Best of the ISP-Lists

General

Who's Firing Blanks at Mail Servers?

Mail server admins are starting to notice an e-mail problem that can crash e-mail clients. It's a new headache for your already burdened tech support staff.

[February 25, 2004]

On the ISP-Tech list in February, GR asked:

"Has anyone else noticed an upswing in the number of blank e-mails arriving in your inboxes? I'm not talking about this list mail, just general mail. Any idea what the blank e-mails are?"

Many had noticed this problem. Although there were theories concerning the possible cause, none knew for certain why the problem was happening:

[JS asked] "Are you sure they are blank? i.e. I use kmail and by default I have it display my mail in txt (not html). Alot of spam coming in now has blank txt and includes an html message instead."

[DH mused] "Any chance they're from AOL users? AOL 9.0 seems to be able to produce e-mails that display as blank in Outlook."

[SW replied] "Simple answer: Yes. Are you running a spam filter on your mail server? I'm running SpamAssassin 2.60, and although many of these do not get marked as spam, SpamAssassin still puts some information in the header of the mail in question.

[ed. note: sample spam removed]

As you can see, my threshold is set to 3 points, and this e-mail scores 2.5 points. My guess is that there are allot of amateur spammers out there who are using spam servers, which are probably user configurable. In the above example they are using X-Mailer: Evolution/1.0.2-5mdk, which is a Linux Mandrake 8.2 mail server app."

[LE pondered] "I have seen two guesses. 1) a spammer or e-mail address list seller trying to check if the addresses are valid in their mailing list are valid by looking for rejection messages from no longer valid addresses. Or 2) some spammer(s) have malfunctioning or misconfigured spam software that is sending out the e-mail but failing to put the actual content in."

[RS noted] "Yes. Some of them are getting caught in our spam filters, and some actually get through. The ones I find in the spam quarantine are usually incomplete, as if they got cut off in the middle of the headers. (Messages with a blank subject get quarantined.) Somehow getting a period on a line by itself would do that, as it signals the end of the data stream during the SMTP transmission."

[JM guessed] "I've seen a few of these recently. They had incomplete headers but no message body. It's obviously harmless unless you're getting swamped by them. My guess is they're being generated by a broken e-mail worm."

[MM agreed] "I've been seeing messages with naked carriage returns in unusual places, particularly at the end of some addresses. e.g.: From: <user@example.com_> where the "_" is a carriage return character. Either this is an accident, or it's a deliberate attempt to fool filter programs (and MUAs) into thinking the header has ended and thus get around any simple header checking. My bet is it's a bug."

[SP groused] "I have found the blank e-mails to be a pain for some users because it occasionally crashes their e-mail client, forcing me to go into the mailbox and delete out any mails that have both <blank> sender and <blank> subject. This is becoming a larger problem, and I am trying to figure out some sort of filtering to catch blank e-mails before they hit the mailbox."

—End