Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256540 > unrolled thread

Strange locally-originating spam messages from sport.qc.ca

Back to article view | Back to linux.debian.user

Contents

  Strange locally-originating spam messages from sport.qc.ca Julian Gilbey <julian@d-and-j.net> - 2023-03-30 11:00 +0200
    Re: Strange locally-originating spam messages from sport.qc.ca Jeremy Ardley <jeremy@ardley.org> - 2023-03-30 11:10 +0200
      Re: Strange locally-originating spam messages from sport.qc.ca Julian Gilbey <julian@d-and-j.net> - 2023-03-30 13:30 +0200
    Re: Strange locally-originating spam messages from sport.qc.ca Reco <recoverym4n@enotuniq.net> - 2023-03-30 11:20 +0200
      Re: Strange locally-originating spam messages from sport.qc.ca Greg Wooledge <greg@wooledge.org> - 2023-03-30 13:20 +0200
        Re: Strange locally-originating spam messages from sport.qc.ca Julian Gilbey <julian@d-and-j.net> - 2023-03-31 10:40 +0200
      Re: Strange locally-originating spam messages from sport.qc.ca Julian Gilbey <julian@d-and-j.net> - 2023-03-30 13:20 +0200
        Re: Strange locally-originating spam messages from sport.qc.ca Reco <recoverym4n@enotuniq.net> - 2023-03-30 14:00 +0200
          Re: Strange locally-originating spam messages from sport.qc.ca Julian Gilbey <julian@d-and-j.net> - 2023-03-31 10:40 +0200

#256540 — Strange locally-originating spam messages from sport.qc.ca

I'm getting a significant number of spam messages being sent to my MTA
(exim) for the address FRPJXbKeKuek at sport.qc.ca, and now I'm
starting to see some sent to www-data at aether.toine.be.  What is
disturbing is that the machine is on a local network, and my
internet-facing router does not forward anything to this machine.  So
I presume that these mails are originating from the machine itself.

I have another machine on the same network that is internet-facing and
also receives similar messages.

I don't know how to track down the source of these mails, and I wonder
if somehow my machine has picked up some sort of virus.

I wonder if anyone has any idea about how to track this down?

Thanks!

   Julian

[toc] | [next] | [standalone]

#256541

On 30/3/23 16:30, Julian Gilbey wrote:
> I'm getting a significant number of spam messages being sent to my MTA
> (exim) for the address FRPJXbKeKuek at sport.qc.ca, and now I'm
> starting to see some sent to www-data at aether.toine.be.  What is
> disturbing is that the machine is on a local network, and my
> internet-facing router does not forward anything to this machine.  So
> I presume that these mails are originating from the machine itself.

The first problem I see is you have just published the internal DNS name 
of a machine in your local network.

bots will at this moment be scouring this mailing list and recording the 
internal dns name.

More intelligent bots will be able to pair your email address and server 
and the internal dns name and make a guess your internal server has a 
user www-data that can receive emails.

Hence you get emails to your public email server addressed to your 
internal server.

in 99.99% of the cases that won't be a problem. But in a small number of 
cases it will be.

-- 
Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#256548

Hi Jeremy!

On Thu, Mar 30, 2023 at 05:03:47PM +0800, Jeremy Ardley wrote:
> 
> On 30/3/23 16:30, Julian Gilbey wrote:
> > I'm getting a significant number of spam messages being sent to my MTA
> > (exim) for the address FRPJXbKeKuek at sport.qc.ca, and now I'm
> > starting to see some sent to www-data at aether.toine.be.  What is
> > disturbing is that the machine is on a local network, and my
> > internet-facing router does not forward anything to this machine.  So
> > I presume that these mails are originating from the machine itself.
> 
> The first problem I see is you have just published the internal DNS name of
> a machine in your local network.

To clarify: these are the addresses that the email was addressed to.
They have absolutely no relationship with my personal network(s),
hostname(s) or personal email addresses.

But I think I've just solved the problem (by grepping for this email
address across my system); my local machine was - unknown to me -
running fetchmail.  These spam messages must have been sent to the
mail server being read by fetchmail.  That is a relief!

Best wishes,

   Julian

[toc] | [prev] | [next] | [standalone]

#256542

	Hi.

On Thu, Mar 30, 2023 at 09:30:49AM +0100, Julian Gilbey wrote:
> I wonder if anyone has any idea about how to track this down?

I'd check /var/log/exim4/mainlog first, obviously.
For instance, your mail was sent to my MTA by bendel.d.o, as is
should be:

$ grep ZmNnhCgr7-N.A.uSE.A2UJkB /var/log/exim4/mainlog
2023-03-30 10:51:15 1pho03-0000QZ-9B <= bounce-debian-user=deb=enotuniq.net@lists.debian.org H=bendel.debian.org [82.195.75.100] P=esmtps X=TLS1.3:ECDHE_X25519__ECDSA_SECP384R1_SHA384__AES_256_GCM:256 CV=no S=5087 id=ZmNnhCgr7-N.A.uSE.A2UJkB@bendel

Reco

[toc] | [prev] | [next] | [standalone]

#256545

On Thu, Mar 30, 2023 at 12:00:01PM +0300, Reco wrote:
> On Thu, Mar 30, 2023 at 09:30:49AM +0100, Julian Gilbey wrote:
> > I wonder if anyone has any idea about how to track this down?
> 
> I'd check /var/log/exim4/mainlog first, obviously.

In addition to that, open one of the spam messages in a competent MUA
and examine the full headers.  You should see one or more "Received:"
headers.  Every time the message is handed off to a new MTA, a new
Received: header is prepended to the top of the message, so to read
them in chronological order, you have to start at the bottom and work
your way upward.

So, look at the bottom-most Received: header first.  Do you recognize
either the sending or receiving system?  If not, continue upward until
you do.

At some point, one of them should reveal where the message came from
(i.e. who sent it to your computer).

If your computer truly is cut off from the Internet as you say, then
I would imagine you received it from another host on your local network.
Be prepared for that.

[toc] | [prev] | [next] | [standalone]

#256573

Hi Greg,

On Thu, Mar 30, 2023 at 07:18:15AM -0400, Greg Wooledge wrote:
> On Thu, Mar 30, 2023 at 12:00:01PM +0300, Reco wrote:
> > On Thu, Mar 30, 2023 at 09:30:49AM +0100, Julian Gilbey wrote:
> > > I wonder if anyone has any idea about how to track this down?
> > 
> > I'd check /var/log/exim4/mainlog first, obviously.
> 
> In addition to that, open one of the spam messages in a competent MUA
> and examine the full headers.  You should see one or more "Received:"
> headers.  Every time the message is handed off to a new MTA, a new
> Received: header is prepended to the top of the message, so to read
> them in chronological order, you have to start at the bottom and work
> your way upward.
> [...]

Thanks - this was useful, and eventually helped me to pin-point the
source of the spam.

Best wishes,

   Julian

[toc] | [prev] | [next] | [standalone]

#256546

On Thu, Mar 30, 2023 at 12:00:01PM +0300, Reco wrote:
> 	Hi.
> 
> On Thu, Mar 30, 2023 at 09:30:49AM +0100, Julian Gilbey wrote:
> > I wonder if anyone has any idea about how to track this down?
> 
> I'd check /var/log/exim4/mainlog first, obviously.
> For instance, your mail was sent to my MTA by bendel.d.o, as is
> should be:
> 
> $ grep ZmNnhCgr7-N.A.uSE.A2UJkB /var/log/exim4/mainlog
> 2023-03-30 10:51:15 1pho03-0000QZ-9B <= bounce-debian-user=deb=enotuniq.net@lists.debian.org H=bendel.debian.org [82.195.75.100] P=esmtps X=TLS1.3:ECDHE_X25519__ECDSA_SECP384R1_SHA384__AES_256_GCM:256 CV=no S=5087 id=ZmNnhCgr7-N.A.uSE.A2UJkB@bendel

Hi Reco,

Thanks!

The log seems quite unhelpful here, though I may be missing
something.  Here is an example:

2023-03-29 00:07:19 1phIPT-0047NQ-0H <= <> H=(LOCALHOSTNAME) [::1] P=smtp S=2878
2023-03-29 00:07:19 1phIPT-0047NQ-0H ** frpjxbkekuek@sport.qc.ca <FRPJXbKeKuek@sport.qc.ca> R=nonlocal: Mailing to remote domains not supported
2023-03-29 00:07:19 1phIPP-0047NT-0V <= <> R=1phIPT-0047NQ-0H U=Debian-exim P=local S=667
2023-03-29 00:07:19 1phIPT-0047NQ-0H Frozen (delivery error message)
2023-03-29 00:13:24 1phIPT-0047NQ-0H Message is frozen

...and lots of repeats of this last message until I manually deleted
the message.

(I've replaced my local machine name with "LOCALHOSTNAME" in the above.)

It seems to have originated locally ([::1]), which is why I wonder
whether I've got a virus of some sort.

On my internet-facing host, these messages appear to originate from a
Canadian ISP, but I don't know whether to believe it, given what's
happening on my other machine.

Best wishes,

   Julian

[toc] | [prev] | [next] | [standalone]

#256549

	Hi.

On Thu, Mar 30, 2023 at 12:19:24PM +0100, Julian Gilbey wrote:
> The log seems quite unhelpful here, though I may be missing
> something.  Here is an example:

I disagree. There's nothing to miss here, thus you're correct.

> 2023-03-29 00:07:19 1phIPT-0047NQ-0H <= <> H=(LOCALHOSTNAME) [::1] P=smtp S=2878

That, my friend, is a locally queued mail.
I.e. some process on that very host connected to exim on tcp:25 on the
same host and

> 2023-03-29 00:07:19 1phIPT-0047NQ-0H ** frpjxbkekuek@sport.qc.ca <FRPJXbKeKuek@sport.qc.ca> R=nonlocal: Mailing to remote domains not supported

tried to send a e-mail to that e-mail above.
That exim is probably configured as "local" MTA, so it refused to send
that e-mail.


> It seems to have originated locally ([::1]), which is why I wonder
> whether I've got a virus of some sort.

"Virus" is such a harsh word.
It's a malware, plain and simple.

I suggest you to:

1) Poweroff problematic host ASAP.

2) Remove HDD from that host.

3) Attach the HDD to known clean host, preferably with a different CPU
architecture, mount filesystems.

4) Check Debian software for validity (debsums -ac -r ...).

5) Check crontabs (both system and users'), double-check www-data
crontab.

6) Check systemd timers, both system and users'.

7) Consider using very strict Apparmor policy for any LAN-facing
services that you have there in the future (aa-genprof).


> On my internet-facing host, these messages appear to originate from a
> Canadian ISP, but I don't know whether to believe it, given what's
> happening on my other machine.

Be generous, ban whole AS of that ISP via iptables/nft first.
Consider repeating the steps outlined above for internet-facing host
too.

Reco

[toc] | [prev] | [next] | [standalone]

#256572

Hi Reco,

On Thu, Mar 30, 2023 at 02:34:29PM +0300, Reco wrote:
> 	Hi.
> 
> On Thu, Mar 30, 2023 at 12:19:24PM +0100, Julian Gilbey wrote:
> > The log seems quite unhelpful here, though I may be missing
> > something.  Here is an example:
> 
> I disagree. There's nothing to miss here, thus you're correct.
> [...]

Thanks for your detailed analysis and advice!  Though I've solved the
problem in this case (it was fetchmail running in daemon mode, pulling
in emails from another mail server, though I didn't realise that this
was happening), your suggestions are excellent and I will bear them in
mind in the future if anything similar happens.

Best wishes,

   Julian

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web