Re: impersonating users on usenet


quasi wrote:

It's very possible that the impersonator randomly hits many usenet
groups, not just sci.math, and if so, it could be a prelude to a wider
attack.

It doesn't look altogether random insofar as the people being
impersonated (at least from what I've seen) tend to be regulars and of
relatively high sanity :) Several are academics, or sound like
academics, which could be a pointer to the perpetrator's motive -- a
resentment of academia, which is not rare. The motive, in any event, is
apt to be a low one.

Because of the uniformity with which the header fields were modified,
and the fact that the content of the spoofed post, so far, has always
been an exact copy of a prior real one, I believe it's probably being
done by a script, rather than manually. Still, even if it's a script,
I'm fairly certain that the script is being run by an actual user.

I have no doubt it's a script, specifically a script for the bulletin
board program called phpBB, which runs (among other places) www dot
sci4um dot com, which in turn sent the spoof above to sci.math. See
http://sci4um.com/index-2.html

LH

.

Loading