[clug] [AUSCERT ALERT - Email worm W32.Beagle.A/Win32.Bagle.A]

[Francis James Whittle]

On Tue, 2004-01-20 at 02:06, Nemo -earth native- wrote:
> For a business solution though, I'd prefer to send a reject that at
> least in some minor way informs the sending system why it wasn't
> accepted. In an ideal world (ok, in an ideal world we wouldn't have spam
> and email worms) ... in a more ideal scenario, my bayesian spamfilter
> would work more intimately with my mailserver, and along with some other
> rules, I might (for example) drop to the floor any mails with .exe
> attachments if they were from any address previously unknown. Once an
> address gets to me as ham once, then future mails from that address
> would allow executables... 

Given that some IBM GSA employees have very recently (ie. yesterday)
been bombarded with email worms claiming to be from people in their
address books and the company contact lists that haven't even seen the
worm, I doubt that's a feasible solution.

-- 
Francis James Whittle
BSEng Student,
Australian National University
Canberra, Australia