Porn Spam using Slashdot.org name

I've gotten a lot of mail, and seen this submitted - a porn site has sent mail using the Slashdot.org name, purporting to be Slashdot.org. They are not. We don't, and will not send mail out using your name. Click below for the full text of the message that was sent out. Update: 06/17 12:56 by H :Current going theory (thanks to Mark Rietman) is The list is the one maintained at distributed.net. This is because they used my distributed.net@rsoft.demon.nl adress (which i never use anywhere else). It's a list open to public (team stats-page --> memberslist) Update: 06/17 01:09 by CT : I just wanted to apologize. I'm getting a lot of hate mail, and I just want to reiterate that we didn't do this, and that I wish bad things would happen to the bastards who did this. I consider forging email to be among the worst of all net.crimes. And don't visit the site or you'll just encourage these pricks.

[TEXT OF MAIL FOLLOWS]

"X-Received: from pony-1.mail.digex.net (pony-1.mail.digex.net [204.91.241.5]) by groucho.med.jhmi.edu (980427.SGI.8.8.8/970903.SGI.AUTOCF) via ESMTP id AAA56584 for ; Thu, 17 Jun 1999 00:14:26 -0400 (EDT)

X-Received: from zamboni.mail.digex.net (zamboni.mail.digex.net [204.91.99.98])
by pony-1.mail.digex.net (8.9.3/8.9.3) with ESMTP id AAA14165
for ; Thu, 17 Jun 1999 00:11:07 -0400 (EDT)

X-Received: from mx.icp.rssi.ru (mx.icp.rssi.ru [194.85.223.7])
by zamboni.mail.digex.net (8.9.3/8.9.3) with ESMTP id AAA01690
for ; Thu, 17 Jun 1999 00:11:06 -0400 (EDT)

X-Received: from mx.intra.ru ([194.135.182.7]) by mx.icp.rssi.ru
(post.office MTA v1.9.3b **** trial license expired ****)
with ESMTP id AAA224 for ;
Thu, 17 Jun 1999 08:08:50 +0400

X-Received: from ras5.icp.rssi.ru by mx.intra.ru with SMTP (Microsoft Exchange Internet Mail Service Version 5.0.1458.49)
id MQ9VDG1N; Thu, 17 Jun 1999 08:08:00 +0400
From: "slashdot.org" To: Date: Thu, 17 Jun 1999 08:07:52 +0300
Subject: Dear Member of slashdot.org (eisen@access.digex.net)
Reply-To: support@slashdot.org
Organization: slashdot.org
Content-Type: multipart/mixed; boundary=XX0BFF0BCE-00350BFFXX
X-Priority: 3
ReSent-From: Halmonster ReSent-To:

This is a Multipart MIME message. Since your mail reader does not understand this format, some or all of this message may not be legible.

--XX0BFF0BCE-00350BFFXX
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Hello dear member!
Slashdot.org offer you new service of overclocking your operation system (w=
in95/98/NT/linux/mac=20
and more)
For more information please visit http://join.at/freepc CT:DO NOT CLICK THIS LINK! ITS A PAGE OF DAMN BANNER ADS! THIS IS A SCAM!
We always think about You

------------------------------------------
This message was sent to you by
Name: slashdot.org
Email Address: support@slashdot.org
IP Address: ras5.icp.rssi.ru
------------------------------------------

Using Aureate Group Mail Free Edition
Find out more about this product and try it=20
for free at: link
--XX0BFF0BCE-00350BFFXX--
"

Comments

Spam to distributed.net team members

[Decibel]

As far as we can tell, the spammer did harvest the email addresses from our stats database. They seem to have targeted both the /. team as well as the OS/2 Warp team.

As mentioned in our official announcement below, we're going to try to make it as hard as possible for spammers to grab email addresses, but its to impossible to protect emails that are listed 'out in the open'. If you're concerned about spam, PLEASE edit your info so that you are not listed by your email address.

Again, we apologize to those of you who were targeted by this spammer. Its very disapointing that someone would use the services of a non-profit organization, who's goal is to make the computing world a better place, to send spam.

Here's our official announcement:
Yesterday, a spammer 'harvested' email addresses from our stats database and sent out spam with spoofed email headers, making it appear that the spam came from slashdot.org or team warped. It appears that the spammer took email addresses out of the team member listing for the Slashdot team, the OS/2 Warp team, and perhaps other teams.

We are looking into ways we can make it harder for spammers to harvest email addresses from the stats database. Given the determination of some spammers, it will be difficult for us to completely protect email addresses without taking the stats off-line completely. Currently, our best line of defense is to allow participants to be listed by something other than their email address. If anyone has other suggestions, feel free to send them to our mailing list, rc5@lists.distributed.net.

If you are worried about your address being harvested, we strongly suggest that you edit your participant info and change how you are listed. In addition to being listed by your address, you can also be listed at 'Participant 123456' or by your name, which you can specify on the same page.

To edit your information, you need your password. If you don't have it, take a look at your personal stats listing at http://stats.distributed.net and click the link at the bottom of your listing that says 'I cannot remember my password. Please email...'

Once you have your password, go to http://stats.distributed.net/pedit.php3 You will be asked for a user name and a password. Your user name is your email address, and your password is the password that was mailed to you.

We hope that our users already assume this, but to clarify, distributed.net will never, ever sell or otherwise distribute your email addresses. The only method for people to retrieve email addresses is via the stats database. We do not support spam, and we're very sorry that someone would use our services to spam people.

Jim Nasby
distributed.net Human Interface

How to LART this spammer:

[strredwolf]

Right out of the books from SPUTUM and Sam Spade, both good anti-spam sites...

mx.icp.rssi.ru is an OPEN RELAY used by spammers to hide their tracks. Complain to postmaster@rssi.ru about it and send this spam to them, with full headers.

The spammer is hosted via intra.ru. Send mail to abuse@intra.ru and postmaster@intra.ru with the full headers and spam and say "You have a spammer on your system which is compromizing security and profits. Please remove."

Also, visit The Radparker Relay Spam Stopper to block the relay on subscribed systems.

---
Spammed? Click here for free slack on how to fight it!