From: Brian Wolven <brian.wolven_at_verizon.net>
Date: Mon, 7 Jul 2003 18:38:25 -0400

Bradley M Alexander wrote:
> It is entirely possible that nobody on the list is infected. sobig.E
> does address spoofing. I have gotten several hate mails from people
> around the world telling me to stop sending them infected
> files...Even though my workstation and the two upstream mail servers
> (one of which is in my basement) are all running Linux. Go figure.

It spoofs the "from" address, but the addresses it sends *to* are taken
from the address book (.wab file for OE) on the infected PC. If someone
gets the virus sent to an address they use *only* for this list, it's
likely because that list address was present in the infected someone's
address book. There are other ways it could happen of course, but the OP
probably pointed this out and posted the info to the list in the first
place because it is the most *likely* way for that to happen. Your hate
mails came from people who got a copy with your spoofed "from" address -
even though you could not have sent them, being a User of a Superior OS.
=)
Received on 2003-07-08