Great Circle Associates Firewalls
(September 1996)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Accidental Social Engineering Security Attack
From: Adam Safier <AdamS @ worldnet . att . net>
Date: Sun, 29 Sep 1996 03:12:15 +0000
To: firewalls @ greatcircle . com

I have the e-mail address AdamS @
 worldnet .
 att .
 com .
   When I checked my ATT
e-mail after a hyatus it contained about 90 private messages to/from people
I didn't know.  Most of these people were addressing some part of the
message to Adams, usually a cc. Since the mail was originating on
worldnet.att.com an e-mail addressed to simply Adams ended up in my e-mail.
I am sure they did not mean to send it to me.  Some had Adams as a surname
while others seemed to know someone named Adams.

It took a little while to convince the ATT rep that I considered this a
security problem and have him agree to pass on my recommendation that they
turn off automatic addition of @worldnet.att.com on addresses that don't
have an @.  I realize this is a conveniance feature on Unix SMTP systems but
in a very large service with lots of inexperienced users it can be a
security and privacy problem.

I really wonder if ATT can get it right in the Web access service business.
The 800 support number is really usefull when it should not be needed.  So
far, a slow and rocky start.
---------------------
Example message:

From: Ricky Adams <rickey-kim .
  @
 worldnet .
 att .
 net>
To: postmaster @
 mtigwc01 .
 worldnet .
 att .
 net
cc: rickey, adams
Subject: mail system error
Date: Tue, 30 Jul 96 00:00:11 +0000

I don't understand why my message was not delivered.  My address ( 
rickey-kim .
  @
 worldnet .
 att .
 net ) seems to be correct.

-----------------------

Adam Safier                       AdamS @
 Worldnet .
 att .
 com

Technology Abuse:  Netscape Frames on a 14" screen!


Indexed By Date Previous: Best CFG Sun SparcStation + FW-1
From: Gildasio Rocha Filho <gildasio @ cult . com . br>
Next: Re: authentication w/CERN or other proxy
From: Natchu Vishnu Priya <vishnu @ cs . iitm . ernet . in>
Indexed By Thread Previous: Best CFG Sun SparcStation + FW-1
From: Gildasio Rocha Filho <gildasio @ cult . com . br>
Next: Re: Accidental Social Engineering Security Attack
From: rabbi @ www . valuu . net (Rabbi Haim Cassorla)

Google
 
Search Internet Search www.greatcircle.com