Subject: [OAUTH-WG] Recent spam

From: Neil Madden <[email-masked]>
Date: Wed, 13 Nov 2019 12:27:18 +0000

It appears that overnight some spam was sent out that spoofed my email address and appeared to be a reply to a genuine (old) message on this mailing list. It appears some people are then hitting "Reply All" and so generating additional messages to the OAuth WG mailing list asking to be unsubscribed.

I've checked my own machines and there is no sign of any of them being compromised to send the emails, and there's no trace of any such email in my account's Sent folder - it seems to have been a straightforward email address spoofing. I've asked our IT department to double-check our DMARC/DKIM/SPF settings just to be sure.

Based on the responses I've received, the only people who seemed to received the original spam messages (not the responses) all have "@sympatico.ca" addresses, so it might also be the case that this ISP is not validating incoming emails correctly. I have emailed the ISP to alert them to this, so hopefully the issue will be corrected soon if so.

-- Neil

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 13 Nov 2019 07:41:18 -0500

Thanks Neil,

The chairs are aware of the issue, as we receive notifications to
approve these messages sent by non-members.
We have been receiving these emails for few weeks now, and Glen from IETF
IT is also aware of the issue and he took some measures to try to address
this.
Glen also contacted the ISP but unfortunately he did not hear back from
them.

Regards,
 Rifaat

On Wed, Nov 13, 2019 at 7:27 AM Neil Madden <[email-masked]>
wrote:

> It appears that overnight some spam was sent out that spoofed my email
> address and appeared to be a reply to a genuine (old) message on this
> mailing list. It appears some people are then hitting "Reply All" and so
> generating additional messages to the OAuth WG mailing list asking to be
> unsubscribed.
>
> I've checked my own machines and there is no sign of any of them being
> compromised to send the emails, and there's no trace of any such email in
> my account's Sent folder - it seems to have been a straightforward email
> address spoofing. I've asked our IT department to double-check our
> DMARC/DKIM/SPF settings just to be sure.
>
> Based on the responses I've received, the only people who seemed to
> received the original spam messages (not the responses) all have "@
> sympatico.ca" addresses, so it might also be the case that this ISP is
> not validating incoming emails correctly. I have emailed the ISP to alert
> them to this, so hopefully the issue will be corrected soon if so.
>
> -- Neil
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>