[24177] in APO-L
[APO-L] Messages with attachments & subject line change (for some)
daemon@ATHENA.MIT.EDU (Charlie Zimmerman, APO-L Moderator)
Tue Mar 2 22:25:08 2004
Date: Tue, 2 Mar 2004 22:24:41 -0500
Reply-To: CharlieZ@aol.com
From: "Charlie Zimmerman, APO-L Moderator" <CharlieZ@aol.com>
To: APO-L@LISTSERV.IUPUI.EDU
Today's posts that appeared to come from APO-L subscribers but instead were bogus, would-be worm-spreading messages prompt me to share these few points:
1) As noted earlier, worms often use addresses from an infected computer's address book to replicate themselves while using bogus return addresses as well.
2) APO-L will only allow direct posts from subscribers, but evidently the forged return addresses were good to enough to let these messages slip through. I'm not sure that LISTSERV can do anything about this.
3) Despite this deception, APO-L does not allow attachments, so the nasty little worms were stripped, as are any attachments sent to the list.
4) With this in mind, if you ever get an e-mail with an attachment that appears to come from APO-L, just deleted it. It's possible that a worm could use APO-L as a return address just as easily as the posts today that appeared to come from subscribers.
Note: While this is a *possibility*, such an e-mail would most likely NOT have "[APO-L]" at the beginning of the subject line. This has been a default setting for some time, but effective immediately has been implemented for ALL current subscribers. This should provide a clear identifier that posts are indeed coming from the list.
(My apologies if this catches anyone by surpise, but I felt it was worth the inconvenience to provide this added assurance.)
Fraternally,
Charlie Zimmerman
APO-L Moderator
charliez@aol.com
