Hey all, i found something today, which caused me a wry grin. i am using sendmail tls 8.11 on a suse 7.3 box. According to http://www.abuse.net/cgi-bin/relaytest the server does not allow relay. and now i am gettig massive postmaster mails from te box, each claiming the same the original message was received at Sat, 25 May 2002 12:18:55 +0200 from nobody@localhost with id g4PAItb19508 mail header message. anyone know what this is about? regards Evert Smit

That's excatly what i just found !!!! one of my customers has been using it. i shut it down now. thanks for the input. greatly apreciated. regards Evert -----Original Message----- From: Reto Inversini [mailto:inversini@datacomm.ch] Sent: Saturday, May 25, 2002 1:41 PM To: suse-security@suse.com Subject: Re: [suse-security] Spamming under sendmail 8.11 TLS Hi, You don't have a webserver running on this box? ... perhaps with a vulnerable cgi-script such as the infamous formail.pl? Best regards Reto Inversini ----- Original Message ----- From: "Evert Smit" To: Sent: Saturday, May 25, 2002 1:16 PM Subject: [suse-security] Spamming under sendmail 8.11 TLS

Hey all,

i found something today, which caused me a wry grin. i am using

sendmail tls

8.11 on a suse 7.3 box. According to http://www.abuse.net/cgi-bin/relaytest the server does not allow relay.

and now i am gettig massive postmaster mails from te box, each claiming the same

the original message was received at Sat, 25 May 2002 12:18:55 +0200 from nobody@localhost with id g4PAItb19508

mail header message. anyone know what this is about?

regards Evert Smit

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

-----Original Message----- From: bolo@lupa.de [mailto:bolo@lupa.de] Sent: 1. marts 2002 09:48 To: suse-security@suse.com Subject: Re: [suse-security] Spamming ... [snipped] If you're worried about the From:-line in the mail header, calm down - most spammers use Bcc (blind carbon copy) lists for their mails, to hide the recipient list, and to make things looking "innocent". [snipped] Boris Lorenz I disagree, the real trouble with this is not the angry receivers of the spam, as much as the bounced messages. If Thomas receives multiple bounces due to undeliverable messages, it could have a negative impact on his system ressources. If the bounces are generated from a dictionary spamrun, there could be thousands on the inbound towards his box. Yarrel

Shoot them? There's probably someone out there to annoy you big time. You could go and ask the admins of the originating servers to try to get hold of them (in case their server's been hacked, things like, connection times from "foreign" computers and stuff. So you can trace back them to their ISP, if enough people are willing to cooperate. Don't be surprised if it's someone living round the corner...

So ... this means it will be better to live with the 200 Mails a day ... :) :( Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl@scc.co.at, http://scc.co.at

whois <ip-address> is your friend, here. Sometimes, but APNIC is a total disaster. More often than not no usefull info will turn up, including a closer look the apnic.net and (most notoriousl spammers) nic.or.kr sites, leading to nothing or small

...

2) What can I do to stop those spammers ... I complain quite regularly about spam (if I can find the responsible

Yo! private owned ranges that seem to be completely outta control. A traceroute is a very laborious method as reverse DNS is (almost?) non-existent in the pacific rim. It would be nice if the community could press those reaches of the internet to make some effort to get things straight. parties, am bored and in a faul mood) (note that the text is always friendly, brief and informative) and what I have got is this: - Complain to the open relay itself: mostly bounces about "postmaster@host.net mailbox is full", "mailbox does not exist" or simply no reply. - Complain to real netblock owner or the upstream provider of an open relay: have only recently started do do that because of the previous experience (mostly with cc to relay itself), first results are not too hopefull. - Complain to provider of spam sender: mostly auto replies with no follow-up, but I do get some of those rewarding "we located and disconnected the offending accounts"; there ARE quite some very decent providers out there. - Complain to the provider or real netblock owner of the company that is being promoted in the spam: here I get the best results, mainly (guessing) cause the evidence is soo clear. I've already had quite a few web-sites knocked over, always giving ye that "make my day" feeling :>) Lets all promise to make at least one serious complaint a week! There's obviously not enough people that do... Some things I found out while complaining: be friendly, brief, do include the full headers, skip all the traceroute and whois info (them are professional folk and are probably better than yourself), have your servers NTP synchronized and tell them that and which timezone you're in (so they can cross-reference their logs). I think any form of auto complain or auto reject will remain largely a dream. One very cool tool I found recently (though I did not use it myself yet): http://software.libertine.org/tmda/