From: skaplin@skypoint.com (Samuel Kaplin)
Date: Mon, 19 Dec 94 10:30:20 PST
To: unicorn@access.digex.net
Subject: Re: Automated Witchhunt: I've been slandered by a script.
In-Reply-To: <Pine.SUN.3.91.941218033513.23234C-100000@access3.digex.net>
Message-ID: <vRPzkKjqRagR075yn@skypoint.com>
MIME-Version: 1.0
Content-Type: text/plain


-----BEGIN PGP SIGNED MESSAGE-----

In article <Pine.SUN.3.91.941218033513.23234C-100000@access3.digex.net>, you wrote:
>
>
>
> It seems then that someone is running a process which looks for posts to
> alt.2600, and then automates the above response, original post attached,
> to warn off system admins, fight crime, save the day, etc. etc.
> Either that or Lance is bored again.

Hi Uni,

I found this in alt.revenge and it may have something to do with your
problem. I didn't follow all of it, but then again I don't subscribe to
alt.2600.

Sam


Path: skypoint.com!winternet.com!interactive.net!news.sprintlink.net!howland.reston.ans.net!gatech!n
From: crk_test@guiness.ucns.uga.edu (Danhiel "Deviant?" Baker)
Newsgroups: alt.2600,alt.revenge
Subject: Thanks Cracker Buster!
Date: 17 Dec 1994 17:16:24 GMT
Organization: Beyond the Mists
Lines: 27
Sender: crk_test@guiness.ucns.uga.edu
Message-ID: <3cv6d8$mos@hobbes.cc.uga.edu>
NNTP-Posting-Host: sb.dcs.uga.edu
Approved-By: Derkhil CatSpawn
Originator: dbaker@sb.dcs.uga.edu
Xref: skypoint.com alt.2600:41189 alt.revenge:4501

It's surprising to me that no one else has touched on this before; it'd
seem the natural thing for those that read 2600.  While the automated
messages are rather annoying when you are making a "legit" post, you can use
this 'service' that Cracker Buster is providing for a bit of net-revenge.

News is easy to forge - the spammer demonstrated that quite handily - and
providing a new 'From:' line to a post that points to your favorite net-
nemesis.  Some on alt.2600 are pro'ly already doing a similiar switch in
order to mis-direct the autoresponses and save themself a headache.  With a
little thought I'm sure that you could generate quite an interesting post
that will have their sysadmin suspicious quite quickly.  Just a thought...
For all of his hypocritical "goods intentions", Cracker Buster has provided
another method to cause all of that damage/destruction/evil/traffic
stoppage that he accuses us of.  *grin*

No, I wouldn't actually suggest that you mis-direct the auto-replies in a
malicious way; a couple of "legit" ideas along this line would be to
screw-up your 'From:' line so that Cracker Buster gets a mailbox full of
returned-mail-bad-address (this I *do* suggest, naturlich!) and to add
your own 'Really-From: realme@real.address.com' line with your correct
address so that ppl that _really_ want to get in touch with you can.  Some
variation on the line would be advised -- no need to make it easy for his
responder to handle.  Take a look at the headers on CB's apology post for
more ideas and suggestions.  Pro'ly need a "Sender:" line as well; I'll
know exactly after this post goes thru.

Danhiel


==============================================================================

Doctors are just the same as lawyers; the only
difference is that lawyers merely rob you, whereas
doctors rob you and kill you too.
                        --Anton Chekhov--

==============================================================================
skaplin@skypoint.com                   | "...vidi vici veni" - Overheard
                                       | outside a Roman brothel.
PGP encrypted mail is accepted and     |
preferred.                             | Change is the only constant in the
                                       | Universe..."Four quarters, please."
E-mail key@four11.com for PGP Key or   |
Finger skaplin@mirage.skypoint.com     | Smile!! Big brother is watching.
==============================================================================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: This message digitally signed to verify the identity of the sender

iQEVAwUBLvWaWclnXxBRSgfNAQGNvwf9HyB5p5HtZhYWytQfFfBErf5XhFVrC/WZ
OUfaNbz66XpsAiYVPPuVewH8p5gIDEvS/rqkrZB2QvnekcgsiEcjZgwQHQQDz2rk
T+pbj8niz+s6RY7phauXyIRVA2Uve2y0EPvnmvUgBkiythW3rff0PuB0yWV0QpxK
PfeNnMPZRB9cMfYr4sPerceKu64ttp9sDitxJNeNKJYrS5m1oU5vvjW1/c03r+5n
C7Blulhc4BNMOqWjbWP7+TjoIl+qaXqgnkDToVCt8ZAOCW8v4ANKRnyC3El8K1rb
fdlpAW0WIs5OU4dqbl4ay6OQi2EbMKcYcD1THU3dNOPBILk4xxQgSA==
=LKp0
-----END PGP SIGNATURE-----