Subject: Virus warning: (was: [MSEC] Page uses frames, but your browser doesn)

From: Bob Briscoe <[email-masked]>
Date: Fri, 12 Jul 2002 08:14:11 +0100

msec,

A posting to msec appearing to come from <[email-masked]> with the above subject was sent to the list recently with a base64 coding audio file attached apparently containing a virus. Transcript of our gateway's message about it below, suitably cut.

It seems fairly easy to subscribe to the list  (which may have been done some time ago), request the subscriber list then spoof a mail from one of the members, whether or not the attacker had since unsubscribed. This may have been the approach taken in this attack, given a quick scan of the archive shows the above address has never posted to this list. It may be possible for the list admin to audit recent requests for the subscriber list, which may help track this attack down.

Bob

========================================================================

"An attempt has been made to send a file called unknown into BT's e-mail system, to 
---Cut---
, which was infected with the
Exploit-MIME.gen.b virus.  This virus has been Deleted  

--HPs4d11KC8b3C02F54W731u455Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD></HEAD><BODY>
<iframe src=3Dcid:T8Pc5E1z3tf989q2847 height=3D0 width=3D0>
</iframe>
<FONT></FONT></BODY></HTML>

--HPs4d11KC8b3C02F54W731u455
Content-Type: audio/x-wav;
	name=ÖÐ¿ÆÔºÓë±´¶ûÊµÑéÊÒ¹²½¨Í¨ÐÅ¼¼ÊõÊµÑéÊÒ.bat
Content-Transfer-Encoding: base64
Content-ID: <T8Pc5E1z3tf989q2847>
--Cut---

________________________________________________________
Notice: This contribution is the personal view of the 
author and does not necessarily reflect the technical nor 
commercial direction of British Telecommunications plc.
________________________________________________________
Bob Briscoe      http://www.labs.bt.com/people/briscorj/

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec