Home page logo
/

educause logo Educause Security Discussion mailing list archives

Re: spam return address backlash
From: Dick Jacobson <Dick.Jacobson () NDSU NODAK EDU>
Date: Wed, 10 Jan 2007 12:51:19 -0600

On Tue, 9 Jan 2007, Ken Connelly wrote:

Our spam filters catch these so I am not certain of an increase.  However,
I would assume the volume would follow the increase in spam.  Every now
and then I get a question from a user that gets the bounce to email they
didn't send.

I have heard from a couple external users that are pretty irate that our
bounces are going to them when their address was spoofed.  They say that
the RFC is wrong and we should just reconfigure our environment according
to their specifications.  In fact, that is SpamCop's contention also.  We
haven't done that yet.

We see this occasionally, but not often.  And no uptick here in recent
days/weeks.

-ken

Roger Safian wrote:
Greetings,

In the last couple weeks we have seen several of our
addresses used as the from address in spam.  This
causes few serious problems, but does generate an
increase in the number of spam complaints to our
abuse aliases.

It does cause a serious issue if the chosen address
used by the spammer, also happens to be a real
address in use here at Northwestern.  We have
heard of people receiving hundreds of bounced messages
per day if this happens.  We recommend filters,
but there's little else we can do to stop this.

My questions are two.  Is this happening elsewhere,
and if so, have you recently noticed an increase
in this activity?




--
- Ken
=================================================================
Ken Connelly             Associate Director, Security and Systems
ITS Network Services                  University of Northern Iowa
email: Ken.Connelly () uni edu   p: (319) 273-5850 f: (319) 273-7373




----------------------------------------------------------------------- 
Dick Jacobson                   e-mail : Dick.Jacobson () ndus NoDak edu
NDUS IT Security Officer        office : IACC 206, NDSU
ND HECN MultiUser Host SysAdd   phone  : 701-231-7385
----------------------------------------------------------------------- 

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault