Re: [Xen-users] Acquiring the latest pvUSB frontend patches?

[David Kowis <david@xxxxxx>]

I thought I'd share with the list that someone is legit trying to attack 
folks on here.
I got an email that was a firefox send file, an archive of some sorts, 
claiming to be an update to the PVUSB branch. Immediately suspect, 
because why wouldn't it just be an update to the git repo. And of course 
the email came from phishy sources.
Just thought I'd let ya'll know, so you can be extra diligent. Someone 
is doing intentional hax here, trying to take advantage of the folks 
that usually help people on the public list. Pay close attention to your 
email sources (like where it's delivered from,) and don't trust people 
that don't also reply to the list.
Original email content follows:
<<evil email>>
Return-Path: <support@xxxxxxxxxx>
Delivered-To: david@xxxxxx
Received: from cloudmachine.kow.is (unknown [10.99.0.1])
        (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "cloudmachine.kow.is", Issuer "Let's Encrypt Authority X3" 
(not verified))
        by soulreaver.dark.kow.is (Postfix) with ESMTPS id CC5828003F
        for <david@xxxxxx>; Wed, 24 Jun 2020 11:22:18 -0500 (CDT)
Received: from gateway32.websitewelcome.com 
(gateway32.websitewelcome.com [192.185.145.111])
        (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
        (Client did not present a certificate)
        by cloudmachine.kow.is (Postfix) with ESMTPS id 2FEAE7D15B
        for <david@xxxxxx>; Wed, 24 Jun 2020 11:22:18 -0500 (CDT)
Received: from cm12.websitewelcome.com (cm12.websitewelcome.com 
[100.42.49.8])
        by gateway32.websitewelcome.com (Postfix) with ESMTP id 249FF443A91
        for <david@xxxxxx>; Wed, 24 Jun 2020 11:21:52 -0500 (CDT)
Received: from amigo.websitewelcome.com ([192.185.2.19])
        by cmsmtp with SMTP
        id o89njh2OkzOauo89njywzs; Wed, 24 Jun 2020 11:21:52 -0500
X-Authority-Reason: nr=8
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; 
d=vct.com.pa;
         s=default; h=Content-Transfer-Encoding:Content-Type:Message-ID:Date:
        References:In-Reply-To:Subject:To:From:MIME-Version:Sender:Reply-To:Cc:
        Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:
        
Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:
        List-Subscribe:List-Post:List-Owner:List-Archive;
	bh=OgQ3R+mE0ISOt36IcbJkg+Zuq7pnVCJT4DgV2ylCfhE=; 
b=GpqiAEA4uICV1TS7kWWX8Lwkdy
        
UNsWF/PbumR9zcJBvBFv2wjCjjxsilBYtHq54EyXoOwiWUQyPFNhLfxXdR/0+2rm/h5ATHWAEy+sd
        
DodUuGtRpERoopTcYk59wqedFKL5Oi92jciBEJTm6ZH0Yyyc1BqZBiFHeqbVColwnP3/sdaDEa/7p
        
VgMuh3vGhyHPOUGLSiuwZAQVScmZY5Z64wJyGDJsalKAHGicf0q/xC0bthnY2cwpjOvceRfdhM/55
        
KcwusvSpwkHa4TQwpWrFog1+WJoFjpGI2lSu4PBe3PBfz3jjSHAupMmAB8InfUv1zRPvm2FzOgSBY
        9rErKNWQ==;
Received: from p5b2649dd.dip0.t-ipconnect.de ([91.38.73.221]:50179 
helo=[169.254.53.195])
	by amigo.websitewelcome.com with esmtpsa  (TLS1.2) tls 
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        (Exim 4.93)
        (envelope-from <support@xxxxxxxxxx>)
        id 1jo89n-000xct-Kz
        for david@xxxxxx; Wed, 24 Jun 2020 11:21:51 -0500
MIME-Version: 1.0
X-Mailer: MailBee.NET 12.0.0.615
From: "xen-users@xxxxxxxxxxxxxxxxxxxx" <support@xxxxxxxxxx>
To: david@xxxxxx
Subject: Re: Re: [Xen-users] Acquiring the latest pvUSB frontend 
patches?
In-Reply-To: <febfd4478ef02756c2266e583098a7de@xxxxxx>
References: <qtrsilufvkr2g1avsrvhlpo5.1566844058435@xxxxxxxxxxxxxxxxx>
 <febfd4478ef02756c2266e583098a7de@xxxxxx>
Date: Wed, 24 Jun 2020 09:21:50 -0700
Message-ID: <1.a8bc71b38b211c6bb643@WIN-DDV6UFOS797>
Content-Type: text/plain;
        charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it 
with any abuse report
X-AntiAbuse: Primary Hostname - amigo.websitewelcome.com
X-AntiAbuse: Original Domain - kow.is
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - vct.com.pa
X-BWhitelist: no
X-Source-IP: 91.38.73.221
X-Source-L: No
X-Exim-ID: 1jo89n-000xct-Kz
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: p5b2649dd.dip0.t-ipconnect.de ([169.254.53.195]) 
[91.38.73.221]:50179
X-Source-Auth: support@xxxxxxxxxx
X-Email-Count: 47
X-Source-Cap: dmN0Y29tO3ZpcnR1YWxjO2FtaWdvLndlYnNpdGV3ZWxjb21lLmNvbQ==
X-Local-Domain: yes


Here is an update of the project - please confirm the 
changes.=0Ahttps://se=
nd.firefox.com/download/<yeah not gonna put the actual thing in 
there>/#FvLRdBjJnjmvtRSCnDTnZw=0AArchive =
password: 7777=0A=0A
On 2019-08-26 13:27, david@xxxxxx wrote:
> > Thanks a whole bunch! I'll give it a go soon.
<<end of message source>>

On 2020-06-04 22:55, David Kowis wrote:
> On 2019-08-26 13:27, david@xxxxxx wrote:
> > Thanks a whole bunch! I'll give it a go soon.
> Soon turned out to be a lot longer than I expected. I don't suppose
> there's updates to this at all?
>
> Thanks!
>
> > Sent from Nine [1]
> >
> > -------------------------
> >
> > From: Juergen Gross <jgross@xxxxxxxx>
> > Sent: Monday, August 26, 2019 13:05
> > To: David Kowis; xen-users@xxxxxxxxxxxxxxxxxxxx
> > Subject: Re: [Xen-users] Acquiring the latest pvUSB frontend patches?
> >
> > On 18.08.19 05:44, David Kowis wrote:
> > > I found this email https://markmail.org/message/oi2l5n267lp7yoxv
> > which
> > > seems to be the latest patches for the pvUSB frontend drivers.
> > >
> > > I couldn't find the source of the patches off the wiki page, and I
> > > thought I'd email to find out if this is the latest version of the
> > > patches, or how I could generate the patches myself to apply to an
> > > upstream kernel for my Xen DomUs.
> > I have pushed an upstream version to:
> >
> > https://github.com/jgross1/linux.git pvusb
> >
> > Juergen
> >
> >
> > Links:
> > ------
> > [1] http://www.9folders.com/
> > _______________________________________________
> > Xen-users mailing list
> > Xen-users@xxxxxxxxxxxxxxxxxxxx
> > https://lists.xenproject.org/mailman/listinfo/xen-users