This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SMTP being hijacked - trying to block sender

Looks like over the weekend we got hijacked and now I have spammers from Italy using our SMTP relay to send thousands of emails. I have added their domains to the sender blacklist filter and the expression filter, but the emails continue to pour through. Obviously, I'm not using the right tool to stop them. I've got a list of the domains they're using - does anyone know how I can block these guys? Thanks!

edit: Also realized this could be a malware intrusion on one of our workstations - we are currently scanning all machines with Malwarebytes to see if we can find the culprit. Just in case this is not the issue and we indeed have been hijacked, any tips for dealing with this would be highly appreciated.
____

ASG220
Firmware 7.501
Pattern Version 22662

This thread was automatically locked due to age.

Parents

0 BAlfson over 14 years ago

I don't know if you're using Lion or not, but apparently there's a really nasty bug where Lion will accept any password when using LDAP authentication.

Tremendous find, Scott! I bet that's exactly what their script was looking to exploit, and they found Steve's Astaro that was allowing LDAP-authenticated relay from remote users. I guess the "test" account had no password, or had the default password they were looking for - then, when that stopped working, their script shifted to other names, but it was unable to authenticate because Steve's LDAP server didn't have the bug you reported to us.

Does that fit, Steve?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 14 years ago

I don't know if you're using Lion or not, but apparently there's a really nasty bug where Lion will accept any password when using LDAP authentication.

Tremendous find, Scott! I bet that's exactly what their script was looking to exploit, and they found Steve's Astaro that was allowing LDAP-authenticated relay from remote users. I guess the "test" account had no password, or had the default password they were looking for - then, when that stopped working, their script shifted to other names, but it was unable to authenticate because Steve's LDAP server didn't have the bug you reported to us.

Does that fit, Steve?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data