Google group FAIL

[John Murphy]

OK, now I'm getting spammed by sf2g emails from mid 2011. Time to switch this group to a Facebook page.

Sent from my iPhone

[Andrew Ballantyne]

We should respect the G in the name? And go for Google+? (that's that annoying thing at the top of my gmail I can't seem to get rid of ;-)

-A

On Feb 10, 2012, at 7:51 AM, John Murphy wrote:

> OK, now I'm getting spammed by sf2g emails from mid 2011. Time to switch this group to a Facebook page.
>
> Sent from my iPhone
>

> --
> store: http://sf2g.com/store.html | blog: http://blog.sf2g.com | terms: http://sf2g.com/terms.html | bike prep: http://sf2g.com/prep.html | unsub: http://groups.google.com/group/sf2g

[Darrin Ward]

fuck that shit.  not signing up for a facebook account.

darrin

On Fri, Feb 10, 2012 at 7:51 AM, John Murphy <ta...@murphstahoe.com> wrote:

OK, now I'm getting spammed by sf2g emails from mid 2011. Time to switch this group to a Facebook page.

Sent from my iPhone

[Beckett Madden-Woods]

It looks like we're getting spammed. Re-emailing old posts from last July. Going to ask around at work for any ideas.

[faye steiner]

I'm getting the old posts too.

F

On Feb 10, 2012 7:52 AM, "John Murphy" <ta...@murphstahoe.com> wrote:

OK, now I'm getting spammed by sf2g emails from mid 2011. Time to switch this group to a Facebook page.

Sent from my iPhone

[Danny Wyatt]

All the ones I'm getting also have me in the To: field, so they're coming to me directly not via the list.  Is that the case for you guys?

Is anyone getting re-delivered mails that have come only from the list?

[Darrin Ward]

or if only there was a biking related site that had a social aspect to it that would allow us to upload our rides and be connected to one another that several sf2gers work at.  :)

lurch

[faye steiner]

Danny,
Yeah, same with me.

Would be nice if some Googler followed up on this/reported the bug to the appropriate person :)

F

[John Murphy]

Anyone good at sniffing headers? Entirely possible the issue is someone's email account has been hacked and is bouncing old mails out. Would explain the old digests showing up too...

J

Sent from my iPhone

[Beckett Madden-Woods]

Lina's on it... and has escalated the question here.

I'm guessing it's some weird phishing thing gone awry. The extra recipient on each fake email points to "wombatsecurity", a company that appears to specialize in anti-phishing and group privacy, of all things.

It's not obvious that any accounts have been hacked (the sender fields are pretty varied, and none of them seem to match the source, which is why Gmail, if you have it, should trigger the phishing warning on the emails). All the sf2g posts are publicly available after all. But since SF2G moderates posts from non-members, you're only seeing the ones that explicitly have you in the to/cc field. (I bet there's a huge pileup in the moderation stream though).

Certainly strange...

[Beckett Madden-Woods]

(In the mean time, if you do use Gmail, I encourage you to click on the "Report phishing" links on some of these emails...)

[djconnel]

Gmail problem?

Delivered-To: djco...@gmail.com
Received: by 10.231.113.161 with SMTP id a33cs18154ibq;
Mon, 11 Jul 2011 15:59:15 -0700 (PDT)
Received: by 10.236.182.103 with SMTP id n67mr46768yhm.
26.1310425155116;
Mon, 11 Jul 2011 15:59:15 -0700 (PDT)
Return-Path: <bec...@beckettmw.com>
Received: from mail-yw0-f50.google.com (mail-yw0-f50.google.com
[209.85.213.50])
by mx.google.com with ESMTPS id q66si34454767yhj.
108.2011.07.11.15.59.13
(version=TLSv1/SSLv3 cipher=OTHER);
Mon, 11 Jul 2011 15:59:14 -0700 (PDT)
Received-SPF: neutral (google.com: 209.85.213.50 is neither permitted
nor denied by best guess record for domain of bec...@beckettmw.com)
client-ip=209.85.213.50;
Authentication-Results: mx.google.com; spf=neutral (google.com:
209.85.213.50 is neither permitted nor denied by best guess record for
domain of bec...@beckettmw.com) smtp.mail=bec...@beckettmw.com
Received: by mail-yw0-f50.google.com with SMTP id 6so1757809ywa.9
for <djco...@gmail.com>; Mon, 11 Jul 2011 15:59:13 -0700
(PDT)
MIME-Version: 1.0
Received: by 10.90.11.29 with SMTP id 29mr4694226agk.
118.1310425153716; Mon,
11 Jul 2011 15:59:13 -0700 (PDT)
Received: by 10.90.33.7 with HTTP; Mon, 11 Jul 2011 15:59:13 -0700
(PDT)
In-Reply-To:
<21f69eb8-246b-49b4...@q29g2000prj.googlegroups.com>
References: <cc2884cf-916b-4bdf-b657-
a59b4c...@t38g2000prj.googlegroups.com>
<1520127.1528.1310422893624.JavaMail.geo-discussion-forums@prkk15>
<CALSqfs19=ktZqR8ogEe_vAO_AGyqh...@mail.gmail.com>
<F184809F-8D66-44FF...@me.com>
<21f69eb8-246b-49b4...@q29g2000prj.googlegroups.com>
Date: Mon, 11 Jul 2011 15:59:13 -0700
Message-ID: <CAMCwDU25LKiGT8Y9a-
xtHRfLw6AMAmXG0a...@mail.gmail.com>
Subject: Re: Recommendation for Garmin?
From: Beckett Madden-Woods <bec...@beckettmw.com>
To: djco...@gmail.com
Cc: SF2G <sf...@googlegroups.com>
Content-Type: multipart/alternative;
boundary=0016361e7a6acac0e704a7d32114

[Lina Mårtensson]

done.

[Nathan Dushman]

At least for me, while the name claims wombatsecurity, it's actually
coming from some Comcast account:

Received: from dev01.wombatsecurity.com
(c-24-131-84-205.hsd1.pa.comcast.net [24.131.84.205])
by andromeda.abtech.org (8.13.8/8.13.8) with ESMTP id
q1AF47AF000537

Nathan

On Feb 10, 8:37 am, Beckett Madden-Woods <beck...@beckettmw.com>
wrote:

> I'm guessing it's some weird phishing thing gone awry. The extra recipient
> on each fake email points to "wombatsecurity", a company that appears to
> specialize in anti-phishing and group privacy, of all things.
>

[Matt Terich]

Yeah, I'm getting the same thing and I even changed my membership to be web-only.

[Eric Altendorf]

looks to me like someone figured out how to spam the list and spoof
everyone's email address. not really a groups thing, as far as I can
tell.

as for facebook -- i didn't realize that was a spam and phishing free zone!

On Fri, Feb 10, 2012 at 9:44 AM, Matt Terich <matt....@gmail.com> wrote:
> Yeah, I'm getting the same thing and I even changed my membership to be
> web-only.
>

[Beckett Madden-Woods]

Hey Scott or another admin. Can you check the moderation queue and see whether there are tons of messages waiting for approval? (if not we'll assume they were blocked as spam)

Thanks,

-Beckett

[Rob Wultsch]

On Fri, Feb 10, 2012 at 1:33 PM, Eric Altendorf <erical...@gmail.com> wrote:

> as for facebook -- i didn't realize that was a spam and phishing free zone!

Given the number of FB'er that read this list, posting spam to a sf2g
FB group would probably be one of the fastest way get a FB account
nuked.

[Scott Crosby]

no, nothing pending.  just made you a manager btw, if you want to check it out.

"love" how groups STILL hasn't migrated the member management to the new interface, and it further spawns a new window to switch to the old one. sigh.

[murphstahoe]

I'm guessing this is some weird phishing thing gone awry.

On Feb 10, 7:51 am, John Murphy <ta...@murphstahoe.com> wrote:
> OK, now I'm getting spammed by sf2g emails from mid 2011. Time to switch this group to a Facebook page.

We should respect the G in the name? And go for Google+?

fuck that shit. not signing up for a facebook account. darrin

as for facebook -- i didn't realize that was a spam and phishing free
zone!

[Eric Altendorf]

Somehow I'm guessing that wouldn't be what stops them, but I guess I
don't know; I don't use FB. :)

[Peter Colijn]

Are there actually a lot of FBers on the list? I rarely ride with
anybody going to FB, but I guess they could be lurking.

Peter

[Peter Chang]

Le 10 février 2012 14:50, Peter Colijn <caff...@colijn.ca> a écrit :
> Are there actually a lot of FBers on the list?

not unless you think two is a lot (1) (or that's the number that have
been on a ride w/ me).

\p

(1) ObRipOff of http://www.youtube.com/watch?v=aLEabGpRPkI

[Johan Beisser]

Ridden with a couple. But, they're rarer than people heading past Castro Street.

[steve armijo]

I tend to fall towards http://en.wikipedia.org/wiki/Hanlon's_razor

I've seen enough newb's go to process mail spools and do exactly this.

I wouldn't be surprised to learn someone at wombatsecurity was using
google group archives for ham.

I'm surprised that we don't see more facebookers regularly. maybe
their quiet period forbids sf2g.

-s

[Andrew Stadler]

Hello, I moderate the newbie queue almost every day, 2x on workdays.  No backup.

Andy

[Peter Chang]

http://www.wombatsecurity.com/antiphishingphil

is the first rest (for me) when i look for wombat phishing. almost funny.

\p

[Eric Altendorf]

That is pretty funny.

I wonder if we should complain to them.

[Ben Kochie]

Update: A fix to the gmail spam detection is going in to help fix
this in the future. However this was mail generated by a 3rd party
reading groups and re-sending mails. People not on gmail will have to
deal with the spam on their own.