Spammers are minning these OSR lists

NTDEV
1

FYI:

I started a new email address two or three weeks ago and it has been 100%
spam-free. I signed up for the OSR lists yesterday and the spam has begun.

I am just dropping a bug in everyone’s ear. I doubt anything can be done.

Jamey

2

Spammers mine anything that resembles an email address in any publicly
readable internet space.

=====================
Mark Roddy

-----Original Message-----
From: Jamey Kirby [mailto:xxxxx@tfb.com]
Sent: Tuesday, November 16, 2004 2:40 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Spammers are minning these OSR lists

FYI:

I started a new email address two or three weeks ago and it has been 100%
spam-free. I signed up for the OSR lists yesterday and the spam has begun.

I am just dropping a bug in everyone’s ear. I doubt anything can be done.

Jamey

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

3

Wow, is this really true?

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Tuesday, November 16, 2004 11:52 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Spammers are minning these OSR lists

Spammers mine anything that resembles an email address in any publicly
readable internet space.

=====================
Mark Roddy

-----Original Message-----
From: Jamey Kirby [mailto:xxxxx@tfb.com]
Sent: Tuesday, November 16, 2004 2:40 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Spammers are minning these OSR lists

FYI:

I started a new email address two or three weeks ago and it has been 100%
spam-free. I signed up for the OSR lists yesterday and the spam has begun.

I am just dropping a bug in everyone’s ear. I doubt anything can be done.

Jamey

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@tfb.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Jamey Kirby wrote:

FYI:

I started a new email address two or three weeks ago and it has been 100%
spam-free. I signed up for the OSR lists yesterday and the spam has begun.

I am just dropping a bug in everyone’s ear. I doubt anything can be done.

OK, we’ll ENTIRELY remove email addresses from the archives (to date
we’ve been changing them to things like “PeterGV_AT_OSR_DOT_COM”… this
obviously is not enough).

A few things to note:

  1. Accessing the lists via the newsgroup requires membership.
    Membership requires responding to the confirmation email. Very unlikely
    a spammer is sufficiently interested to go through this process, so the
    newsgroup interface should be “safe”.

  2. The list is no longer available for internet access (not including
    the archives, which are indeed available)

  3. The archives are indexed and cached by google (as requested and
    promised long ago in this forum).

Remvoing the email addresses from the archives (we’ll try to leave
names) should decrease or eliminate the problem,

Peter
OSR

5

Maybe I misunderstood. Was it only the signup that resulted in your
spammage, not your posting?

=====================
Mark Roddy

-----Original Message-----
From: Jamey Kirby [mailto:xxxxx@tfb.com]
Sent: Tuesday, November 16, 2004 3:13 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Spammers are minning these OSR lists

Wow, is this really true?

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Tuesday, November 16, 2004 11:52 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Spammers are minning these OSR lists

Spammers mine anything that resembles an email address in any publicly
readable internet space.

=====================
Mark Roddy

-----Original Message-----
From: Jamey Kirby [mailto:xxxxx@tfb.com]
Sent: Tuesday, November 16, 2004 2:40 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Spammers are minning these OSR lists

FYI:

I started a new email address two or three weeks ago and it has been 100%
spam-free. I signed up for the OSR lists yesterday and the spam has begun.

I am just dropping a bug in everyone’s ear. I doubt anything can be done.

Jamey

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@tfb.com To unsubscribe send a
blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

6

Hi,

We have the list setup so that you need to login to read the NNTP archives
and the searchable web archives obfuscate the poster’s address, so we’re
taking all of the necessary precautions to sway the average spammer. Your
posts from yesterday aren’t even in the web archive yet, so this is one of 3
things:

  1. A direct attack at Lyris ListManager (though deep down I want to attack
    ListManager myself, I don’t think it’s very likely)

  2. Someone went through the trouble of signing up for the lists, downloading
    the archive and doing a mass spamming. I’m more game for this one, but it
    seems like an awful lot of work for not a lot of email addresses

  3. Someone that is receiving the list posts as email is infected with some
    sort of virus/trojan/mass mailer which picked your email address out and
    spammed it.

The only recourse to these things is really to try and hunt down where the
spam came from and file a complaint with the ISP. It’s a small victory, but
a victory nonetheless.

Regardless, we will look into what else we can do to cut spam down.

OSR List Slave

“Jamey Kirby” wrote in message news:xxxxx@ntdev…
> FYI:
>
> I started a new email address two or three weeks ago and it has been 100%
> spam-free. I signed up for the OSR lists yesterday and the spam has begun.
>
> I am just dropping a bug in everyone’s ear. I doubt anything can be done.
>
> Jamey
>
>
>

7

I changed my e-mail address about 7 months before and still don’t receive any spam. Maybe spam filters on our mail server are so good but I doubt because with previous address at least one spam daily came through.

It is possible spammers found your address another way and you received the first present after subscribe to OSR lists by accident. Or maybe Scott is right and some of list members is infected by trojan which picks up addresses from received mails. Anyway, I’ll use fake sender address for sure :wink:

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]

From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Jamey Kirby[SMTP:xxxxx@tfb.com]
Reply To: Windows System Software Devs Interest List
Sent: Tuesday, November 16, 2004 8:40 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Spammers are minning these OSR lists

FYI:

I started a new email address two or three weeks ago and it has been 100%
spam-free. I signed up for the OSR lists yesterday and the spam has begun.

I am just dropping a bug in everyone’s ear. I doubt anything can be done.

Jamey

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@upek.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

Great. Fake sender address and correct one in the signature :slight_smile: Well, I was using this signature in all posts to the list. I’ll have to check our mail server if there was refused spam sent to my address.

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]

From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Michal Vodicka[SMTP:xxxxx@veridicom.cz.nospam]
Reply To: Windows System Software Devs Interest List
Sent: Tuesday, November 16, 2004 11:09 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Spammers are minning these OSR lists

I changed my e-mail address about 7 months before and still don’t receive any spam. Maybe spam filters on our mail server are so good but I doubt because with previous address at least one spam daily came through.

It is possible spammers found your address another way and you received the first present after subscribe to OSR lists by accident. Or maybe Scott is right and some of list members is infected by trojan which picks up addresses from received mails. Anyway, I’ll use fake sender address for sure :wink:

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]

> ----------
> From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Jamey Kirby[SMTP:xxxxx@tfb.com]
> Reply To: Windows System Software Devs Interest List
> Sent: Tuesday, November 16, 2004 8:40 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Spammers are minning these OSR lists
>
> FYI:
>
> I started a new email address two or three weeks ago and it has been 100%
> spam-free. I signed up for the OSR lists yesterday and the spam has begun.
>
> I am just dropping a bug in everyone’s ear. I doubt anything can be done.
>
> Jamey
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@upek.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

9

Or 4) its a coincidence :wink:

The old ntdev site got mined several times a week. One more reason I
shut it down. Keeping the blacklist up to date was a lot of trouble.
OSR does WAY better at this than I ever could. And since the archive
got created from posts sent to me, my email was at the end of every
archived post, so I got ALL the spam.

  1. doesnt sound likely, nor does 2). Could just be that one of the
    subscribers is an automated collector subscribed to hundreds of lists.
    That wouldnt surprise me.

Scott, maybe try getting a hotmail account and signing it into the list
and see what happens? Then send a post from it to see what happens?

-------- Original Message --------
Subject: Re:[ntdev] Spammers are minning these OSR lists
From: “Scott Noone”
> Date: Tue, November 16, 2004 3:36 pm
> To: “Windows System Software Devs Interest List”
>
> Hi,
>
> We have the list setup so that you need to login to read the NNTP archives
> and the searchable web archives obfuscate the poster’s address, so we’re
> taking all of the necessary precautions to sway the average spammer. Your
> posts from yesterday aren’t even in the web archive yet, so this is one of 3
> things:
>
> 1) A direct attack at Lyris ListManager (though deep down I want to attack
> ListManager myself, I don’t think it’s very likely)
>
> 2) Someone went through the trouble of signing up for the lists, downloading
> the archive and doing a mass spamming. I’m more game for this one, but it
> seems like an awful lot of work for not a lot of email addresses
>
> 3) Someone that is receiving the list posts as email is infected with some
> sort of virus/trojan/mass mailer which picked your email address out and
> spammed it.
>
> The only recourse to these things is really to try and hunt down where the
> spam came from and file a complaint with the ISP. It’s a small victory, but
> a victory nonetheless.
>
> Regardless, we will look into what else we can do to cut spam down.
>
> OSR List Slave
>
> “Jamey Kirby” wrote in message news:xxxxx@ntdev…
> > FYI:
> >
> > I started a new email address two or three weeks ago and it has been 100%
> > spam-free. I signed up for the OSR lists yesterday and the spam has begun.
> >
> > I am just dropping a bug in everyone’s ear. I doubt anything can be done.
> >
> > Jamey

10

I did not mean to start a massive thread on this. I only posted this as an
FYI. It is possible that the spam did not come from OSR mining, however, it
is the only thing I have used the new address for so far.

I know this is a terrible problem for anyone with email. I am not blaming
anyone. It is a reality of today Internet.

Regards,

Jamey Kirby

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@sequest.com
Sent: Tuesday, November 16, 2004 3:25 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Spammers are minning these OSR lists

Or 4) its a coincidence :wink:

The old ntdev site got mined several times a week. One more reason I
shut it down. Keeping the blacklist up to date was a lot of trouble.
OSR does WAY better at this than I ever could. And since the archive
got created from posts sent to me, my email was at the end of every
archived post, so I got ALL the spam.

  1. doesnt sound likely, nor does 2). Could just be that one of the
    subscribers is an automated collector subscribed to hundreds of lists.
    That wouldnt surprise me.

Scott, maybe try getting a hotmail account and signing it into the list
and see what happens? Then send a post from it to see what happens?

-------- Original Message --------
Subject: Re:[ntdev] Spammers are minning these OSR lists
From: “Scott Noone”
> Date: Tue, November 16, 2004 3:36 pm
> To: “Windows System Software Devs Interest List”
>
> Hi,
>
> We have the list setup so that you need to login to read the NNTP archives

> and the searchable web archives obfuscate the poster’s address, so we’re
> taking all of the necessary precautions to sway the average spammer. Your
> posts from yesterday aren’t even in the web archive yet, so this is one of
3
> things:
>
> 1) A direct attack at Lyris ListManager (though deep down I want to attack

> ListManager myself, I don’t think it’s very likely)
>
> 2) Someone went through the trouble of signing up for the lists,
downloading
> the archive and doing a mass spamming. I’m more game for this one, but it
> seems like an awful lot of work for not a lot of email addresses
>
> 3) Someone that is receiving the list posts as email is infected with some

> sort of virus/trojan/mass mailer which picked your email address out and
> spammed it.
>
> The only recourse to these things is really to try and hunt down where the

> spam came from and file a complaint with the ISP. It’s a small victory,
but
> a victory nonetheless.
>
> Regardless, we will look into what else we can do to cut spam down.
>
> OSR List Slave
>
> “Jamey Kirby” wrote in message news:xxxxx@ntdev…
> > FYI:
> >
> > I started a new email address two or three weeks ago and it has been
100%
> > spam-free. I signed up for the OSR lists yesterday and the spam has
begun.
> >
> > I am just dropping a bug in everyone’s ear. I doubt anything can be
done.
> >
> > Jamey

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@tfb.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

11

Michal Vodicka wrote:

Great. Fake sender address and correct one in the signature :slight_smile: Well, I was using this signature in all posts to the list. I’ll have to check our mail server if there was refused spam sent to my address.

Actually… we’re aware of this when we create the archives, so we
actually search and opaque ANYplace an email address appears.

When we do the archive update, we’ll also implement these changes for
email addresses found in message bodies.

Peter
OSR