email attack

"Matthew P. Cummings" wrote in message
news
On Sun, 28 Sep 2003 13:34:04 -0700, Rich S. wrote:

Isn't there any simple way of determining who is the actual sender of
the
virus?

Sort of. But it requires cooperation of the other ISP and most of the
time they won't do it without a court order. I have tracked down some of
the users that had a virus that kept sending me lots of them and had the
ISP inform that user, but they never told me who it was.

Damn shame, that. Kinda surpasses the definition of simple. Too bad we can't
rethink this science and require a DNA on signatures. Yeah, that's it. And
then we can give John Ashcroft the authority to hunt them down and kill
them!

On second thought. . .

Rich "Better the devil we know.." S.

In article ,
Rich S. wrote:
Isn't there any simple way of determining who is the actual sender of the
virus?

For those knowledgable in deciphering the information in the message 'headers',
one can _usually_ make a "well-informed guess" as to the _network_ on which
the *machine* that sent the message lives. Identifying the actual machine
frequently requires access to information that _only_ the party that manages
and operates that network has. The _only_ "potentially reliable" data you
have to work with are the IP addresses -- and when they are 'dynamically'
assigned, you have to coordinate the address _with_ the timestamp, to figure
out "who was using that address *then*". Obviously, you can't do that, if
you _don'_ have access to the records of 'who was assigned which address,
when".