Date: Sun, 20 Feb 2000 20:57:13 -0800 From: tom brown <tomb@cgf.net> To: freebsd-security@freebsd.org Subject: Re: Strange Spam Message-ID: <38B0C5A9.F0776BD2@cgf.net> References: <C49FCB351752A944B116743EBAAE9FE8CB3D@moe.wojo.net>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format. --------------F81BACE454FDFAB580CDE9CF Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Robert I agree. It looks like some of the example work I've seen that is designed to avoid the content detection mechanisum's triggered by strong math techniques. Like you say it has a slight theme, suggesting a key based upon a manuscript? Beats reading about IPFW. Tom "Robert Wojciechowski Jr." wrote: > Richard, > > Looks like some sort of steganography. Look at > http://ip-service.com/cgi-bin/stego.pl, which contains a web interface to > Texto, a steganography program. I tried decoding it with Texto, but it > didn't work. If it is a form of steganography, it could be a custom type > or encrypted with a key which would make it impossible to read it without > knowing the shared secret. > > Another thing about it is that it follows a letter structure. If it's more > than just random words, maybe both parties have a dictionary file with a > special lookup table to map say, "the" to "dodecahedron". But I don't see > many repeating words, so maybe not. It colud also be a stenography program > that creates the correct structure of a letter on purpose for some reason, > even though it's not intelligible text (Texto is at least contains correct > sentence structure). > > The best steganography of course, is the one you never spot as containing > hidden data! > > Ugh, there are a million things it *could* be... I give up already. It's > going to be a chore finding out exactly what. Still very intriguing, and if > you find out what it is... please do share! ;) > > Best Regards, > > --- > Robert S. Wojciechowski Jr. > robertw@wojo.com > > ----------------------------------------------------------------- > > On 20-Feb-2000 22:44:07, Richard Martin writes: > > Has anyone been seeing spam like this lately? It consists of an > > unintelligible sequence of English words. Seems to be just strings of > > randomly generated words, but I am wondering if there is something more > > sinister going on here. Someone accidentally send us an encoded message? > > > > *************** > > > > Hi. This is the qmail-send program at mail.origen.com. > > I tried to deliver a bounce message to this address, but the bounce > bounced! > > > > <zubenanalgenube@origen.com>: > > Sorry, no mailbox here by that name. (#5.1.1) > > > > - --- Below this line is the original bounce. > > > > Return-Path: <> > > Received: (qmail 1747 invoked from network); 20 Feb 2000 18:24:44 -0000 > > Received: from www.cause.org (HELO www.educause.edu) (198.59.61.80) > > by mail.origen.com with SMTP; 20 Feb 2000 18:24:44 -0000 > > From: postmaster@www.cause.org > > To: zubenanalgenube@origen.com > > Date: 20 Feb 2000 18:39:16 -0600 > > Message-ID: <036cc2029181488RKWEB@www.educause.edu> > > Subject: Nondeliverable mail > > MIME-Version: 1.0 > > Content-Type: Multipart/mixed; > > boundary = "NTWEBgGK:EVF+?cBGmzmVxN" > > > > - --NTWEBgGK:EVF+?cBGmzmVxN > > > > - ------Transcript of session follows ------- > > ww@cci.lg.ua > > 550 <ww@cci.lg.ua>... User unknown > > > > - --NTWEBgGK:EVF+?cBGmzmVxN > > Content-Type: message/rfc822; charset=us-ascii > > > > Received: from BEAVISNBUTTHEAD ([63.225.147.56]) by www.educause.edu with > > Microsoft SMTPSVC(5.5.1877.197.19); > > Sun, 20 Feb 2000 18:41:03 -0600 > > To: ww@cci.lg.ua > > From: zubenanalgenube@origen.com > > Subject: RE: from WW > > Return-Path: zubenanalgenube@origen.com > > Message-ID: <036f23327181488RKWEB@www.educause.edu> > > Date: 20 Feb 2000 18:41:06 -0600 > > > > > > StriderCaracas, > > > > Falsetto colonel flak devilish Miami experience Raymond polymerase emulate > > donkey summand Harold paint Daly hill acclimatize evince component seethe > > sarah1 Jewish Quixote Dowling corwin bye formant prince collusion, society > > agrimony lithography waybill Mathematik Zealand Shockley diluent Braun > > retaliate Cortez emphasis hooves we're molt franklin. > > > > Ravine graphic., auric moat. > > > > Mynah, ogle circumpolar nameplate tablespoon octopus curiosity posthumous > > optometrist stressful crossbill bitnet ablution abstract javelin, > continuum > > Bentham conflagration Lissajous choose Thomas matriculate cancel reprise. > > gratuity broad cramp, southernmost jilt, reverberate Joshua malice > homework > > hydrometer ladyfern Fourier biophysic fanfold Alcmena adamant phenolic > > snowstorm deacon swingable. imputation impel bedding hello washout, hopple > > spate doltish erupt thrips Farley, swat twiddle pipsissewa boastful > ambrosia, > > oatcake haunch porterhouse DARPA anhydrite cerebral inexhaustible feast > impede > > bombard annie cynthia contractual Nebuchadnezzar. UHF crepe Galloway > bleach > > function psyllium cap, calico porridge tempestuous nature consul > regretting > > Antioch customary halfback distribution canced Salish redound sepulchral > > kangaroo atonal begrudge factor swine climactic local Skeeter youth > Montevideo > > flash chilblain, spyglass sire Wahl loquacity Rastus waistcoat, kid > > reclamation greet wipe child. kingdom busywork stake sideshow gauzy hank > > indiscernible groupoid baud repetition majesty faint. Aubrey Galatea > > halfhearted inlay Awesome inappeasable NY uprise helmsman lakers scout > feeble > > Whatley, ontology Cochran libretto diablo chatting labia scion tarpaulin. > > > > Melee sang counterweight resident boogie bulldoze Eveready, Wilmington > tong > > whitish rockabye duchess continuant clannish Annale nutate entrepreneur > jade > > boatman, stellar, adjoin churchgo scream Clive briefcase Waco wildfire > > colonist neck concord firework expletive expel gunflint port glob lookup > > boyhood propionate biometry inability comparison arousal differ skeletal > > holography pandemonium Laplacian riverbank ringmaster euglena dulse > Cassandra > > Rockland competitor softball handgun successful, gush Cabot congener > > tripartite ghetto. Grin strabismus Krueger Caesarian., tightwad, Ankara > Peru > > bib coattail galaxy ingrown obsolescent triangular, pinniped amateurish > > adequacy. theoretician, mentor hyperbolic, sniff chip satisfactory > divalent > > physiotherapist rocky dip, superman, buttonhole, ford, guitar lactose > > rapprochement steradian Copperfield Ernst class nominee Wakefield wad > Czerniak > > Caracas Clarence island pyrolysis stratosphere eggshell pulley belch blab > > amnesty uterus poi offensive sciatica electric perspicacious. voice, > whereupon > > foxglove drunk retina radiology Penh limestone. mozzarella titanate > > guillotine, detractor Interpol propensity aphelion comport arc Tutenkhamon > > exculpatory filial, eradicable chumming Clarence Calgary Mollie unify > babyhood > > quanta indium. Batchelder Francisco survive marshmallow fumigate bloodshot > > receive tiger readout academe chatting player, Armonk selenate millstone > > bartend provision system, exegete botch cytosine Indonesian design chicago > > tailor wagoneer potent aforethought pacific alway loin benzene moose > > sympathetic dodecahedron suntanned schist entreaty Comanche anvil yucca. > > > > Arch, > > Ensnare > > > > > > -- > > Richard Martin dmartin@origen.com > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-security" in the body of the message > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message --------------F81BACE454FDFAB580CDE9CF Content-Type: text/x-vcard; charset=us-ascii; name="tomb.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for tom brown Content-Disposition: attachment; filename="tomb.vcf" begin:vcard n:Brown;Tom tel;cell:+1 650 814 5949 tel;home:+1 650 566 8715 tel;work:+1 650 812 9400 x-mozilla-html:FALSE url:http://www.cgf.net/ org:Ministry of Information;Information Adjustment adr:;;;Menlo Park;California;;USA version:2.1 email;internet:tomb@cgf.net title:Historical Adjustments Officer note:This isn't my real job! x-mozilla-cpt:;-4864 fn:Tom Brown end:vcard --------------F81BACE454FDFAB580CDE9CF-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?38B0C5A9.F0776BD2>