[TUHS] Warning: April Fools

[TUHS] Warning: April Fools

[Ron Natalie]

[-- Attachment #1: Type: text/plain, Size: 3082 bytes --]

Once again, I must dredge up this post from 1991….


From spaf@cs.purdue.EDU Thu Apr  4 23:11:22 1991
Path: ai-lab!mintaka!mit-eddie!wuarchive!usc!apple!amdahl!walldrug!moscvax!perdue!spaf
From:
spaf@cs.purdue.EDU (Gene Spafford)
Newsgroups: news.announce.important,news.admin
Subject: Warning: April Fools Time again (forged messages on the loose!)
Message-ID: <
4-1-1991@medusa.cs.purdue.edu>
Date: 1 Apr 91 00:00:00 GMT
Expires: 1 May 91 00:00:00 GMT
Followup-To: news.admin
Organization: Dept. of Computer Sciences, Purdue Univ.
Lines: 25
Approved:
spaf@cs.purdue.EDU
Xref: ai-lab news.announce.important:19 news.admin:8235

Warning: April 1 is rapidly approaching, and with it comes a USENET
tradition. On April Fools day comes a series of forged, tongue-in-cheek
messages, either from non-existent sites or using the name of a Well Known
USENET person. In general, these messages are harmless and meant as a joke,
and people who respond to these messages without thinking, either by flaming
or otherwise responding, generally end up looking rather silly when the
forgery is exposed.

So, for the few weeks, if you see a message that seems completely out
of line or is otherwise unusual, think twice before posting a followup
or responding to it; it's very likely a forgery.

There are a few ways of checking to see if a message is a forgery. These
aren't foolproof, but since most forgery posters want people to figure it
out, they will allow you to track down the vast majority of forgeries:

	o Russian computers. For historic reasons most forged messages have
	  as part of their Path: a non-existent (we think!) russian
	  computer, either kremvax or moscvax. Other possibilities are
	  nsacyber or wobegon. Please note, however, that walldrug is a real
	  site and isn't a forgery.

	o Posted dates. Almost invariably, the date of the posting is forged
	  to be April 1.

	o Funky Message-ID. Subtle hints are often lodged into the
	  Message-Id, as that field is more or less an unparsed text string
	  and can contain random information. Common values include pi,
	  the phone number of the red phone in the white house, and the
	  name of the forger's parrot.

	o subtle mispellings. Look for subtle misspellings of the host names
	  in the Path: field when a message is forged in the name of a Big
	  Name USENET person. This is done so that the person being forged
	  actually gets a chance to see the message and wonder when he
	  actually posted it.

Forged messages, of course, are not to be condoned. But they happen, and
it's important for people on the net not to over-react. They happen at this
time every year, and the forger generally gets their kick from watching the
novice users take the posting seriously and try to flame their tails off. If
we can keep a level head and not react to these postings, they'll taper off
rather quickly and we can return to the normal state of affairs: chaos.

Thanks for your support.

Gene Spafford, Net.God (and probably tired of seeing this message)

[-- Attachment #2: Type: text/html, Size: 4241 bytes --]

[TUHS] Re: Warning: April Fools

[John Cowan]

[-- Attachment #1: Type: text/plain, Size: 653 bytes --]

See also <https://godfatherof.nl/kremvax.html>.

Yesterday, indeed, I got an obviously misdirected email on my work account,
I clicked on a link in it to try to figure out what had gone wrong, and
found myself on a page informing me that $EMPLOYER had just phished me, and
I was being sent to a re-education camp (well, in fact I just had to look
at some slides and answer questions).  Of course, it's very difficult to
train people out of being careless and impulsive.

-- 

John Cowan          {backbones}!rutgers!hombre!magpie!cowan
                Charles li reis, nostre emperesdre magnes,
                Set anz totz pleinz ad ested in Espagnes.

[-- Attachment #2: Type: text/html, Size: 1661 bytes --]

[TUHS] Re: Warning: April Fools

[steve jenkin]

[ Please post follow-ups to COFF ]

Ron,

Thanks for the history, enjoyed very much.
Quite relevant to Early Unix, intertwined with VAxen, IP stack from UCB, NSF-net & fakery.

The earliest documented Trojan, Unix or not, would be Ken’s login/cc hack in his “Reflections on Trust” paper.

It was 1986 when Clifford Stoll tracked a KGB recruit who broke into MILNET, then the first “honeynet” by Stoll.

	<https://en.wikipedia.org/wiki/Clifford_Stoll#Career>
	<https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book)>

1986 was also the first known PC virus according to Kaspersky.

	<https://www.kaspersky.com.au/resource-center/threats/a-brief-history-of-computer-viruses-and-what-the-future-holds?
	“Brain (boot) , the first PC virus, began infecting 5.2" floppy disks in 1986.”

2nd November 1988, the Morris worm escaped from a lab,
& overloaded the Internet for a week.

Causing CERT to be formed in November 1988 in response.
	<https://en.wikipedia.org/wiki/CERT_Coordination_Center>

The SANS Institute was formed the next year, 1989, creating structured training & security materials.
	<https://en.wikipedia.org/wiki/SANS_Institute>

This structured, co-ordinated response, led by technical folk, not NatSec/ Intelligence/ Criminal investigation bodies,
created CVE’s, Common Vulnerabilities and Exposures, as a way to identify & name
unique attacks & vectors, track them and make vendors aware, forcing publicity & responses.

	<https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures>
	<https://cve.mitre.org>

The Internet eventually became a significant theatre of Crime & Espionage, Commercial & National Security.

Mandiant was formed in 2004 to identify, track and find sources of APT’s, Advanced Persistent Threats.
In 2010, they described APT’s  tracked in their “M-trends” newsletter.
in Feb 2013, Mandiant publicly described “APT1” and the military unit & location they believed ran it.

	<https://en.wikipedia.org/wiki/Mandiant>
	<https://en.wikipedia.org/wiki/Advanced_persistent_threat>
	<https://www.lawfareblog.com/mandiant-report-apt1>
	<https://www.mandiant.com/resources/blog/mandiant-exposes-apt1-chinas-cyber-espionage-units>

=============

> On 2 Apr 2023, at 02:34, Ron Natalie <ron@ronnatalie.com> wrote:
> 
> Once again, I must dredge up this post from 1991….

=============

For future reference, Kremvax lives! [ datestamp in email header ]

iMac1:steve$ host kremvax.demos.su
	kremvax.demos.su has address 194.87.0.20
	kremvax.demos.su mail is handled by 100 relay2.demos.su.
	kremvax.demos.su mail is handled by 50 relay1.demos.su.

iMac1:steve$ ping -c2 kremvax.demos.su
	PING kremvax.demos.su (194.87.0.20): 56 data bytes
	64 bytes from 194.87.0.20: icmp_seq=0 ttl=46 time=336.127 ms
	64 bytes from 194.87.0.20: icmp_seq=1 ttl=46 time=335.823 ms

--- kremvax.demos.su ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 335.823/335.975/336.127/0.152 ms

=============

--
Steve Jenkin, IT Systems and Design 
0412 786 915 (+61 412 786 915)
PO Box 38, Kippax ACT 2615, AUSTRALIA

mailto:sjenkin@canb.auug.org.au http://members.tip.net.au/~sjenkin

[TUHS] Re: Warning: April Fools

[Noel Hunt]

[-- Attachment #1: Type: text/plain, Size: 968 bytes --]

 Charles li reis, nostre emperesdre magnes, Set anz totz pleinz ad ested in
Espagnes.

A translation would be most helpful. It looks like a mixture
of Spanish and Mediaevel French...ah, it is the La Chanson de
Roland.


On Sun, 2 Apr 2023 at 03:55, John Cowan <cowan@ccil.org> wrote:

> See also <https://godfatherof.nl/kremvax.html>.
>
> Yesterday, indeed, I got an obviously misdirected email on my work
> account, I clicked on a link in it to try to figure out what had gone
> wrong, and found myself on a page informing me that $EMPLOYER had just
> phished me, and I was being sent to a re-education camp (well, in fact I
> just had to look at some slides and answer questions).  Of course, it's
> very difficult to train people out of being careless and impulsive.
>
> --
>
> John Cowan          {backbones}!rutgers!hombre!magpie!cowan
>                 Charles li reis, nostre emperesdre magnes,
>                 Set anz totz pleinz ad ested in Espagnes.
>
>
>

[-- Attachment #2: Type: text/html, Size: 3255 bytes --]

[TUHS] Re: Warning: April Fools

[Wesley Parish]

[-- Attachment #1: Type: text/plain, Size: 1372 bytes --]

"Charles the King, our great emperor"

(and the rest I can only guess at. It's referring to King Chuck the 
Great, Karl der Gross, Charlemagne. Or if you like, the Great and 
Magnificent King Upchuck. :) ) It's not Spanish; I thought it had a 
touch of Occitan/Catalan, but I could be wrong.

Wesley Parish

On 2/04/23 19:39, Noel Hunt wrote:
> Charles li reis, nostre emperesdre magnes, Set anz totz pleinz ad 
> ested in Espagnes.
> A translation would be most helpful. It looks like a mixture
> of Spanish and Mediaevel French...ah, it is the La Chanson de
> Roland.
>
> On Sun, 2 Apr 2023 at 03:55, John Cowan <cowan@ccil.org> wrote:
>
>     See also <https://godfatherof.nl/kremvax.html>.
>
>     Yesterday, indeed, I got an obviously misdirected email on my work
>     account, I clicked on a link in it to try to figure out what had
>     gone wrong, and found myself on a page informing me that $EMPLOYER
>     had just phished me, and I was being sent to a re-education camp
>     (well, in fact I just had to look at some slides and answer
>     questions). Of course, it's very difficult to train people out of
>     being careless and impulsive.
>
>     -- 
>
>     John Cowan          {backbones}!rutgers!hombre!magpie!cowan
>                      Charles li reis, nostre emperesdre magnes,
>                      Set anz totz pleinz ad ested in Espagnes.
>
>

[-- Attachment #2: Type: text/html, Size: 4644 bytes --]

[TUHS] Re: Warning: April Fools

[markus schnalke]

Hoi,

As Noel already mentioned, it's from the Song of Roland. See here,
the beginning of this old french version:

https://fr.wikisource.org/wiki/La_Chanson_de_Roland/L%C3%A9on_Gautier/%C3%89dition_critique/Premi%C3%A8re_partie


meillo



[2023-04-02 23:18] Wesley Parish <wobblygong@gmail.com>
>
> "Charles the King, our great emperor"
> 
> (and the rest I can only guess at. It's referring to King Chuck the Great, Karl
> der Gross, Charlemagne. Or if you like, the Great and Magnificent King Upchuck.
> :) ) It's not Spanish; I thought it had a touch of Occitan/Catalan, but I could
> be wrong.
> 
> Wesley Parish
> 
> On 2/04/23 19:39, Noel Hunt wrote:
> 
>     Charles li reis, nostre emperesdre magnes, Set anz totz pleinz ad ested in
>     Espagnes.
>     A translation would be most helpful. It looks like a mixture
>     of Spanish and Mediaevel French...ah, it is the La Chanson de
>     Roland.
>    
>     On Sun, 2 Apr 2023 at 03:55, John Cowan <cowan@ccil.org> wrote:
> 
>         See also <https://godfatherof.nl/kremvax.html>.
> 
>         Yesterday, indeed, I got an obviously misdirected email on my work
>         account, I clicked on a link in it to try to figure out what had gone
>         wrong, and found myself on a page informing me that $EMPLOYER had just
>         phished me, and I was being sent to a re-education camp (well, in fact
>         I just had to look at some slides and answer questions).  Of course,
>         it's very difficult to train people out of being careless and
>         impulsive.
> 
>         -- 
> 
>         John Cowan          {backbones}!rutgers!hombre!magpie!cowan
>                         Charles li reis, nostre emperesdre magnes,
>                         Set anz totz pleinz ad ested in Espagnes.
> 
> 
> 

[TUHS] Re: Warning: April Fools

[Harald Arnesen]

Wesley Parish [02/04/2023 13.18]:

> It's referring to King Chuck the Great, Karl der Gross, Charlemagne. Or 
> if you like, the Great and Magnificent King Upchuck. :) )

Karlamagnus, as the vikings called him.
-- 
Hilsen Harald
Слава Україні!

[TUHS] Re: Warning: April Fools

[Marc Donner]

[-- Attachment #1: Type: text/plain, Size: 655 bytes --]

And for you history nerds, there's an interesting new life of Charlemagne
out from the UC Press (
https://www.ucpress.edu/book/9780520383210/king-and-emperor).  It's a heavy
slog but fascinating.
=====
nygeek.net
mindthegapdialogs.com/home <https://www.mindthegapdialogs.com/home>


On Sun, Apr 2, 2023 at 9:46 AM Harald Arnesen <skogtun@gmail.com> wrote:

> Wesley Parish [02/04/2023 13.18]:
>
> > It's referring to King Chuck the Great, Karl der Gross, Charlemagne. Or
> > if you like, the Great and Magnificent King Upchuck. :) )
>
> Karlamagnus, as the vikings called him.
> --
> Hilsen Harald
> Слава Україні!
>
>

[-- Attachment #2: Type: text/html, Size: 1339 bytes --]