Why are postmasters distributing the MyDoom virus?

[Richard M. Smith]

Hi,

I was looking over the MyDoom email messages that I received today and found
about 15 copies of the worm which came from postmasters in bounce messages.
Some postmasters, when sending out a bounce message, include the original
email message as an attachment. If a bounce message is for a
MyDoom-infected message, the bounce message will sometimes include an intact
copy of the MyDoom executable which can be run by mistake with a few mouse
clicks.

It looks like some postmasters are in the virus distribution business pretty
much like the MyDoom virus itself. Perhaps these postmasters need to review
their bounce message policies and remove all attached files from messages
being bounced.

Attached is a list of postmasters that appear to have sent me intact copies
of the MyDoom virus today.

Richard M. Smith
http://www.ComputerBytesMan.com

================================================== ============

System Administrator [postmaster@BARCODESOURCE.com]
Mail Delivery Subsystem [MAILER-DAEMON@mailgw2.tiscali.dk]
postmaster@COR.ORG
Mail Delivery System [MAILER-DAEMON@mxr01.nyc02.dsl.net]
Mail Delivery Subsystem [MAILER-DAEMON@dev.adorigin.com]
MAILER-DAEMON [MAILER-DAEMON@swip.net]
postmaster@walde.dk
postmaster@att.net
postmaster@dukerealty.com
postmaster@sjeccd.org
postmaster@wa-gunnet.co.jp
Mail Delivery Subsystem [MAILER-DAEMON@SNET.Net]
Mail Delivery Subsystem [MAILER-DAEMON@msbit.com]

[mgotts@2roads.com]

> > I was looking over the MyDoom email messages that I received todayand
found
> > about 15 copies of the worm which came from postmasters in bounce
messages.
> > Some postmasters, when sending out a bounce message, include the
original
> > email message as an attachment. If a bounce message is for a
> > MyDoom-infected message, the bounce message will sometimes includean
intact
> > copy of the MyDoom executable which can be run by mistake with a few
mouse
> > clicks.
>
> This is sometimes unavoidable. A lot of MyDoom's go to nonexistent
> recipients, and when they are failed with a 5xx failure code, the
sending
> relay (quite reasonably) includes the original message in the bounce.
>

Not only do a lot of MyDoom's go to nonexistent recipients, they go to
nonexistent recipients *by design*. These are intentional bounces where
the worm is putting a simple but typically nonexistent email address in
the "To:" and putting it's intended target address in the "From:". Then it
uses the 5xx failures to deliver the worm via the bounce mechanism, so
that the recipient gets an actual non-delivery report, not a faked one.

It is a subtle distinction, but I don't recall this method of delivery
being used previously. All those bounces/rejections you see in your
mail-server logs for "bill@yourdomain.com", "jane@yourdomain.com",
"john@yourdomain.com", and "sam@yourdomain.com", etc. are NOT really
attempts to deliver the worm to those made-up addresses (though I doubt
the worm author would mind if the addresses did exist...). They are meant
to bounce to the *actual* intended recipient, who is listed in the "From:"

I agree that the 5xx failures correctly bounce the complete message. But
it is that predictable process that is being exploited by the worm author.

-- Mark

[Georg Schwarz]

> It looks like some postmasters are in the virus distribution business pretty
> much like the MyDoom virus itself. Perhaps these postmasters need to review
> their bounce message policies and remove all attached files from messages
> being bounced.

the mails probably bounced (were rejected by the target SMTP server) because
of an invalid recipient address. It is an ordinary and IMHO still good
practise to include the entire original mail in the bounce message.
Those mail servers did not bother about the content of the mail, so they
just sent it back (to the alledged return address), whether or not it
contained any malicious attachment. I think this is exactly what they are
supposed to do, and it is IMHO the best way they can react to the upstream
SMTP rejecting an email.
I think intermediate systems should not tamper with the mail, including
scanning for virii. The worst are such systems that only remove the virus
(which in many cases could easily be scanned for by the reciving system at
the end), leving the rest of the mail as hard-to-filter annoying junkmail.

Now the real issue is you, as the recipient, being in danger of executing
any arbitrary code (with powerful abilities to your system) found in an
email attachment by just an accidental mouse click (regardless how exactly
that mail reached you). Such MUAs are just an invitation for abuse. It is
here where any security measures should start. If it does not, such users
will always remain in jeopardy.


--
Georg Schwarz http://home.pages.de/~schwarz/
geos@epost.de +49 177 8811442