Murray is of course correct that duplicated headers could be used to fool
sorting programs like procmail or filtering programs.
I have an archive of a lot of the spam received on my system in recent
years, so I've been grepping through it looking for duplicated from and
subject headers. Here's what I've found so far.
The URLs below are real, and will fetch you a copy of the spam. Each line
tells how many from and subject lines the message has, and "same" means
the two subjects are the same. In this tiny sample, every duplicated
subject is the same, and the duplicated froms are all similar to each
other, and appear to be due to bugs in the spamware, not malicious intent.
I dunno what that tells us, other than that whatever attack is enabled by
duplicated headers, it doesn't appear to have happened yet. But I do
share Mark's concern that it would be unfortunate if there were ways to
make significant changes to the way a message renders without breaking a
non-silly signature, i.e., one that covers the usual headers and the whole
body.
R's,
John
http://spample.iecc.com/uft/22579237 !!! from 2 subj 1
http://spample.iecc.com/trh/22584748 !!! from 1 subj 2 same
http://spample.iecc.com/hua/22585805 !!! from 1 subj 2 same
http://spample.iecc.com/jaw/22594898 !!! from 1 subj 2 same
http://spample.iecc.com/jcf/22594899 !!! from 1 subj 2 same
http://spample.iecc.com/kea/22594900 !!! from 1 subj 2 same
http://spample.iecc.com/kgi/22594901 !!! from 1 subj 2 same
http://spample.iecc.com/ljd/22594902 !!! from 1 subj 2 same
http://spample.iecc.com/llm/22594903 !!! from 1 subj 2 same
http://spample.iecc.com/mnh/22594904 !!! from 1 subj 2 same
http://spample.iecc.com/mpp/22594905 !!! from 1 subj 2 same
http://spample.iecc.com/nrk/22594906 !!! from 1 subj 2 same
http://spample.iecc.com/ntt/22594907 !!! from 1 subj 2 same
http://spample.iecc.com/pxx/22594909 !!! from 1 subj 2 same
http://spample.iecc.com/pzr/22594910 !!! from 1 subj 2 same
http://spample.iecc.com/qba/22594911 !!! from 1 subj 2 same
http://spample.iecc.com/qdv/22594912 !!! from 1 subj 2 same
http://spample.iecc.com/rge/22594913 !!! from 1 subj 2 same
http://spample.iecc.com/riy/22594914 !!! from 1 subj 2 same
http://spample.iecc.com/syh/22594915 !!! from 1 subj 2 same
http://spample.iecc.com/sac/22594916 !!! from 1 subj 2 same
http://spample.iecc.com/tcl/22594917 !!! from 1 subj 2 same
http://spample.iecc.com/teg/22594918 !!! from 1 subj 2 same
http://spample.iecc.com/ugo/22594919 !!! from 1 subj 2 same
http://spample.iecc.com/uij/22594920 !!! from 1 subj 2 same
http://spample.iecc.com/vks/22594921 !!! from 1 subj 2 same
http://spample.iecc.com/vmn/22594922 !!! from 1 subj 2 same
http://spample.iecc.com/wov/22594923 !!! from 1 subj 2 same
http://spample.iecc.com/xrq/22594924 !!! from 1 subj 2 same
http://spample.iecc.com/xtz/22594925 !!! from 1 subj 2 same
http://spample.iecc.com/yvu/22594926 !!! from 1 subj 2 same
http://spample.iecc.com/yxc/22594927 !!! from 1 subj 2 same
http://spample.iecc.com/zzx/22594928 !!! from 1 subj 2 same
http://spample.iecc.com/zbg/22594929 !!! from 1 subj 2 same
http://spample.iecc.com/adb/22594930 !!! from 1 subj 2 same
http://spample.iecc.com/afk/22594931 !!! from 1 subj 2 same
http://spample.iecc.com/bhe/22594932 !!! from 1 subj 2 same
http://spample.iecc.com/bjn/22594933 !!! from 1 subj 2 same
http://spample.iecc.com/cli/22594934 !!! from 1 subj 2 same
http://spample.iecc.com/cor/22594935 !!! from 1 subj 2 same
http://spample.iecc.com/dql/22594936 !!! from 1 subj 2 same
http://spample.iecc.com/dsu/22594937 !!! from 1 subj 2 same
http://spample.iecc.com/eup/22594938 !!! from 1 subj 2 same
http://spample.iecc.com/ewy/22594939 !!! from 1 subj 2 same
http://spample.iecc.com/fys/22594940 !!! from 1 subj 2 same
http://spample.iecc.com/gab/22594941 !!! from 1 subj 2 same
http://spample.iecc.com/gcw/22594942 !!! from 1 subj 2 same
http://spample.iecc.com/her/22594943 !!! from 1 subj 2 same
http://spample.iecc.com/hga/22594944 !!! from 1 subj 2 same
http://spample.iecc.com/iiu/22594945 !!! from 1 subj 2 same
http://spample.iecc.com/ild/22594946 !!! from 1 subj 2 same
http://spample.iecc.com/jph/22594948 !!! from 1 subj 2 same
http://spample.iecc.com/krb/22594949 !!! from 1 subj 2 same
http://spample.iecc.com/khk/22594950 !!! from 1 subj 2 same
http://spample.iecc.com/ljf/22594951 !!! from 1 subj 2 same
http://spample.iecc.com/llo/22594952 !!! from 1 subj 2 same
http://spample.iecc.com/mpr/22594954 !!! from 1 subj 2 same
http://spample.iecc.com/nrm/22594955 !!! from 1 subj 2 same
http://spample.iecc.com/ntv/22594956 !!! from 1 subj 2 same
http://spample.iecc.com/owq/22594957 !!! from 1 subj 2 same
http://spample.iecc.com/pyy/22594958 !!! from 1 subj 2 same
http://spample.iecc.com/pat/22594959 !!! from 1 subj 2 same
http://spample.iecc.com/qcc/22594960 !!! from 1 subj 2 same
http://spample.iecc.com/qex/22594961 !!! from 1 subj 2 same
http://spample.iecc.com/rgf/22594962 !!! from 1 subj 2 same
http://spample.iecc.com/ria/22594963 !!! from 1 subj 2 same
http://spample.iecc.com/skj/22594964 !!! from 1 subj 2 same
http://spample.iecc.com/sme/22594965 !!! from 1 subj 2 same
http://spample.iecc.com/tom/22594966 !!! from 1 subj 2 same
http://spample.iecc.com/tqh/22594967 !!! from 1 subj 2 same
http://spample.iecc.com/usq/22594968 !!! from 1 subj 2 same
http://spample.iecc.com/uvl/22594969 !!! from 1 subj 2 same
http://spample.iecc.com/vxu/22594970 !!! from 1 subj 2 same
http://spample.iecc.com/vzo/22594971 !!! from 1 subj 2 same
http://spample.iecc.com/wbx/22594972 !!! from 1 subj 2 same
http://spample.iecc.com/wds/22594973 !!! from 1 subj 2 same
http://spample.iecc.com/xfb/22594974 !!! from 1 subj 2 same
http://spample.iecc.com/yhv/22594975 !!! from 1 subj 2 same
http://spample.iecc.com/yje/22594976 !!! from 1 subj 2 same
http://spample.iecc.com/zlz/22594977 !!! from 1 subj 2 same
http://spample.iecc.com/zni/22594978 !!! from 1 subj 2 same
http://spample.iecc.com/apc/22594979 !!! from 1 subj 2 same
http://spample.iecc.com/asl/22594980 !!! from 1 subj 2 same
http://spample.iecc.com/cyk/22594983 !!! from 1 subj 2 same
http://spample.iecc.com/cas/22594984 !!! from 1 subj 2 same
http://spample.iecc.com/dcn/22594985 !!! from 1 subj 2 same
http://spample.iecc.com/dsi/22594986 !!! from 1 subj 2 same
http://spample.iecc.com/eur/22594987 !!! from 1 subj 2 same
http://spample.iecc.com/lxp/22595001 !!! from 1 subj 2 same
http://spample.iecc.com/iwr/22595338 !!! from 2 subj 1
http://spample.iecc.com/lct/22596053 !!! from 1 subj 2 same
http://spample.iecc.com/kzp/22619085 !!! from 1 subj 2 same
http://spample.iecc.com/lpk/22619086 !!! from 1 subj 2 same
http://spample.iecc.com/ypw/22622689 !!! from 2 subj 1
http://spample.iecc.com/ppv/22626347 !!! from 1 subj 2 same
http://spample.iecc.com/lna/22626634 !!! from 1 subj 2 same
http://spample.iecc.com/qsk/22626692 !!! from 2 subj 1
http://spample.iecc.com/kaa/22628715 !!! from 2 subj 1
http://spample.iecc.com/edn/22647571 !!! from 1 subj 2 same
http://spample.iecc.com/zpf/22649547 !!! from 1 subj 2 same
http://spample.iecc.com/jaa/22650694 !!! from 1 subj 2 same
http://spample.iecc.com/kps/22666352 !!! from 1 subj 2 same
http://spample.iecc.com/lvr/22666355 !!! from 1 subj 2 same
http://spample.iecc.com/vuo/22667011 !!! from 1 subj 2 same
http://spample.iecc.com/wxj/22667012 !!! from 1 subj 2 same
http://spample.iecc.com/wzr/22667013 !!! from 1 subj 2 same
http://spample.iecc.com/ubi/22667352 !!! from 1 subj 2 same
http://spample.iecc.com/lxd/22668927 !!! from 1 subj 2 same
http://spample.iecc.com/lzm/22668928 !!! from 1 subj 2 same
http://spample.iecc.com/mbh/22668929 !!! from 1 subj 2 same
http://spample.iecc.com/oqm/22674006 !!! from 1 subj 2 same
http://spample.iecc.com/ibk/22674042 !!! from 1 subj 2 same
http://spample.iecc.com/eur/22675628 !!! from 2 subj 1
http://spample.iecc.com/oxu/22678416 !!! from 2 subj 1
http://spample.iecc.com/avr/22678636 !!! from 1 subj 2 same
http://spample.iecc.com/bxm/22678637 !!! from 1 subj 2 same
http://spample.iecc.com/aci/22682408 !!! from 2 subj 1
http://spample.iecc.com/yps/22683752 !!! from 1 subj 2 same
Regards,
John Levine, johnl(_at_)iecc(_dot_)com, Primary Perpetrator of "The Internet
for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html