Subject: news gateway malfunctioning?

From: Alvaro Herrera <[email-masked]>
Date: Wed, 4 Mar 2009 16:45:01 -0300

Hi Marc,

Lately I have gotten a number of moderation request for -hackers and
other lists that look like the attached message.  From the header it
looks to me like they are coming from the USENET gateway; I wonder
what's up with the "RCPT TO" stuff at the top of the body of the
message.  Is the gateway getting confused by the mangling done by the
spam checker?

-- 
Alvaro Herrera                         http://www.flickr.com/photos/alvherre/
"Y eso te lo doy firmado con mis lágrimas" (Fiebre del Loco)

Subject: D3DF-3B9E-0982 : CONSULT from pgsql-hackers (post)
From: [email-masked]
To: [email-masked]
Date: Wed, 04 Mar 2009 10:20:14 -0400

__ 
The following request:

  "(post to pgsql-hackers)"

was sent to postgresql.org
by [email-masked].

The request requires your confirmation for the following reason(s):

  The author ([email-masked])
  is not a member of any of the restrict_post groups.

To accept or reject this request, please do one of the following:

1. If you have web browsing capability, visit
   <http://mail.postgresql.org/mj/mj_confirm/domain=postgresql.org?t=D3DF-3B9E-0982>
   and follow the instructions there.

2. Reply to [email-masked] 
   with one of the following two commands in the body of the message:

    accept
    reject

   (The number D3DF-3B9E-0982 must be in the Subject header)

3. Reply to [email-masked] 
   with one of the following two commands in the body of the message:
   
    accept D3DF-3B9E-0982
    reject D3DF-3B9E-0982

4. If you know the administrative password for the pgsql-hackers list,
   all pending requests can be managed by visiting
   <http://mail.postgresql.org/mj/mj_wwwadm/domain=postgresql.org/pgsql-hackers?func=showtokens>

If you do not respond within 7 days, this token will expire,
and the request will not be completed.

Subject: (NONE)
From: [email-masked]
To: [email-masked]
Date: Wed, 4 Mar 2009 09:50:11 -0400 (AST)

MAIL FROM: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
DATA
From: =?koi8-r?B?5tXOy8PJySDTxcvSxdTB0tE=?= <[email-masked]>
To: <[email-masked]>
Subject: =?koi8-r?B?5tXOy8PJz87BzNjO2cUgz8LR2sHOzs/T1MkgIMkg3NTJy8XUICDTzNXW?=
	=?koi8-r?B?xcLO2cggz9TOz9vFzsnKINPFy9LF1MHS0Q==?=
Date: Wed, 4 Mar 2009 23:34:24 +0800

This is a multi-part message in MIME format.

------=_NextPart_000_0007_01C99CDE.B2948380
Content-Type: text/plain;
	charset="koi8-r"
Content-Transfer-Encoding: quoted-printable

=E4=C5=CC=CF=D0=D2=CF=C9=DA=D7=CF=C4=D3=D4=D7=CF -  =CF=D2=C7=C1=CE=C9=DA=C1=
=C3=C9=D1 =C4=CF=CB=D5=CD=C5=CE=D4=CF=CF=C2=CF=D2=CF=D4=C1 =D0=D2=C5=C4=D0=D2=
=C9=D1=D4=C9=D1=20
=E9=CE=C6=CF=D2=CD=C1=C3=C9=C0 =CD=CF=D6=CE=CF =D0=CF=CC=D5=DE=C9=D4=D8 =D0=
=CF =D4=C5=CC=C5=C6=CF=CE=C1=CD: (cod =ED=CF=D3=CB=D7=D9) 7/9/2-21 22;  =FE=
45-=FA9  68

 =20
    V=CF=D3=C5=CD=CEad=C3=C1=D4=CFg=CF =CD=C1=D2ta 2009 =C7.
 =20

=F0=D2=CF=C7=D2=C1=CD=CD=C1 =CD=C5=D2=CF=D0=D2=C9=D1=D4=C9=D1 1-=CA =C4=C5=CE=
=D8:=20

  =EE=CF=D2=CD=C1=D4=C9=D7=CE=CF-=D0=D2=C1=D7=CF=D7=D9=C5 =C1=CB=D4=D9 =D0=CF=
 =C4=C5=CC=CF=D0=D2=CF=C9=DA=D7=CF=C4=D3=D4=D7=D5. =EF=D3=CE=CF=D7=CE=D9=C5=
 =CB=C1=D4=C5=C7=CF=D2=C9=C9 =C4=CF=CB=D5=CD=C5=CE=D4=CF=D7. =F3=CF=DA=C4=C1=
=CE=C9=C5 =F4=C1=C2=C5=CC=D1 =D5=CE=C9=C6=C9=C3=C9=D2=CF=D7=C1=CE=CE=D9=C8 =
=C6=CF=D2=CD =C4=CF=CB=D5=CD=C5=CE=D4=CF=D7 =D0=D2=C5=C4=D0=D2=C9=D1=D4=C9=D1=

---

From: "Marc G. Fournier" <[email-masked]>
Date: Thu, 5 Mar 2009 00:20:23 -0400 (AST)

> message.  Is the gateway getting confused by the mangling done by the

I'm a bit lost here, so bare with me ...

First question, I guess, is whether there are othe rmessages showing up 
that RCPT TO stuff, or is it just these types of 'spam' messages ... ?

The oddness here is that it almost looks like someone manually connected 
to the smtp port and tried to inject the message manually ... and ended up 
injecting the 'formatted message' that has all the SMTP cmds embeded ...

The second question is ... mangling done by what spam checker?  Our spam 
checker does nothing except add some X-Spam / X-Virus related headers ... 
the body isn't touched ...

  ----
Marc G. Fournier           Hub.Org Networking Services (http://www.hub.org)
Email . [email-masked]                              MSN . [email-masked]
Yahoo . yscrappy               Skype: hub.org        ICQ . 7615664

---

From: Alvaro Herrera <[email-masked]>
Date: Thu, 5 Mar 2009 10:27:28 -0300

> that RCPT TO stuff, or is it just these types of 'spam' messages ... ?

As far as I can tell, it's only spam messages that are KOI8-R encoded.
Strangely no other spam message seems to suffer the same fate.  Maybe
something is buggy in the usenet gateway path that gets confused by a
KOI8-R escape sequence or something, and ends up inserting an extra
carriage return.

> to the smtp port and tried to inject the message manually ... and ended 
> up injecting the 'formatted message' that has all the SMTP cmds embeded 
> ...

Well, it's consistent enough that I doubt that's the case.  I attach a
pair of messages here.  As far as I can tell, they are both exactly the
same message, except that one was passed through the usenet gateway.

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
PostgreSQL Replication, Consulting, Custom Development, 24x7 support

Subject: AFDB-1B52-CAF6 : CONSULT from pgsql-hackers (post)
From: [email-masked]
To: [email-masked]
Date: Wed, 04 Mar 2009 10:20:16 -0400

__ 
The following request:

was sent to postgresql.org
by [email-masked] (=?koi8-r?B?88/T1MHXzMXOycUgzs/Nxc7LzMHU1dLZIMTFzA==?=).

  The author ([email-masked] (=?koi8-r?B?88/T1MHXzMXOycUgzs/Nxc7LzMHU1dLZIMTFzA==?=))
  is not a member of any of the restrict_post groups.

1. If you have web browsing capability, visit
   <http://mail.postgresql.org/mj/mj_confirm/domain=postgresql.org?t=AFDB-1B52-CAF6>
   and follow the instructions there.

    accept
    reject

   (The number AFDB-1B52-CAF6 must be in the Subject header)

    accept AFDB-1B52-CAF6
    reject AFDB-1B52-CAF6

Subject: Делопроизводство - организация документооборота предприятия
From: [email-masked] (Составление номенклатуры дел)
To: [email-masked]
Date: Wed, 4 Mar 2009 23:34:14 +0800

Делопроизводство -  организация документооборота предприятия 
Вся информация по тел: [495] 792*--21 22, 4Ч5Ч05З

    18 Mарtа 2ОО9 г.

Программа мероприятия 1-й день: 

  Нормативно-правовые акты по делопроизводству. Основные категории документов. Создание Табеля унифицированных форм документов предприятия=

Subject: B458-2AF8-2D95 : CONSULT from pgsql-hackers (post)
From: [email-masked]
To: [email-masked]
Date: Wed, 04 Mar 2009 10:20:30 -0400

__ 
The following request:

1. If you have web browsing capability, visit
   <http://mail.postgresql.org/mj/mj_confirm/domain=postgresql.org?t=B458-2AF8-2D95>
   and follow the instructions there.

    accept
    reject

   (The number B458-2AF8-2D95 must be in the Subject header)

    accept B458-2AF8-2D95
    reject B458-2AF8-2D95

Subject: (NONE)
From: [email-masked]
To: [email-masked]
Date: Wed, 4 Mar 2009 09:50:17 -0400 (AST)

MAIL FROM: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
DATA
MAIL FROM: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
RCPT TO: <[email-masked]>
DATA
From: =?koi8-r?B?6c3JxNYgz8bJ0y3Nxc7FxNbF0sE=?= <[email-masked]>
To: <[email-masked]>
Subject: =?koi8-r?B?5tXOy8PJz87BzNjO2cUgz8LR2sHOzs/T1MkgIMkg3NTJy8XUICDTzNXW?=
	=?koi8-r?B?xcLO2cggz9TOz9vFzsnKINPFy9LF1MHS0Q==?=
Date: Wed, 4 Mar 2009 23:34:32 +0800

------=_NextPart_000_0007_01C99CDE.B7163B10
Content-Type: text/plain;
	charset="koi8-r"
Content-Transfer-Encoding: quoted-printable

=EE=CF=D2=CD=C1=D4=C9=D7=CE=CF-=D0=D2=C1=D7=CF=D7=D9=C5 =C1=CB=D4=D9 =D0=CF=
 =C4=C5=CC=CF=D0=D2=CF=C9=DA=D7=CF=C4=D3=D4=D7=D5. =F0=D2=C1=CB=D4=C9=DE=C5=
=D3=CB=C1=D1 =D2=C1=C2=CF=D4=C1 =D3 =C4=CF=CB=D5=CD=C5=CE=D4=C1=CD=C9=20
=F0=CF =D7=CF=D0p=CFc=C1=CD =D0=CF=C4=D2=CF=C2=CE=CF=CA =C9=CE=C6=CF=D2=CD=C1=
=C3=C9=C9 =C9 p=C5=C7uc=D4=C1p=C1=C3uu =CF=C2p=C1=DD=C1=CA=D4=C5c=D8 =D0=CF=
 =D4=C5=CC: (495) 792-=C4=D7=C1=C4=C3=C1=D4=D8 =CF=C4=C9=CE-=C4=D7=C1=C4=C3=
=C1=D4=D8 =C4=D7=C1, 4=FE5-4=EF-=D0=D1=D4=D8=C4=C5=D3=D1=D8 =D4=D2=C9

 =20
    l8 M=C1rt=C1 2OO9 =C7.
 =20