So just to be clear,
a new and
unacknowledged Exchange or Windows 2000 vulnerability
has not been discovered here right?
We want
to know about vulnerabilities (not mis-configurations)
If you do wish to report a suspected
security vulnerability please either contact
myself directly, log the details on https://s.microsoft.com/technet/security/bulletin/alertus.asp
or email secure@microsoft.com (PGP key is on https://s.microsoft.com/technet/security/MSRC.asc
)
Details
of our vulnerability handling processes are
on http://microsoft.com/technet/security/bulletin/msrpracs.asp
Regards
Nathan
Technology Specialist
Microsoft NZ
From: Geoff Williams [mailto:geoff@katnet.com.au]
Sent: Tuesday,
28 October 2003 11:26 a.m.
To: nznog@list.waikato.ac.nz
Subject: FW: [nznog] New and unacknowledged
Exchange / Win2k SMTPvulnerability?
Further to my earlier
post, Neil G has pointed me
correctly to an SMTP AUTH attack. I
have used the logs of the ORF tool
to pinpoint which accounts have been compromised.
Strangely
the spammers are
trying to work out why, even if they authenticate, they can't
relay, so there is a lot of traffic
to watch and
learn from. A large number of their connections are being blocked by the IP blacklists
I have selected. I had originally
blocked 2 Class A IP ranges at
our router after watching the traffic
and finding that
they were allocated to a
provider in China. But I am not 100% sure that
IP addresses are
not being spoofed as they seem to have a
huge range of Class A and
B addresses available
to them and I was really
chasing my tail
trying to block them at that level.
So now I have
a new password
generator and
will start training
the mind to work with 12 or more character passwords.
Hope this is of assistance to others.
-----Original
Message-----
From: Geoff Williams
Sent: Monday,
27 October 2003 11:01 PM
To: nznog@list.waikato.ac.nz
Subject: [nznog] New and unacknowledged
Exchange / Win2k SMTP vulnerability?
I have exactly the same
open-relay problem, including the
sending servers and addresses, and
have been struggling to diagnose for a
few weeks.
I had a hunch that
the hack may
involve the SystemMailbox account (which of course is disabled), but this was
based on checking security logs
and seeing who was logged in at
the same time as
the spam was
dumped into the queue.
I have got around it for the moment (I hope) by loading the ORF relay
and spam
tool but I would really like to know
how this hack is being perpetrated as I
have a
whole stack of other Exchange servers to look after
and I really
don't want this to get out of
control...
So if anyone has made any progress I would really
appreciated
you sharing your experience.
______________
Geoffrey Williams
KAT International
T: 02 9904 3137
F: 02 9904 0232
M: 0417 281 905
size=2 width="100%" align=center>
This email is confidential
and intended for the recipient only.
If you have received it in error please delete it immediately.