Re: Virus posted to list using forged sender address

[Paul Russell <prussell @ nd . edu>]

On 7/20/2004 11:42 PM, Nick Simicich wrote:

> On Tue, 2004-07-20 at 09:34, Chuqui wrote:
> 
>>>Animals
>>
>>Password: 
> 
> 
> One of my listserv lists got one of these - and it came from an alias of
> mine that, literally, had not been used in probably 10 years - it was
> still an alias that could be used to post to the list.

...

> Someone said a similar attack was W32Beagle.  I have not checked this
> one.

There have been at least 3 new Bagle variants discovered in the wild in the
past week, and we have seen a marked increase in the number of copies of
Bagle hitting our central mail servers.

We run A/V software and MIMEDefang on our central mail servers, but we
also configure new lists to reject messages with attachments. The default
configuration for new announcement lists requires confirmation on posting,
and some discussion list owners have imposed the same restriction.

--
Paul Russell
Senior Systems Administrator
OIT Messaging Services Team
University of Notre Dame