I thought I'd share with the list that someone is legit trying to attack
folks on here.
I got an email that was a firefox send file, an archive of some sorts,
claiming to be an update to the PVUSB branch. Immediately suspect,
because why wouldn't it just be an update to the git repo. And of course
the email came from phishy sources.
Just thought I'd let ya'll know, so you can be extra diligent. Someone
is doing intentional hax here, trying to take advantage of the folks
that usually help people on the public list. Pay close attention to your
email sources (like where it's delivered from,) and don't trust people
that don't also reply to the list.
Original email content follows:
<<evil email>>
Return-Path: <support@vct.com.pa>
Delivered-To: david@kow.is
Received: from cloudmachine.kow.is (unknown [10.99.0.1])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
(Client CN "cloudmachine.kow.is", Issuer "Let's Encrypt Authority X3"
(not verified))
by soulreaver.dark.kow.is (Postfix) with ESMTPS id CC5828003F
for <david@kow.is>; Wed, 24 Jun 2020 11:22:18 -0500 (CDT)
Received: from gateway32.websitewelcome.com
(gateway32.websitewelcome.com [192.185.145.111])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client did not present a certificate)
by cloudmachine.kow.is (Postfix) with ESMTPS id 2FEAE7D15B
for <david@kow.is>; Wed, 24 Jun 2020 11:22:18 -0500 (CDT)
Received: from cm12.websitewelcome.com (cm12.websitewelcome.com
[100.42.49.8])
by gateway32.websitewelcome.com (Postfix) with ESMTP id 249FF443A91
for <david@kow.is>; Wed, 24 Jun 2020 11:21:52 -0500 (CDT)
Received: from amigo.websitewelcome.com ([192.185.2.19])
by cmsmtp with SMTP
id o89njh2OkzOauo89njywzs; Wed, 24 Jun 2020 11:21:52 -0500
X-Authority-Reason: nr=8
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=vct.com.pa;
s=default; h=Content-Transfer-Encoding:Content-Type:Message-ID:Date:
References:In-Reply-To:Subject:To:From:MIME-Version:Sender:Reply-To:Cc:
Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:
Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=OgQ3R+mE0ISOt36IcbJkg+Zuq7pnVCJT4DgV2ylCfhE=;
b=GpqiAEA4uICV1TS7kWWX8Lwkdy
UNsWF/PbumR9zcJBvBFv2wjCjjxsilBYtHq54EyXoOwiWUQyPFNhLfxXdR/0+2rm/h5ATHWAEy+sd
DodUuGtRpERoopTcYk59wqedFKL5Oi92jciBEJTm6ZH0Yyyc1BqZBiFHeqbVColwnP3/sdaDEa/7p
VgMuh3vGhyHPOUGLSiuwZAQVScmZY5Z64wJyGDJsalKAHGicf0q/xC0bthnY2cwpjOvceRfdhM/55
KcwusvSpwkHa4TQwpWrFog1+WJoFjpGI2lSu4PBe3PBfz3jjSHAupMmAB8InfUv1zRPvm2FzOgSBY
9rErKNWQ==;
Received: from p5b2649dd.dip0.t-ipconnect.de ([91.38.73.221]:50179
helo=[169.254.53.195])
by amigo.websitewelcome.com with esmtpsa (TLS1.2) tls
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.93)
(envelope-from <support@vct.com.pa>)
id 1jo89n-000xct-Kz
for david@kow.is; Wed, 24 Jun 2020 11:21:51 -0500
MIME-Version: 1.0
X-Mailer: MailBee.NET 12.0.0.615
From: "xen-users@lists.xenproject.org" <support@vct.com.pa>
To: david@kow.is
Subject: Re: Re: [Xen-users] Acquiring the latest pvUSB frontend
patches?
In-Reply-To: <febfd4478ef02756c2266e583098a7de@kow.is>
References: <qtrsilufvkr2g1avsrvhlpo5.1566844058435@email.android.com>
<febfd4478ef02756c2266e583098a7de@kow.is>
Date: Wed, 24 Jun 2020 09:21:50 -0700
Message-ID: <1.a8bc71b38b211c6bb643@WIN-DDV6UFOS797>
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it
with any abuse report
X-AntiAbuse: Primary Hostname - amigo.websitewelcome.com
X-AntiAbuse: Original Domain - kow.is
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - vct.com.pa
X-BWhitelist: no
X-Source-IP: 91.38.73.221
X-Source-L: No
X-Exim-ID: 1jo89n-000xct-Kz
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: p5b2649dd.dip0.t-ipconnect.de ([169.254.53.195])
[91.38.73.221]:50179
X-Source-Auth: support@vct.com.pa
X-Email-Count: 47
X-Source-Cap: dmN0Y29tO3ZpcnR1YWxjO2FtaWdvLndlYnNpdGV3ZWxjb21lLmNvbQ==
X-Local-Domain: yes
Here is an update of the project - please confirm the
changes.=0A
https://se= nd.firefox.com/download/<yeah not gonna put the actual thing in
password: 7777=0A=0A
On 2019-08-26 13:27, david@kow.is wrote:
>> Thanks a whole bunch! I'll give it a go soon.
<<end of message source>>
On 2020-06-04 22:55, David Kowis wrote:
> On 2019-08-26 13:27, david@kow.is wrote:
>> Thanks a whole bunch! I'll give it a go soon.
>
> Soon turned out to be a lot longer than I expected. I don't suppose
> there's updates to this at all?
>
> Thanks!
>
>>
>> Sent from Nine [1]
>>
>> -------------------------
>>
>> From: Juergen Gross <jgross@suse.com>
>> Sent: Monday, August 26, 2019 13:05
>> To: David Kowis; xen-users@lists.xenproject.org
>> Subject: Re: [Xen-users] Acquiring the latest pvUSB frontend patches?
>>
>> On 18.08.19 05:44, David Kowis wrote:
>>> I found this email https://markmail.org/message/oi2l5n267lp7yoxv
>> which
>>> seems to be the latest patches for the pvUSB frontend drivers.
>>>
>>> I couldn't find the source of the patches off the wiki page, and I
>>> thought I'd email to find out if this is the latest version of the
>>> patches, or how I could generate the patches myself to apply to an
>>> upstream kernel for my Xen DomUs.
>>
>> I have pushed an upstream version to:
>>
>> https://github.com/jgross1/linux.git pvusb
>>
>> Juergen
>>
>>
>> Links:
>> ------
>> [1] http://www.9folders.com/
>> _______________________________________________
>> Xen-users mailing list
>> Xen-users@lists.xenproject.org
>> https://lists.xenproject.org/mailman/listinfo/xen-users