Source Code for Ellie Light Emails

Hot Air Blog ^ | 1/25/2009 | Ed Morrissey

[The Big Boo]

From – Mon Jan 25 06:42:56 2010 X-Account-Key: account11 X-UIDL: UID204928-1203640919 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-path: Envelope-to: hotair@edmorrissey.com Delivery-date: Mon, 25 Jan 2010 07:38:46 -0500 Received: from tosh-PC (host11-164-dynamic.59-82-r.retail.telecomitalia.it [82.59.164.11]) by (Postfix) with SMTP id DBC0C1E1C6AB Mon, 25 Jan 2010 06:38:30 -0600 (CST) Received: from [82.59.164.11] by web335.mail.yahoo.com via HTTP; Mon, 25 Jan 2010 12:22:20 GMT Message-Id: Date: Mon, 25 Jan 2010 08:22:20 -0400 From: “Ellie Light” User-Agent: Mozilla 2.0 (Macintosh; I; 68K) MIME-Version: 1.0

[kcvl]

Email: ellie.light@yahoo.com

Location: Sunnyvale, CA

[madinmadtown]

The Washington Times certainly has a conservative editorial content. It doesn’t mean that every staffer has the same conservative philosophy. I have a conservative friend who actually works for PBS and keeps his views to himself. Even a conservative staffer can be blackmailed. Perhaps the Washington Times was the outlier, maybe they actually just coincidentally published the letter. There are any number of possibilities for the Washington Times to have published the letter.

[The Big Boo]

details? post privately if you must. Would like to get this out...

[Simplemines]

The thing that is most perplexing, as many others have noted, is that so many papers published THIS particular email. It is the papers that have MORE explaining to do than the sender of the email. Everyone gets spammed. All campaigns, both sides, do form letters of one sort or another. What is odd is that so many papers chose this ONE email.

It's not so odd that so many papers published the letter (you have no idea how many more were sent out to papers that didn't publish it.)

Ellie Light sent the same letter with different cities that corresponded to the coverage area of the target newspaper. Usually the op-ed editor or a clerk will call the person to make sure they did indeed send the letter before they publish it.

That's what's so odd about this email - what phone number did Ellie Light use? Or did the papers even bother to verify that Ellie Light sent the email?

I can see some papers with the lack of staff just skipping over the verification and printing it. But all those papers?

And of course we'll never know how many papers didn't print it because they couldn't confirm that Ellie Light even existed.

[The Big Boo]

here’s the latest on the analysis for Hot Air

http://hotair.com/archives/2010/01/25/ellie-light-speaks-and-speaks-and-speaks/

Ed, the only truthful line in the header will be
a) the one you removed showing your mailserver being connected to by the Ellie Light border mailserver.

Return-path is added by your mailserver to indicate the RCVD FROM portion of the envelope.

All e-mail has the following information:
a) Connection info, which includes the local and foreign IP address pairs. This cannot be spoofed, because e-mail is delivered via TCP, which has a handshaking protocol, and the protocol would break to the point that the e-mail could not be delivered.
b) Envelope information, such as HELO/EHLO (text identity of sending server), RCPT (To:), and RCVD FROM (From:). Only RCPT must be correct, because if you don’t give a valid recipient e-mail address, the receiving mailserver does not know to whom to route the e-mail.
c) Header information, all of which can be falsified, and
d) Body information (the text of the e-mail, including any attachments). This is the payload the sender wants delivered for you to examine, for whatever purpose.

Your mailserver adds a (Received From:) header, detailing the connection information, as well as the EHLO/HELO salutation used to deliver the message; that is the line you removed.

Your mailserver also added “Envelope-to” from the RCPT portion of the envelope.

The Received lines in the text you provide are in the wrong order (should be latest handler first, with the lines going back in time), unless you reordered them while pasting.

My mailserver’s DNSBL blocks telecomitalia.it — it’s a known nest of spammers and scammers. If anything came out of there, it was probably anonymized out of recognition.

That someone is going to this trouble to fake headers indicates a criminal operation (or that these people have obtained copies of criminal-style mailers such as SpamBlaster). Normal mailers don’t do this stuff.

X-Mozilla-Keys indicates that you used a Thunderbird reader and placed the e-mail into a local folder (as opposed to using LDAP). If that header came in the e-mail, that’s a bug in the sender’s mail agent.

I can’t see anything that would give you the information you are seeking.

If you feel comfortable, put back in the missing “Received” line but remove YOUR mailserver (the “by” portion) from that line. Then we’ll have a real piece of data to go on.

unclesmrgol on January 25, 2010 at 12:28 PM

[madinmadtown]

You are correct that we don't know how many papers didn't publish the letter. We don't know how many papers published the letter by random choice. We DO know that lots of papers published the same letter far beyond what would be the natural random selection. It is that aspect that implies collusion on the part of some identity with many different papers. It is as if there is a code encrypted somewhere to alert whomever makes the choice of letters to be published that this particular letter is THE letter to be published.

[Simplemines]

It is that aspect that implies collusion on the part of some identity with many different papers. It is as if there is a code encrypted somewhere to alert whomever makes the choice of letters to be published that this particular letter is THE letter to be published.

Are you serious??

[Sigurdrifta]

The Spanish-language version of The Miami Herald (El Nuevo Herald) published this letter by “Ellie Light” this morning
IN SPANISH.

To me there are only two possibilities:

1) the letter is being translated by the organization behind “her” and is sending it out to Hispanic “targets”.

2) the newspaper here did not check anything, but rather just blindly translated it and published it.

Neither conclusion is very good news for the Herald.

[MSSC6644]

Hey, Big Boo: I read this thread earlier and then I was reading a Politico thread and this is what I happened across in the "response" section:

"Even I am starting to have second thoughts and i'm on the payroll

Posted By: Ellie Light | January 25, 2010 at 01:06 PM

This is the url for the post:

http://www.politico.com/blogs/glennthrush/0110/Berry_Obama_said_big_difference_between_10_and_94_is_me.html?showall

[Palladin]

You have to be over 70 to get that one!

[MSSC6644]

Ellie admits she is being paid by Obama!!

[MSSC6644]

Palladin, I’m only 65 and I got it.

[Palladin]

You’re just a smart kid!

[MSSC6644]

Yeah.... :)

[chris_bdba]

SO/ I use a mac and am not an Obama supporter?

[Bob J]

I think the more disturbing question isn’t who Ellie Light is or where she came from, but how so many of her form letters got printed in news publications.

Do you know how many letters they receive and how hard it is just to get one published?

[The Big Boo]

God knows whats going on now. With the democrat spam machine discovered at their site, Freepers sending out bash letters through it, everyone assuming alternate identities....there being a hundred ellie lights roaming the web now....though how two different ellie lights registered at Politico would be a quirk I guess in the registration...she previously emailed? posted? there to Ben Smith.

The fact is the Republicans were caught asleep at the wheel in discovering Axelrod's widget, yet it was there in plain sight. You would think that spiffy new RNC Internet shop would have nailed this before it started....can't say Republicans ain't dense!!!!!

It should also offer a great lesson in journalism, although I'm afraid rather than any concern for checking identities, today's journalist will say “Cool, how do I get in on the spamming”. A bunch of freaking freaks...all of them.

jes sayin...

[Gideon7]

Here is the WHOIS information from ARIN via RIPE on the originating IP address (82.59.164.11):

inetnum: 82.56.0.0 – 82.59.255.255
netname: TELECOM-ADSL-6
descr: Telecom Italia S.p.A. TIN EASY LITE
country: IT
admin-c: BS104-RIPE
tech-c: BS104-RIPE
status: ASSIGNED PA
remarks: ************************************************
remarks: Pay attention
remarks: Any communication sent to email different
remarks: from the following will be ignored!
remarks: Any abuse reports, please send them to
remarks: abuse@retail.telecomitalia.it
remarks: ************************************************
mnt-by: TIWS-MNT
mnt-lower: TIWS-MNT
mnt-routes: TIWS-MNT
source: RIPE # Filtered
person: BBBEASYIP STAFF
address: MDBLAB
address: Via Val Cannuta, 250
address: I-00100 Roma
address: Italy
phone: +39 06 36881
e-mail: info@irnetco.net
nic-hdl: BS104-RIPE
mnt-by: IRNETCO-RIPE-MNT
source: RIPE # Filtered

---

Telecomitalia.it is a favorite launching point for professional spammers. In the past couple years I’ve sent at least 20 LART complaints to the abuse address listed above and never got a response.

[lefty-lie-spy]

Good info on the story here. If we pop all these rhetorical phrases into Google, web archives, and other search engines, we might come up with something/someone plausible based on speech patterns, such as “Crypto-Stalinist”, “surprise and wonderment”, “record-breaking election”, etc.. It would not surprise me one bit if this turns out to be Obama himself behind this, writing from his encrypted Blackberry while rocking back and forth in the corner sucking his thumb with a blanket over his head in full crackup mode.

http://www.cleveland.com/open/index.ssf/2010/01/letter_writer_claims_diverse_r.html

[Simplemines]

Umm, nobody on a newspaper (unless it’s the NY Times or Washington Post) really looks at letters to the editor, even more so nowadays with overworked skeleton staffs. Unless it’s their job, like an op-ed editor or a clerk.