?Que es un?spambots?

Albums, Photos, Attachments, Files.and more, all exist and arenalive and well, in IO...

开云体育

Shal,

Mark,

> Also, I don't know how the companies' helpdesks are getting signed up:
> All the lists require a confirmation email so whoever signs them up
> has to somehow have access to the confirmation email.

Not necessarily.

If all that is required is a reply to the confirmation email that could happen automatically as part of the helpdesk's response to any new case.

Good point. This is a possibility and I've been foolish not to think of it!

You are correct. See below.

The trick, if this is done by a malcontent/prankster, is to forge the helpdesk's address as the From address in a subscribe request to the list.

Most Mailman lists allow initial signup via web. You can of course enter any email address you wish in the web form.

This results in an authentication email being sent to the given address with a "confirm <authcode>" string in both the Subject and message body. All that the receiver has to do is to reply to the message and include the "confirm <authcode>" string anywhere in the message body and/or Subject and the email address will be successfully signed up.

Thus, as you say, if the helpdesk software automatically replies to any new email it receives (which most do) then it is trivial to fraudulently sign them up to any Mailman 2 mail list. (I say Mailman 2 because I've not confirmed whether or not this vulnerability still affects Mailman 3).

It could be done by a random-address spambot if the list has a separate email address for subscription (like the +subscribe address of a Groups.io group).

The initial signup could also be done with a web bot, since most MM2 mail lists have exactly identical layouts to the signup page.

it is only a matter of time before it sends a spam (virus, phishing, malware, etc.) message To: the list's subscribe address From: the helpdesk address.

What I have observed is that no spam or malware of any sort seems to be sent to the mail lists using this method. Indeed, there's no point signing up an innocent company's helpdesk in order to send spam/malware to a mail list since anyone can sign up to the mail list anyway with a disposable email address and send spam/malware that way if they want.

If this thing is an attack then it is definitely an attack on the companies (or the companies' helpdesks). I.e. It would seem to be a very feeble DoS attack against the helpdesks.

Thanks for causing me to think it through properly. :-)

-- 
Mark Rousell

开云体育

Check out the?new groups.io Help Center??Use your browser to search or download?the PDF.

The spreadsheet only seems to indicate what is available for 'albums'
which does not answer my question.

Since the free group has 1G of space, I assume this means photos and
files can still be attached to a post/email message.

I know that photo and file albums do not exist anymore.

Also, I don't know how the companies' helpdesks are getting signed up:
All the lists require a confirmation email so whoever signs them up
has to somehow have access to the confirmation email.

开云体育

Only one of the six responded by forwarding a message, which showed a different AOL.com email address as the intended recipient. I looked up that email address in our membership records. There appeared to be nothing out of the ordinary in that member’s subscription. No bounces, and the last message sent out to the group was shown to have been received without problem. So ?I wrote to that member and asked whether they were receiving the group’s messages normally (they’re subscribed to single messages) and let them know that a non-member had received at least one of their emails. I’d like to find out whether the non-member received a duplicate or whether the actual subscriber is missing any emails. That list member has not written back.

There is a certain (limited) similarity between what you are experiencing and what has been happening on some public mail lists (mostly Mailman based I think) over the last year or so. Here is what happens:

(1) Somehow, I do not know how, a legitimate company's customer service email address is signed up to the mail list. In all cases that I have seen, the company is using some sort of CRM/helpdesk software (possibly outsourced, but I'm not sure).

(2) They start receiving messages from the mail list. This automatically generates response emails that are then sent either back to the mail list or to the individual message sender (depending on the mail list settings).

(3) In all cases where I have been bothered to engage, the customer service staff seem clueless. I have never received an intelligent reply and requests to pass it on to their IT people seem to fall on deaf ears. And yet I have been able to establish in all cases where I've looked that the companies are real, legitimate companies.

(4) They either (eventually) learn to read the footers and unsubscribe their email address from the list or the list admin eventually unsubscribes them (a lot of mail lists don't have very attentive admins).

In my experience this has happened over a number of unrelated technical mail lists with a variety of companies' customer service desks (from wholesale flower sellers to travel companies, in my experience).

I am at a loss to know what is going on. It looks like someone trying to carry out a rather feeble DoS attack against either the mail list or the company. Perhaps the companies are getting signed up to thousands of mail lists. I don't know.

Also, I don't know how the companies' helpdesks are getting signed up: All the lists require a confirmation email so whoever signs them up has to somehow have access to the confirmation email.

Although Mailman is far from perfect, I do not know of any vulnerabilities in it that would let a non-admin user sign up a third party to a mail list unless they had access to the third party's incoming email.

So how does this compare with what is happening to you? It seems to me that there is a similarity in that someone, somewhere is redirecting emails to others without their permission. It's technically different and yet perhaps motives are similar (not that I know what such motives really are).

-- 
Mark Rousell

Is there a way that one subgroup can send a message to another
subgroup"

So I write back to each one ... and explain that their email address
is not signed up to get our messages, and ask them to forward to me
any messages they’ve received from my group, so I can see the email
address of the actual subscriber.

Only one of the six responded by forwarding a message, which showed a
different AOL.com email address as the intended recipient. ... So I
wrote to that member and asked whether they were receiving the group’s
messages normally (they’re subscribed to single messages) and let them
know that a non-member had received at least one of their emails. ...
That list member has not written back.

I should add, my group has over 15,232 members, and it’s time-
consuming to have to deal with this problem. I would like to get to
the bottom of it, so I'm not dealing with this every morning.

Is this a glitch in the Groups.io system, or is it an AOL anomaly – or
some combination of both?

We're using subgroups for our committees, so they can each have their own messaging without bothering the main group. Is there a way that one subgroup can send a message to another subgroup"

Check out the?new groups.io Help Center??Use your browser to search or download?the PDF.