Newsgroups Hit by Random Vertical Spam
Catherine Hampton
I have personally verified that the following newsgroups have been
hit by the current random-text vertical spam:
news.admin.net-abuse.misc
alt.religion.christian
alt.religion.christian.boston-church
misc.education.homeschool.christian
pdaxs.religion.christian
rec.music.christian
uk.religion.christian
No moderated newgroups have been hit so far, and I have warned the
moderator of soc.religion.christian, so he is on the lookout. None
of the alt.christnet.* or christnet.* hierarchy has been hit, and
several regional *.religion.christian newsgroups have also been spared.
I have also been mailbombed by this idiot. I'm not sure how heavily,
since after the first couple of messages appeared, I told procmail
to send them to /dev/null and informed my ISP about this. I kept
copies of the first two mailbomb messages, so if someone needs them
to track the idiots down, let me know.
If anyone knows of other newsgroups which have been hit, PLEASE post
to news.admin.net-abuse.misc. If you want to be sure the word gets to
peopel who can help, you can email me and I'll pass it on. :)
Thank you, John Milburn, for issuing cancels and putting autocancel
on for alt.religion.christian.boston-church! If you and the others
could also take mercy on the other newsgroups, I daresay they'd be
equally grateful. :)
Catherien
Arthur Wouk
if you have an rn,trnsrn or xrn type newsreader, then put
/bagend/h:j
i your killfile. it kills'em all.
ask your ISP to put something equivalent in the global killfile.
--
arthur wouk **********Hail*Dogbert*****
internet: wo...@nilenet.com * Make it possible for
* * * * * * * * * * * * * * * * * programmers to write in
English, and you will find that they can't write in English
Robbie Honerkamp
Catherine Hampton (ar...@nntp.best.com) wrote:
:
: I have also been mailbombed by this idiot. I'm not sure how heavily,
: since after the first couple of messages appeared, I told procmail
: to send them to /dev/null and informed my ISP about this. I kept
: copies of the first two mailbomb messages, so if someone needs them
: to track the idiots down, let me know.
Yes, please. In fact, go ahead and post the full headers of one of them..
Robbie
--
Robbie Honerkamp
rob...@shorty.com, rob...@grumblesmurf.net, rob...@mindspring.com
http://www.shorty.com/~robbie/
"It just goes to show you that ProDOS is too horrible to contemplate"
-Imaginos, "Dead III"
Scott Forbes
+-- aw...@ra.nilenet.com (Arthur Wouk) wrote:
| if you have an rn,trnsrn or xrn type newsreader, then put
|
| /bagend/h:j
|
| i your killfile. it kills'em all.
Note that it also killfiles articles from Jan Isley, who is the target of
this attack -- the bombers are forging the line "Nntp-Posting-Host:
bagend.atl.ga.us" to make it look like the spam originates from Jan's
site.
For that reason if no other, I *strongly* recommend against using the
killfile entry listed above. Instead, use (for trn 3.6):
/bagend.atl.ga.us/HNntp-Posting-Host:j
Or killfile the "Path" entries of the open NNTP servers, as follows:
/news.wvdp.com/HPath:j
/news.speedline.ca/HPath:j
/news.data.co.za/HPath:j
/CINT_SRV02/HPath:j
/news.lsumc.edu/HPath:j
I've been advised by Jay Maynard that the "Nntp-Posting-Host" killfile
entry may not work for some newsreaders, due to the nature of the
forgery. If not, try the Path entries shown above; they're the most
reliable method, and the least likely to kill articles that are *not* part
of the spam.
--
Scott Forbes tr...@lucent.com
Lucent Technologies
Jonathan I. Kamens
In article <4u6174$b...@ra.nilenet.com>, aw...@ra.nilenet.com (Arthur Wouk) writes:
|> if you have an rn,trnsrn or xrn type newsreader, then put
|>
|> /bagend/h:j
|>
|> i your killfile. it kills'em all.
This won't kill the spam in XRN, but it WILL kill authentic articles
from Jan Isley, thus accomplishing exactly what you don't want it to
accomplish.
Releases of XRN up to and including 8.02 only kill based on the From
and Subject lines, and don't obey the 'h' modifier at all. The current
beta release of XRN has significantly enhanced kill-file support, and
it will (I hope) be enhanced even more before I put out the next
production release, but the command above won't do what you want it to
even in the current beta release, because it doesn't kill based on
nntp-posting-host.
Followups to news.software.readers.
--
Jonathan Kamens | OpenVision Technologies, Inc. | j...@cam.ov.com
mamatha...@gmail.com
awesom...@gmail.com
> I have personally verified that the following newsgroups have been
> hit by the current random-text vertical spam:
>
> news.admin.net-abuse.misc
> alt.religion.christian
> alt.religion.christian.boston-church
> misc.education.homeschool.christian
> pdaxs.religion.christian
> rec.music.christian
> uk.religion.christian
>
> No moderated newgroups have been hit so far, and I have warned the
> moderator of soc.religion.christian, so he is on the lookout. None
> of the alt.christnet.* or christnet.* hierarchy has been hit, and
> several regional *.religion.christian newsgroups have also been spared.
>
> since after the first couple of messages appeared, I told procmail
> to send them to /dev/null and informed my ISP about this. I kept
> copies of the first two mailbomb messages, so if someone needs them
> to track the idiots down, let me know.
>
> to news.admin.net-abuse.misc. If you want to be sure the word gets to
> peopel who can help, you can email me and I'll pass it on. :)
>
> Thank you, John Milburn, for issuing cancels and putting autocancel
> on for alt.religion.christian.boston-church! If you and the others
> could also take mercy on the other newsgroups, I daresay they'd be
> equally grateful. :)
>
> Catherien
