New way of spam?

Wed May 14 18:18:57 IST 2008

Hi everybody,

It's the second time in a month that a user get bombarded with tons of 
spam comming from bouncings. They put the users mail account in the From 
so when the mail server replies that the user doesn't exist it get to 
the real user account. As the sending server is legal, the mails get 
trough mailscanner.
Anyone knows a way to stop this?.
Thanks,

Ing. Juan Pablo Lorier
Monte Carlo TV SA
Montevideo, Uruguay
+(598)2 9244444

-----Mensaje original-----
De: mailscanner-request at lists.mailscanner.info 
[mailto:mailscanner-request at lists.mailscanner.info] 
Enviado el: Miércoles, 14 de Mayo de 2008 08:06 a.m.
Para: mailscanner at lists.mailscanner.info
Asunto: MailScanner Digest, Vol 29, Issue 19

Send MailScanner mailing list submissions to
	mailscanner at lists.mailscanner.info

To subscribe or unsubscribe via the World Wide Web, visit
	http://lists.mailscanner.info/mailman/listinfo/mailscanner
or, via email, send a message with subject or body 'help' to
	mailscanner-request at lists.mailscanner.info

You can reach the person managing the list at
	mailscanner-owner at lists.mailscanner.info

When replying, please edit your Subject line so it is more specific
than "Re: Contents of MailScanner digest..."

Today's Topics:

   1. Re: Will Watermarking Stop Backscatter? (Tom G. Christensen)
   2. RE: Will Watermarking Stop Backscatter? (Jason Ede)
   3. RE: Will Watermarking Stop Backscatter? (Martin.Hepworth)
   4. Re: Will Watermarking Stop Backscatter? (Tom G. Christensen)
   5. Re: Will Watermarking Stop Backscatter? (Tom G. Christensen)
   6. RE: Will Watermarking Stop Backscatter? (Koopmann, Jan-Peter)
   7. Re: Will Watermarking Stop Backscatter? (David Jourard)
   8. Re: Will Watermarking Stop Backscatter? (Hugo van der Kooij)

----------------------------------------------------------------------

Message: 1
Date: Tue, 13 May 2008 13:41:30 +0200
From: "Tom G. Christensen" <tgc at statsbiblioteket.dk>
Subject: Re: Will Watermarking Stop Backscatter?
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID: <48297E6A.6020206 at statsbiblioteket.dk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Koopmann, Jan-Peter wrote:
> To answer Daniel's original question: Yes, watermarking should stop 
most
> (if not all) backscatter that is out there. There are commercial
> programs out there as well (e.g. BarricadeMX) that use a very nifty
> E-Mail watermarking system as well. Give them a try. It is worth it.
> 
Stupid question perhaps, but how will it handle this case:
example.com enables watermarking using MailScanner
userA has emailaddress userA at example.com
On his homepc he configures his mail program to use userA at example.com as 

the From adress.
When he sends mail from home he uses his ISP smarthost and not the 
mailsystem at example.com
What happens when mail sent this way is bounced somewhere on the way?

-tgc

------------------------------

Message: 2
Date: Tue, 13 May 2008 12:59:07 +0100
From: Jason Ede <J.Ede at birchenallhowden.co.uk>
Subject: RE: Will Watermarking Stop Backscatter?
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID:
	<4CAB0118AEC63A4FAAE77E6BCBDF760C52F1B0BDFD at server02.bhl.local>
Content-Type: text/plain; charset="us-ascii"

________________________________________
From: mailscanner-bounces at lists.mailscanner.info 
[mailscanner-bounces at lists.mailscanner.info] On Behalf Of Tom G. 
Christensen [tgc at statsbiblioteket.dk]
Sent: 13 May 2008 12:41
To: MailScanner discussion
Subject: Re: Will Watermarking Stop Backscatter?

Koopmann, Jan-Peter wrote:
> To answer Daniel's original question: Yes, watermarking should stop 
most
> (if not all) backscatter that is out there. There are commercial
> programs out there as well (e.g. BarricadeMX) that use a very nifty
> E-Mail watermarking system as well. Give them a try. It is worth it.
>
Stupid question perhaps, but how will it handle this case:
example.com enables watermarking using MailScanner
userA has emailaddress userA at example.com
On his homepc he configures his mail program to use userA at example.com as
the From adress.
When he sends mail from home he uses his ISP smarthost and not the
mailsystem at example.com
What happens when mail sent this way is bounced somewhere on the way?

-tgc

Why not just give that user authenticated outgoing smtp?

Jason

------------------------------

Message: 3
Date: Tue, 13 May 2008 13:15:26 +0100
From: "Martin.Hepworth" <martinh at solidstatelogic.com>
Subject: RE: Will Watermarking Stop Backscatter?
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID: <cce501e3c362d64bbdf10d65710cfa54 at solidstatelogic.com>
Content-Type: text/plain;	charset="us-ascii"

Tom

It won't and if you use SPF it will give a spam result as well.

Email 'should' flow the SMTP gateway for that domain.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Tom G. Christensen
> Sent: 13 May 2008 12:42
> To: MailScanner discussion
> Subject: Re: Will Watermarking Stop Backscatter?
>
> Koopmann, Jan-Peter wrote:
> > To answer Daniel's original question: Yes, watermarking should stop 
most
> > (if not all) backscatter that is out there. There are commercial
> > programs out there as well (e.g. BarricadeMX) that use a very nifty
> > E-Mail watermarking system as well. Give them a try. It is worth it.
> >
> Stupid question perhaps, but how will it handle this case:
> example.com enables watermarking using MailScanner
> userA has emailaddress userA at example.com
> On his homepc he configures his mail program to use userA at example.com 
as
> the From adress.
> When he sends mail from home he uses his ISP smarthost and not the
> mailsystem at example.com
> What happens when mail sent this way is bounced somewhere on the way?
>
> -tgc
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!

**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.
Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.
Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 
Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

------------------------------

Message: 4
Date: Tue, 13 May 2008 14:52:13 +0200
From: "Tom G. Christensen" <tgc at statsbiblioteket.dk>
Subject: Re: Will Watermarking Stop Backscatter?
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID: <48298EFD.8020803 at statsbiblioteket.dk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Jason Ede wrote:
> ________________________________________
> From: mailscanner-bounces at lists.mailscanner.info 
[mailscanner-bounces at lists.mailscanner.info] On Behalf Of Tom G. 
Christensen [tgc at statsbiblioteket.dk]
> Sent: 13 May 2008 12:41
> To: MailScanner discussion
> Subject: Re: Will Watermarking Stop Backscatter?
> 
> Koopmann, Jan-Peter wrote:
>> To answer Daniel's original question: Yes, watermarking should stop 
most
>> (if not all) backscatter that is out there. There are commercial
>> programs out there as well (e.g. BarricadeMX) that use a very nifty
>> E-Mail watermarking system as well. Give them a try. It is worth it.
>>
> Stupid question perhaps, but how will it handle this case:
> example.com enables watermarking using MailScanner
> userA has emailaddress userA at example.com
> On his homepc he configures his mail program to use userA at example.com 
as
> the From adress.
> When he sends mail from home he uses his ISP smarthost and not the
> mailsystem at example.com
> What happens when mail sent this way is bounced somewhere on the way?
> 
> -tgc
> 
> 
> Why not just give that user authenticated outgoing smtp?
> 
Let's say for arguments sake that this is not an option.

My guess would be that example.com rejects the bounce but I'd like a 
second opinion.

-tgc

------------------------------

Message: 5
Date: Tue, 13 May 2008 15:10:42 +0200
From: "Tom G. Christensen" <tgc at statsbiblioteket.dk>
Subject: Re: Will Watermarking Stop Backscatter?
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID: <48299352.7080404 at statsbiblioteket.dk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Martin.Hepworth wrote:
> Tom
> 
> It won't and if you use SPF it will give a spam result as well.
> 
I assume what you're saying is that example.com won't accept the bounce, 

that is pretty much what I expected.

> Email 'should' flow the SMTP gateway for that domain.
> 
Yes I suppose. Damn spammers :(

-tgc

>> -----Original Message-----
>> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
>> bounces at lists.mailscanner.info] On Behalf Of Tom G. Christensen
>> Sent: 13 May 2008 12:42
>> To: MailScanner discussion
>> Subject: Re: Will Watermarking Stop Backscatter?
>>
>> Koopmann, Jan-Peter wrote:
>>> To answer Daniel's original question: Yes, watermarking should stop 
most
>>> (if not all) backscatter that is out there. There are commercial
>>> programs out there as well (e.g. BarricadeMX) that use a very nifty
>>> E-Mail watermarking system as well. Give them a try. It is worth it.
>>>
>> Stupid question perhaps, but how will it handle this case:
>> example.com enables watermarking using MailScanner
>> userA has emailaddress userA at example.com
>> On his homepc he configures his mail program to use userA at example.com 
as
>> the From adress.
>> When he sends mail from home he uses his ISP smarthost and not the
>> mailsystem at example.com
>> What happens when mail sent this way is bounced somewhere on the way?
>>
>> -tgc

------------------------------

Message: 6
Date: Tue, 13 May 2008 15:55:13 +0200
From: "Koopmann, Jan-Peter" <jan-peter at koopmann.eu>
Subject: RE: Will Watermarking Stop Backscatter?
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
	<EMEW-k4CFyY241028f04ee716e32fbd14ecd13b10e6-5F9EB2B0731E5B4D88FC20
780DFD161029C80A at DE-SEXB01RZ.intern.seceidos.de>

Content-Type: text/plain;	charset="US-ASCII"

> Stupid question perhaps, but how will it handle this case:
> example.com enables watermarking using MailScanner
> userA has emailaddress userA at example.com

> When he sends mail from home he uses his ISP smarthost and not the
> mailsystem at example.com

Bad idea.

> What happens when mail sent this way is bounced somewhere on the way?

The bounce will be rejected by the MailScanner system of example.com.

> My guess would be that example.com rejects the bounce but I'd like a 
> second opinion.

Correct.

------------------------------

Message: 7
Date: Tue, 13 May 2008 11:42:17 -0400
From: David Jourard <davidj at bytesinteractive.com>
Subject: Re: Will Watermarking Stop Backscatter?
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID: <4829B6D9.2040002 at bytesinteractive.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Ronny T. Lampert wrote:
>> Backscatter is becoming a real nuisance here. Can I stop it with
>> MailScanner? I did a "backscatter" search on the MS wiki but that
>> yielded nothing. How are all of you dealing with backscatter?
>
> How about taking the easier way and simply reconfigure your front-end
> and back-end servers to not accept any unknown recipients?
>
> For Postfix, simply add LDAP queries (I can help you with them, if you
> are e.g. using AD) - a matter of 5 minutes.
> For Sendmail I've been told it's also relatively easy ;)
I have one client  getting lots of NDRs. 

I want to stop all NDR email just for her email address.

Anyone know how to do this with sendmail or where I can find out.

Thanks in advance.
David J.

------------------------------

Message: 8
Date: Tue, 13 May 2008 18:39:39 +0200
From: Hugo van der Kooij <hvdkooij at vanderkooij.org>
Subject: Re: Will Watermarking Stop Backscatter?
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID: <4829C44B.6050404 at vanderkooij.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tom G. Christensen wrote:
| Koopmann, Jan-Peter wrote:
|> To answer Daniel's original question: Yes, watermarking should stop 
most
|> (if not all) backscatter that is out there. There are commercial
|> programs out there as well (e.g. BarricadeMX) that use a very nifty
|> E-Mail watermarking system as well. Give them a try. It is worth it.
|>
| Stupid question perhaps, but how will it handle this case:
| example.com enables watermarking using MailScanner
| userA has emailaddress userA at example.com
| On his homepc he configures his mail program to use userA at example.com 
as
| the From adress.
| When he sends mail from home he uses his ISP smarthost and not the
| mailsystem at example.com
| What happens when mail sent this way is bounced somewhere on the way?

It will be dumped. The problem is that you shouldn't allow people to do
this to begin with. People may think it is not flexible but it is that
darn "I don't care if is wrong just do it"mentality that is allow so
much spam.

Hugo.

- --
hvdkooij at vanderkooij.org               http://hugo.vanderkooij.org/
PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc

	A: Yes.
	>Q: Are you sure?
	>>A: Because it reverses the logical flow of conversation.
	>>>Q: Why is top posting frowned upon?

Bored? Click on http://spamornot.org/ and rate those images.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFIKcRIBvzDRVjxmYERAtYlAJ97sRUKUxB8QWjRbCupi3oIiKY/8gCfYpXR
TOHFdR06L6Lpru9j00D/oes=
=s5JX
-----END PGP SIGNATURE-----

------------------------------

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read the Wiki (http://wiki.mailscanner.info/).

Support MailScanner development - buy the book off the website! 

End of MailScanner Digest, Vol 29, Issue 19
*******************************************

-- 
Este mensaje ha sido analizado por MailScanner
en busca de virus y otros contenidos peligrosos,
y se considera que est limpio.