Re: [Evolution] Mail Delivery (failure evolution ximian com)
- From: Ron Johnson <ron l johnson cox net>
- To: evolution lists ximian com
- Subject: Re: [Evolution] Mail Delivery (failure evolution ximian com)
- Date: Sun, 16 May 2004 22:00:22 -0500
On Sun, 2004-05-16 at 22:06 +0100, James Ascroft-Leigh wrote:
On Sun, 2004-05-16 at 08:47 -0500, Ron Johnson wrote:
On Sun, 2004-05-16 at 13:30 +0100, James Ascroft-Leigh wrote:
On Sat, 2004-05-15 at 20:15 -0500, Ron Johnson wrote:
On Sun, 2004-05-16 at 00:25 +0100, James Ascroft-Leigh wrote:
On Fri, 2004-05-14 at 09:57 +0900, fejj ximian com wrote:
If the message will not displayed automatically,
follow the link to read the delivered message.
Received message is available at:
I am using the 1.5.7 build from Debian unstable + experimental. The
Did you get this email privately, or via the ML? This reminds me of
the social engineering I've seen on some recent viruses.
It appeared to come from the evolution mailing list but, of course, that
may be forged. Another likely explanation is that some virus scanner
That's what the social engineer wants you to think. Do a "Show
Email Source" on the original mail, and I bet that the ximian.com
"link" is really a phony, that runs a virus, or sends you to a
I have looked at the source and I know the link points to a mime part
with the mime type audio/x-wav but the name indicates a Microsoft
Windows screen-saver (message.scr).
What worries me is that this message is:
* Not displayed as having an attachment (no paper-clip icon) in
* Causes Evolution to crash.
If other people have not seen it I can obfuscate the
message to get it around the scanners and repost.
You obviously have not seen the message I am referring to so I have
I must have been ambiguous when I said "This reminds me of the
social engineering I've seen on some recent viruses."
The reason I've seen them is because I've received them. That's
how I know it's good (but not good enough!) social engineering....
And it didn't crash my Evo because I was suspicious, and first
looked at the email source. Then deleted it...
The file is obfuscated by combining the original email
source as one stream and an infinite stream of "guessmeguessme" with a
bit-by-bit exclusive or operation. I am not to blame if somebody
manages to infect themselves. Microsoft Windows users beware - THE
ATTACHMENT CONTAINS A VIRUS.
Ron Johnson <ron l johnson cox net>
] [Thread Prev