Subject: Forged "agentx" postings

From: Randy Presuhn <[email-masked]>
Date: Mon, 18 Mar 2002 20:13:31 -0800 (PST)

Hi -

I've just received some "antivirus bounces" that strongly
suggest that someone/something is forging posts with
a "From" header claiming that they are originating from
[email-masked].  As far as I can tell, these
are NOT being distributed via the working group mailing
list, and are probably originating somewhere in Poland.

In case someone DOES start trying to use the mailing list
to distributed these, I'd like to know in advance whether
there would be any objections to configuring the mailing list
software used for the DISMAN and AGENTX working groups to
block / require list owner approval of any postings containing
any of:

	- MIME multipart/alternative

        - text/html content-type

       	- attachments

... and similar stuff that's dangerous in the hands of some
popular mail readers as commonly configured.  This would
not affect most legitimate postings at all, but would delay
ones that had stuff that the mail filters didn't like.

 ------------------------------------------------------
 Randy Presuhn          BMC Software, Inc.  1-3141
 [email-masked]  2141 North First Street
 Tel: +1 408 546-1006   San José, California 95131  USA
 ------------------------------------------------------
 My opinions and BMC's are independent variables.
 ------------------------------------------------------

---

From: "Natale, Robert C (Bob)" <[email-masked]>
Date: Mon, 18 Mar 2002 23:44:54 -0500

Hi Randy,

I would encourage you to take any steps you consider
appropriate to minimize threats to AgentX list members,
including those you outline below.

I have noticed a rash of similar bogus postings on
other SNMP-related w-mail lists in recent months.
These postings most often use a forged From: header
that leads one to believe it is coming from a known
contributor to the group being targeted.  The message
structure/content typically makes it obvious upon a
quick scan that it is a bogus message with possibly
dangerous content.

It's truly amazing how much time some people have
to waste.

Thanks,

BobN

> -----Original Message-----
> From: Randy Presuhn [mailto:[email-masked]]
> Sent: Monday, March 18, 2002 11:14 PM
> To: [email-masked]; [email-masked]
> Cc: Wijnen, Bert (Bert); [email-masked]
> Subject: Forged "agentx" postings
> 
> 
> Hi -
> 
>  Tel: +1 408 546-1006   San Jose, California 95131  USA

---

From: "Natale, Robert C (Bob)" <[email-masked]>
Date: Mon, 18 Mar 2002 23:44:54 -0500

Hi Randy,

Thanks,

BobN

---

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Tue, 19 Mar 2002 15:49:27 +0100

Sounds good, you have AD support for that

Bert 

> Sent: Tuesday, March 19, 2002 5:14 AM
> Cc: [email-masked]; [email-masked]