<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>OT: Secret email?!</TITLE>
</HEAD>
<BODY>
<BR>
<P><FONT SIZE=2 FACE="Courier">Greetings all</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier">I know this might have been brought up before so please disregard if</FONT>
<BR><FONT SIZE=2 FACE="Courier"> so. Thought it might be of interest to some.</FONT>
</P>
<P> <FONT SIZE=2 FACE="Courier">While looking for ways to indicate that nimda/codered ect was </FONT>
<BR><FONT SIZE=2 FACE="Courier">pushed to a client within my network, I tripped across something </FONT>
<BR><FONT SIZE=2 FACE="Courier">completely unrelated, but interesting. </FONT>
</P>
<P><FONT SIZE=2 FACE="Courier">It seems these email clients that utilize html formating also </FONT>
<BR><FONT SIZE=2 FACE="Courier">send out information unknowingly. I know nothing new, but heres </FONT>
<BR><FONT SIZE=2 FACE="Courier">the senario. A spam email arrives, client opens/previews the email </FONT>
<BR><FONT SIZE=2 FACE="Courier">and its pretty gifs/jpgs ect, while at the bottom a link is retrieving </FONT>
<BR><FONT SIZE=2 FACE="Courier">what looks like a logo. Example:</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier"><a href="</FONT><U><FONT COLOR="#0000FF" SIZE=2 FACE="Courier"><A HREF="http://www.em5000.com" TARGET="_blank">http://www.em5000.com</A></FONT></U><FONT SIZE=2 FACE="Courier">"><img src="</FONT><U><FONT COLOR="#0000FF" SIZE=2 FACE="Courier"><A HREF="http://www.em5000.com/counter.php?client=newhorizons&email=myemail@addy.com&msgid=281101000" TARGET="_blank">http://www.em5000.com/counter.php?client=newhorizons&email=myemail@addy.com&msgid=281101000</A></FONT></U><FONT SIZE=2 FACE="Courier">" width="109" height="16" border="0" alt="em5000.com"></a></FONT></P>
<P><FONT SIZE=2 FACE="Courier">What it does in fact is send information to a host </FONT>
<BR><FONT SIZE=2 FACE="Courier">(from the firewall's view):</FONT>
<BR><FONT SIZE=2 FACE="Courier">12:54:01: %PIX-5-304001:</FONT> <FONT COLOR="#0000FF" SIZE=2 FACE="Courier">10</FONT><FONT SIZE=2 FACE="Courier">.</FONT><FONT COLOR="#0000FF" SIZE=2 FACE="Courier">1</FONT><FONT SIZE=2 FACE="Courier">.</FONT><FONT COLOR="#0000FF" SIZE=2 FACE="Courier">1</FONT><FONT SIZE=2 FACE="Courier">.</FONT><FONT COLOR="#0000FF" SIZE=2 FACE="Courier">10</FONT><FONT SIZE=2 FACE="Courier"> Accessed URL</FONT><FONT COLOR="#0000FF" SIZE=2 FACE="Arial"></FONT> <FONT SIZE=2 FACE="Courier">66.77.58.92:/counter.php?client=newhorizons&email=</FONT><FONT COLOR="#0000FF" SIZE=2 FACE="Courier">myemail</FONT><FONT SIZE=2 FACE="Courier">@</FONT><FONT COLOR="#0000FF" SIZE=2 FACE="Courier">domain.com</FONT><FONT SIZE=2 FACE="Courier">&msgid=281101000</FONT><FONT SIZE=2 FACE="Courier"> </FONT></P>
<P><FONT SIZE=2 FACE="Courier">(from the host's view):</FONT>
<BR><FONT SIZE=2 FACE="Courier">GET /counter.php?client=newhorizons&email=myemail@domain.com&msgid=281101000 HTTP/1.1</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier">which in turn (I suppose) places my email address into a database thats used </FONT>
<BR><FONT SIZE=2 FACE="Courier">for spaming. i.e. verifying that my email address is valid. While watching </FONT>
<BR><FONT SIZE=2 FACE="Courier">for this behavior, I saw about 10 other nodes/users do this, none of which </FONT>
<BR><FONT SIZE=2 FACE="Courier">knew the information had been sent out. Kind of sneaky if you ask me.</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Courier">Cheers</FONT>
<BR><FONT SIZE=2 FACE="Courier">-Joe</FONT>
</P>
<BR>
</BODY>
</HTML>