Great Circle Associates Firewalls
(September 1996)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Accidental Social Engineering Security Attack
From: rabbi @ www . valuu . net (Rabbi Haim Cassorla)
Date: Sun, 29 Sep 1996 14:37:32 -0400
To: Adam Safier <AdamS @ worldnet . att . net>
Cc: firewalls @ greatcircle . com

The problem may be tirckier, and more serious than you think. I believe, (by
experiment), that some software mail clients, --- e.g. Eudora, will supply
as server and domain, yours, when you send, if you fail to supply.
It is a convenience for those who use Eudora, or other, similar S/W for
intranet.

Shalom

At 03:12 AM 9/29/96 +0000, Adam Safier wrote:
>I have the e-mail address AdamS @
 worldnet .
 att .
 com .
   When I checked my ATT
>e-mail after a hyatus it contained about 90 private messages to/from people
>I didn't know.  Most of these people were addressing some part of the
>message to Adams, usually a cc. Since the mail was originating on
>worldnet.att.com an e-mail addressed to simply Adams ended up in my e-mail.
>I am sure they did not mean to send it to me.  Some had Adams as a surname
>while others seemed to know someone named Adams.
>
>It took a little while to convince the ATT rep that I considered this a
>security problem and have him agree to pass on my recommendation that they
>turn off automatic addition of @worldnet.att.com on addresses that don't
>have an @.  I realize this is a conveniance feature on Unix SMTP systems but
>in a very large service with lots of inexperienced users it can be a
>security and privacy problem.
>
>I really wonder if ATT can get it right in the Web access service business.
>The 800 support number is really usefull when it should not be needed.  So
>far, a slow and rocky start.
>---------------------
>Example message:
>
>From: Ricky Adams <rickey-kim .
  @
 worldnet .
 att .
 net>
>To: postmaster @
 mtigwc01 .
 worldnet .
 att .
 net
>cc: rickey, adams
>Subject: mail system error
>Date: Tue, 30 Jul 96 00:00:11 +0000
>
>I don't understand why my message was not delivered.  My address ( 
>rickey-kim .
  @
 worldnet .
 att .
 net ) seems to be correct.
>
>-----------------------
>
>Adam Safier                       AdamS @
 Worldnet .
 att .
 com
>
>Technology Abuse:  Netscape Frames on a 14" screen!
>
>


Indexed By Date Previous: Re: FW-1 - less secure ?
From: Ron DuFresne <dufresne @ winternet . com>
Next: Re: FW-1 - less secure ?
From: rabbi @ www . valuu . net (Rabbi Haim Cassorla)
Indexed By Thread Previous: Accidental Social Engineering Security Attack
From: Adam Safier <AdamS @ worldnet . att . net>
Next: Re: FW-1 - less secure ?
From: rabbi @ www . valuu . net (Rabbi Haim Cassorla)

Google
 
Search Internet Search www.greatcircle.com