[Dixielandjazz] Fw: Info on the virus problem with the Dixieland mailing list.

[Craig Johnson]

Sorry to go back to this, but I sent the headers (you folks sent to me) and
my
suppositions to the Mail list server provider and the response is
below my signature

. In short it appears that IN THIS CASE the notes were NOT
sent directly to you folks but indeed were actually posted to the list
so they got sent out as being normal. Somehow the send faked the
e-mail address of Flip Oakes (masqueraded as him.) That is why the
note was accepted.

But then the note carried a second "unseen" header that was given to the
server
allowing the post to"change disguises during the dance" and emerged looking
like the
server administrator. I DID INDEED carry a virus if you opened it.
So - be warned if you did. Again we repeat, attachments are not
considered legit on this list so, don't open any of them and you'll be safe.

As the admin fellow said, short of having a moderator look at every
note before it gets posted nothing else can be done. As someone else
said before, this is the Internet, this is its present state and we have to
learn to
deal with it. Short of one question I have of the administrator I believe
all we can
do is be vigilant.

IF FLIP is reading this? --- Did you get with a virus on your machine that
MIGHT have contributed to this? I doubt it, but would like to know.

Musical content -- "Masquerade"

Regards,
Craig Johnson

----- Original Message ----- 
From: "Ron Brogden" <domains at islandnet.com>
To: "Craig Johnson" <civanj at adelphia.net>
Sent: Thursday, March 04, 2004 2:25 PM
Subject: Re: Info on the problem with the Dixieland mailing list.


| On March 3, 2004 07:10 pm, you wrote:
| > Here are the headers andm Subject line  ONLY;   not forwarded, no attach
| > etc.
| > -- although I do have a copy saved (unopened.)
|
| Hello Craig.  In this specific case a virus infected message did go out to
the
| list. The problem was that the SMTP "mail from" header was specified as
| "flip at flipoakes.com" who is on the list but the From: field was set to the
| fake address "administration at islandnet.com".  Mailman accepted the "Mail
| From:" address but posted using the From: field address (which I do not
| like but that is a different issue).  Regardless, that is why the message
was
| accepted.  Short of setting the moderation bit on every user these is
| unfortunately no way to stop this type of thing since an open list is by
its
| very nature an open list.
|
| Ron
|
| -- 
| islandnet.com
| http://www.islandnet.com
| support at islandnet.com
| ph: (250) 383-0096 fax: (250) 383-6698
|