The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Special Forums > Security
.
google unix.com




View Single Post in the UNIX and Linux Forums - Click on the Thread or Permalink to View Entire Thread -->
  #5 (permalink)  
Old 11-01-2002
Neo's Avatar
Neo Neo is offline Forum Staff  
Administrator
  
 

Join Date: Sep 2000
Location: Asia Pacific
Posts: 6,815
As I understand the poster, he is not talking about relaying (one problem) he is talking about the "Reply-To" field where spammers are using his valid email address in their spam "Reply-To" field.

This is a common technique by spammers and you can't filter on source address or you could block 'the good guys' (people like you receiving spam).

It is like when a spammer sends me email and my email address is in the 'Reply To' field... I certainly don't like blocking me from myself and the scenarios go on and on. There are many variations of this spam technique.

However, if the email is being bounced, you can easily filter your server to just blackhole all mail from "mailer-daemon" and similar source addresses from bounced mail. You must examine the mail and set up appropriate filters.

You might find this paper of interest:

http://www.silkroad.com/papers/html/bomb/

the paper describes email bombs, countermeasures and filtering basics.

I'm finding programs like Mailwasher more and more useful: www.mailwasher.net but this gem runs only on MS products; so I queue mail on linux and wash with Mailwasher first thing in the morning (like brushing my teeth) or whenever I've been away for a long time; after washing I read with my standard mail user agent. The developer of Mailwasher is very responsive (Nick) and he has added a couple of features at my request in the past month.