4i8x4
> RSET
> MAIL FROM: <>
> RCPT TO: <mask!__at_private PRIVMSG #channel :LOL>
> </quote>

Could be one of the many standard SMTP worms that
parse text and html files looking for email addresses.
 The routines that do so are relatively 'inaccurate'
as they may just search for the @ symbol.

And in this case, it may have hit upon an IRC log and
didn't quite parse out the email address properly (or
realize they weren't actually email addresses at all).

...Eric

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Gordon Chamberlin: "hpd, afb, sc, and sn"
Previous message: Matt Zimmerman: "Re: DNS help"
In reply to: Joao Gouveia: "IRC -> smtp worm?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Dec 19 2002 - 19:38:58 PST