Re: More on SPAMing

[news@chakotay.ncc74656.org (News system)]

In article <38251E05.CBDE9070@idt.net>, Tom Greene  <cowgod@idt.net> wrote:
>Here's what I know about reading usenet headers. I can't guarantee that
>this info is 100% correct, but it has served me well. :)
>
>
>> Path: typhoon01.swbell.net!cyclone.swbell.net!bos-service1.ext.raytheon.com!cambridge1-snf1.gtei.net!cam-news-hub1.bbnplanet.com!news.gtei.net!newsfeed.mathworks.com!wn3feed!worldnet.att.net!wnmaster1!not-for-mail
>
>The Path: line above is one place to look to see where the message came
>from. It shows all the news servers that the message went through to get
>from the spammer to you. The last server in the line should be the news
>server the spammer posted to. In this case, it seems to have been posted
>via worldnet.att.net.

Actually, the last machine was "wnmaster"...don't know if that's one of
AT&T's boxen or not.  It might be (wn->Worldnet?), but then it might not be. 
If you look at the Path line of this message, the last host (which is the
one from which this message originated) is chakotay.ncc74656.org.  This
hostname won't resolve against any DNS server; it's my Linux server, which
has a private IP address (192.168.100.1, if you're curious) and communicates
with MindSpring's news server through pppd and suck.  (Suck is a package
that allows you to grab small newsfeeds and post replies by making your news
server pretend that it's a client (it doesn't use the NEWNEWS and IHAVE
commands when communicating with servers).

(Why go to this trouble?  I don't like the Win9x-based newsreaders I've
tried.  I prefer trn, but it runs a bit slow over a dial-up connection.  I
use suck and INN to maintain four days' worth of selected (non-binaries,
except for comp.binaries.apple2) newsgroups for "offline reading."  One
other advantage is that it makes spammers' lives more difficult; the only
place my real email address shows up is in my .sig, and it's obscured
somewhat heavily.  The URL for my website is in cleartext, but how many
spammers follow URLs from Usenet to harvest email addresses in webpages?)

>Note that this line can have spoofed entries on it, usually at the end.

OK, so you didn't forget this.  My bad. :-)

>> Organization: AT&T WorldNet Services
>
>Many times organization line is added by the news server the message was
>posted to. I know the server for my provider adds the following line:
>'Organization: IDT (Best News In The World)'

Many newsreaders will allow you to change this.  If an Organization line is
present when you post an article, most news servers will respect it and
leave it alone.  Note that MindSpring didn't overwrite mine, but left it as
"USS Voyager NCC-74656, Delta Quadrant."

>> Message-ID: <800pqi$5i6$551@bgtnsc01.worldnet.att.net>
>
>Again, this shows that the message was posted to an att.net news server.
>I'm almost certain this line cannot be faked.

Message IDs can be generated by the reader, but I suspect that most of 'em
leave that job to the server.  Note that the ID of this message is something
along the lines of <blahblah@chakotay.ncc74656.org>.  That was generated by
my (private) news server and left alone by MindSpring's server.

You can also achieve the same effects by telnetting to port 119 on a news
server and POST your message directly.  If you were truly evil, you could
put names of a few random servers (culled from other posts, if you like) in
the Path line of your message.  Back in the day, I had some macros between
ProTERM and AppleWorks/UltraMacros that served as a crude offline news
reader; it worked by telnetting to my ISP's news server to grab and post
news.

  _/_
 / v \
(IIGS(  Scott Alfter (salfter at (yo no quiero spam) delphi dot com)
 \_^_/  http://people.delphi.com/salfter