Hi (fwd)
Steven M. Bellovin
smb at research.att.com
Thu Mar 18 04:44:38 UTC 2004
In message <Pine.LNX.4.44.0403172118250.2114-100000 at sokol.elan.net>, "william(a
t)elan.net" writes:
>
>
>Me thinks somebody has found a trapdoor in nanog mailsetup and is in
>general out to get us ...
>
>This one supposedely came from 203.18.63.43 (australia powerhous museum -
>phm.gov.au) and advertises page on ip 165.134.187.102 (saint louis
>univerisity - slu.edu). "Connection refused" when I tried to see what's there.
No -- I'm pretty sure it's a worm. Of the 20 copies I've received --
in just the last 3 hours -- only three have been via the NANOG list.
On the bright side, Spamassassin 2.63's default settings seem to kill
this one. In fact, it was only by accident that I even noticed them.
--Steve Bellovin, http://www.research.att.com/~smb
More information about the NANOG
mailing list