Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #158964 > unrolled thread

[OT] Has my e-mail account been hacked?

Back to article view | Back to linux.debian.user

Contents

  [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-12 16:50 +0200
    Re: [OT] Has my e-mail account been hacked? Florian Pelgrim <florian.pelgrim@craneworks.de> - 2015-10-12 17:00 +0200
      Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-12 23:00 +0200
        Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-13 02:00 +0200
          Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 06:40 +0200
            Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-13 10:20 +0200
              Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-13 17:30 +0200
                Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 20:10 +0200
                Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-13 22:10 +0200
                Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:10 +0200
              Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:00 +0200
                Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 04:20 +0200
                  Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 05:00 +0200
                    Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 05:20 +0200
                    Re: [OT] Has my e-mail account been hacked? Adrian O'Dell <crimsonmane@gmail.com> - 2015-10-14 05:20 +0200
                    Re: [OT] Has my e-mail account been hacked? John Hasler <jhasler@newsguy.com> - 2015-10-14 05:30 +0200
                      Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 05:40 +0200
                        Re: [OT] Has my e-mail account been hacked? Timothy Hobbs <timothy@hobbs.cz> - 2015-10-14 10:40 +0200
                        Re: [OT] Has my e-mail account been hacked? Carl Fink <carl@finknetwork.com> - 2015-10-14 15:10 +0200
                  Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 05:30 +0200
                Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 04:30 +0200
                  Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 05:30 +0200
          Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 08:40 +0200
            Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 09:10 +0200
              Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 11:00 +0200
                Re: [OT] Has my e-mail account been hacked? <tomas@tuxteam.de> - 2015-10-13 11:00 +0200
                  Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 11:10 +0200
                    Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 11:20 +0200
            Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 21:10 +0200
            Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 03:30 +0200
              Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-14 11:00 +0200
          Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 13:20 +0200
          Re: [OT] Has my e-mail account been hacked? stelios kteniadalis <keste82@gmail.com> - 2015-10-14 12:40 +0200
    Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-12 18:40 +0200
      Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 00:50 +0200
        Re: [OT] Has my e-mail account been hacked? Adrian O'Dell <crimsonmane@gmail.com> - 2015-10-14 01:00 +0200
        Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-14 01:00 +0200
          Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:30 +0200
            Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-14 11:10 +0200
              [SOLVED] [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-16 01:00 +0200
        Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 03:30 +0200
    Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-12 22:50 +0200

Page 1 of 3  [1] 2 3  Next page →

#158964 — [OT] Has my e-mail account been hacked?

About a week ago, I discovered hundreds of "mail delivery failure"
messages in my inbox.  Investigation revealed that they were all for
SPAM e-mails that I did not send.  I am guessing that this means one
of two things:

(1) Someone discovered my password somehow, logged into my ISP
account as me, and sent out a bunch of SPAM.

Or

(2) Someone sent out a bunch of SPAM, spoofing my e-mail address
as the sender, and the delivery failures came to me.

How can I tell which is the case, and if it's (2), is there anything
I can do to defend myself against this sort of thing in the future?

(I do know enough not to respond in any way to the almost-daily phishing
attacks that try to get me to supply my userid and password.  I have
never responded to any of them.)

I am running Debian stretch; but of course I realize that this question
is not, strictly speaking, a Debian question; so I have marked it
off-topic.  But I suspect that it is of interest to users of this list,
since this list is accessed via e-mail.

-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [next] | [standalone]

#158966

[Multipart message — attachments visible in raw view] — view raw

Hi,

> About a week ago, I discovered hundreds of "mail delivery failure"
> messages in my inbox.  Investigation revealed that they were all for
> SPAM e-mails that I did not send.  I am guessing that this means one
> of two things:
> 
> (1) Someone discovered my password somehow, logged into my ISP
> account as me, and sent out a bunch of SPAM.
> 
> Or
> 
> (2) Someone sent out a bunch of SPAM, spoofing my e-mail address
> as the sender, and the delivery failures came to me.
> 
> How can I tell which is the case, and if it's (2), is there anything
> I can do to defend myself against this sort of thing in the future?
You could check the header of one email you know you send and one of the
others.
I guess what you are getting is simple backscatter spam like in (2) you
described.

> 
> (I do know enough not to respond in any way to the almost-daily phishing
> attacks that try to get me to supply my userid and password.  I have
> never responded to any of them.)
> 
> I am running Debian stretch; but of course I realize that this question
> is not, strictly speaking, a Debian question; so I have marked it
> off-topic.  But I suspect that it is of interest to users of this list,
> since this list is accessed via e-mail.
> 

[toc] | [prev] | [next] | [standalone]

#158988

[Multipart message — attachments visible in raw view] — view raw

On 13/10/15 00:57, Florian Pelgrim wrote:
>> (2) Someone sent out a bunch of SPAM, spoofing my e-mail address
>> > as the sender, and the delivery failures came to me.
>> > 
>> > How can I tell which is the case, and if it's (2), is there anything
>> > I can do to defend myself against this sort of thing in the future?
> You could check the header of one email you know you send and one of the
> others.
> I guess what you are getting is simple backscatter spam like in (2) you
> described.

I'd check the backscatter case, as this requires no skill on the part of
the attacker and is the most likely case.

I've been on the receiving end of a backscatter deluge before.  Not fun.

I actually harvested the offending hosts and used the emails as evidence
of spam activity to have the site brought down.  I found there were 6
machines sending the crap, WHOIS look-ups were performed, and emails
written to those six hosts with samples of the bounces provided, along
with the host hosting the website concerned.

The dead give-away was that the initial "Received" header did not match
any of my hosts.  In fact, all they had done was put my address in the
Return-Path.

It's worth knowing how to read the headers of emails in this
circumstance as it can give you vital information for knowing what is
going on.
-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.

[toc] | [prev] | [next] | [standalone]

#158992

On Mon, 12 Oct 2015 16:53:05 -0400 (EDT), Stuart Longland wrote:
> 
> I'd check the backscatter case, as this requires no skill on the part of
> the attacker and is the most likely case.
> ...
> It's worth knowing how to read the headers of emails in this
> circumstance as it can give you vital information for knowing what is
> going on.

Unfortunately, I don't.  Attached below is one of the mail delivery
failure notices, which includes the headers of the original message.
But I don't understand what it all means.  Perhaps you or someone else
out there can make some sense of it and advise me accordingly.
Remember, I never sent the original e-mail.  I just got the delivery
failure notice.

-----

This message was created automatically by the mail system (ecelerity).

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

>>> zerriells@aol.com (after RCPT TO): 550 5.1.1 <zerriells@aol.com>: Recipient address rejected: aol.com

------ This is a copy of the headers of the original message. ------

Return-Path: <zlinuxman@wowway.com>
X_CMAE_Category: , ,
X-CNFS-Analysis: v=2.1 cv=eaKdB+wH c=1 sm=1 tr=0 a=FxXVyIFnAocEnA08ajU80w==:117 a=FxXVyIFnAocEnA08ajU80w==:17 a=K-v-2zaBAAAA:8 a=QP5IY3kgAAAA:8 a=ZhWb6TEzAAAA:8 a=kj9zAlcOel0A:10 a=op2l2dobe8TBvKaan4QA:9 a=qSf3gRf-E_nrW77P:21 a=Nputykdsa0hyqt36:21 a=CjuIK1q_8ugA:10
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
X-Authed-Username: dGhlY291Z2hpbmdjYW5hcnlAd293d2F5LmNvbQ==
X_CMAE_Category: , ,
X-CNFS-Analysis: 
X-CM-Score: 
X-Scanned-by: Cloudmark Authority Engine
Authentication-Results:  smtp02.wow.cmh.synacor.com smtp.user=thecoughingcanary; auth=pass (LOGIN)
Received: from [69.73.17.154] ([69.73.17.154:57886] helo=46MmPDFcgl13022)
	by smtp.mail.wowway.com (envelope-from <zlinuxman@wowway.com>)
	(ecelerity 3.6.1.42806 r(Platform:3.6.1.1)) with ESMTPA
	id 54/A2-15401-2D8D4165; Wed, 07 Oct 2015 04:33:28 -0400
Reply-To: <shoprecruiterss@oath.com>
Message-ID: <54.A2.15401.2D8D4165@smtp02.wow.cmh.synacor.com>
From: "SSN"<zlinuxman@wowway.com>
To: shoprecruiterss@oath.com
Subject: - Welcome: Mystery Shopper's 2015 -
Date: Wed, 7 Oct 2015 19:18:16 -0700
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081



-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [prev] | [next] | [standalone]

#159008

[Multipart message — attachments visible in raw view] — view raw

On 13/10/15 09:58, Stephen Powell wrote:
> Unfortunately, I don't.  Attached below is one of the mail delivery
> failure notices, which includes the headers of the original message.
> But I don't understand what it all means.

Okay, here goes an attempt at a translation.

> Return-Path: <zlinuxman@wowway.com>

Okay, this is the address where bounce messages will be sent to.

> X_CMAE_Category: , ,
> X-CNFS-Analysis: v=2.1 cv=eaKdB+wH c=1 sm=1 tr=0 a=FxXVyIFnAocEnA08ajU80w==:117 a=FxXVyIFnAocEnA08ajU80w==:17 a=K-v-2zaBAAAA:8 a=QP5IY3kgAAAA:8 a=ZhWb6TEzAAAA:8 a=kj9zAlcOel0A:10 a=op2l2dobe8TBvKaan4QA:9 a=qSf3gRf-E_nrW77P:21 a=Nputykdsa0hyqt36:21 a=CjuIK1q_8ugA:10
> X-CM-Score: 0
> X-Scanned-by: Cloudmark Authority Engine
> X-Authed-Username: dGhlY291Z2hpbmdjYW5hcnlAd293d2F5LmNvbQ==
> X_CMAE_Category: , ,
> X-CNFS-Analysis: 
> X-CM-Score: 
> X-Scanned-by: Cloudmark Authority Engine

These are some scanning service.  Anything with an X- header is a
non-standard header.  Perhaps a search for "Cloudmark Authority Engine"
might yield some clues as to how to interpret these.

> Authentication-Results:  smtp02.wow.cmh.synacor.com smtp.user=thecoughingcanary; auth=pass (LOGIN)
Not sure about this one.

> Received: from [69.73.17.154] ([69.73.17.154:57886] helo=46MmPDFcgl13022)
> 	by smtp.mail.wowway.com (envelope-from <zlinuxman@wowway.com>)
> 	(ecelerity 3.6.1.42806 r(Platform:3.6.1.1)) with ESMTPA
> 	id 54/A2-15401-2D8D4165; Wed, 07 Oct 2015 04:33:28 -0400

There are usually several of these, and they'll appear in reverse order.
 (If you want an example, have a look at mine.)  The bottom one, should
be the original source of the email.

In this case, it gives the IP address of 69.73.17.154 as the source, and
'smtp.mail.wowway.com' was the host that processed the email.  The rest
is detail on how it got there (in this case, the SMTP protocol).

We'll come back to this.

> Reply-To: <shoprecruiterss@oath.com>
> Message-ID: <54.A2.15401.2D8D4165@smtp02.wow.cmh.synacor.com>
> From: "SSN"<zlinuxman@wowway.com>
> To: shoprecruiterss@oath.com
> Subject: - Welcome: Mystery Shopper's 2015 -

Those are the start of the actual message, so where to send replies to
(if someone hits Reply), the message identifier (used when matching a
reply to the original message), From/To/Cc addresses and email subject.

We determined that the email came from 69.73.17.154.  If we do a WHOIS
look-up on this, we get:

> RC=0 stuartl@rikishi ~ $ whois 69.73.17.154
> 
> #
> # ARIN WHOIS data and services are subject to the Terms of Use
> # available at: https://www.arin.net/whois_tou.html
> #
> # If you see inaccuracies in the results, please report at
> # http://www.arin.net/public/whoisinaccuracy/index.xhtml
> #
> 
> 
> #
> # The following results may also be obtained via:
> # http://whois.arin.net/rest/nets;q=69.73.17.154?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
> #
> 
> 
> # start
> 
> NetRange:       69.73.17.152 - 69.73.17.159
> CIDR:           69.73.17.152/29
> NetName:        HUNT697317152-29
> NetHandle:      NET-69-73-17-152-1
> Parent:         WIDEOPENWEST (NET-69-73-0-0-1)
> NetType:        Reassigned
> OriginAS:       AS12083
> Customer:       Oakwood Church (C02277166)
> RegDate:        2009-07-17
> Updated:        2009-07-17
> Ref:            http://whois.arin.net/rest/net/NET-69-73-17-152-1
> 
> 
> CustName:       Oakwood Church
> Address:        5500 Adventist Blvd NW.
> City:           Huntsville
> StateProv:      AL
> PostalCode:     35896
> Country:        US
> RegDate:        2009-07-17
> Updated:        2013-03-19
> Ref:            http://whois.arin.net/rest/customer/C02277166
> 
> OrgAbuseHandle: IPADM469-ARIN
> OrgAbuseName:   IP Administrator
> OrgAbusePhone:  +1-706-645-8194 
> OrgAbuseEmail:  abuse@wideopenwest.com
> OrgAbuseRef:    http://whois.arin.net/rest/poc/IPADM469-ARIN
> 
> OrgNOCHandle: IPADM669-ARIN
> OrgNOCName:   IP Administrator
> OrgNOCPhone:  +1-706-634-2898 
> OrgNOCEmail:  ipadmin@wideopenwest.com
> OrgNOCRef:    http://whois.arin.net/rest/poc/IPADM669-ARIN
> 
> OrgTechHandle: UNIXA3-ARIN
> OrgTechName:   Unix Administration
> OrgTechPhone:  +1-630-536-3158 
> OrgTechEmail:  emcmillen@wideopenwest.com
> OrgTechRef:    http://whois.arin.net/rest/poc/UNIXA3-ARIN
> 
> OrgTechHandle: IPADM669-ARIN
> OrgTechName:   IP Administrator
> OrgTechPhone:  +1-706-634-2898 
> OrgTechEmail:  ipadmin@wideopenwest.com
> OrgTechRef:    http://whois.arin.net/rest/poc/IPADM669-ARIN
> 
> # end
> 
> 
> # start
> 
> NetRange:       69.73.0.0 - 69.73.127.255
> CIDR:           69.73.0.0/17
> NetName:        WIDEOPENWEST
> NetHandle:      NET-69-73-0-0-1
> Parent:         NET69 (NET-69-0-0-0-0)
> NetType:        Direct Allocation
> OriginAS:       AS12083
> Organization:   WideOpenWest Finance LLC (WOPW)
> RegDate:        2003-09-03
> Updated:        2013-03-19
> Ref:            http://whois.arin.net/rest/net/NET-69-73-0-0-1
> 
> 
> OrgName:        WideOpenWest Finance LLC
> OrgId:          WOPW
> Address:        1674 Frontenac Rd
> City:           Naperville
> StateProv:      IL
> PostalCode:     60563
> Country:        US
> RegDate:        2002-04-10
> Updated:        2015-05-08
> Ref:            http://whois.arin.net/rest/org/WOPW
> 
> 
> OrgAbuseHandle: IPADM469-ARIN
> OrgAbuseName:   IP Administrator
> OrgAbusePhone:  +1-706-645-8194 
> OrgAbuseEmail:  abuse@wideopenwest.com
> OrgAbuseRef:    http://whois.arin.net/rest/poc/IPADM469-ARIN
> 
> OrgNOCHandle: IPADM669-ARIN
> OrgNOCName:   IP Administrator
> OrgNOCPhone:  +1-706-634-2898 
> OrgNOCEmail:  ipadmin@wideopenwest.com
> OrgNOCRef:    http://whois.arin.net/rest/poc/IPADM669-ARIN
> 
> OrgTechHandle: UNIXA3-ARIN
> OrgTechName:   Unix Administration
> OrgTechPhone:  +1-630-536-3158 
> OrgTechEmail:  eric.bailey@wideopenwest.com
> OrgTechRef:    http://whois.arin.net/rest/poc/UNIXA3-ARIN
> 
> OrgTechHandle: IPADM669-ARIN
> OrgTechName:   IP Administrator
> OrgTechPhone:  +1-706-634-2898 
> OrgTechEmail:  ipadmin@wideopenwest.com
> OrgTechRef:    http://whois.arin.net/rest/poc/IPADM669-ARIN
> 
> # end
> 
> 
> 
> #
> # ARIN WHOIS data and services are subject to the Terms of Use
> # available at: https://www.arin.net/whois_tou.html
> #
> # If you see inaccuracies in the results, please report at
> # http://www.arin.net/public/whoisinaccuracy/index.xhtml
> #

The bounce message unfortunately doesn't give us any information on what
the server's IP address is, so we can't easily compare it to the emails
you're sending to the list to see if the routes match up.

The headers do bear a strong resemblance though.  Not sure if you're
using a standard email client on another host or whether you're running
a webmail client (I think Zimbra does both).  The email *looks* as if it
was sent directly to your host before a relay was attempted.

From my perspective, it looks like your SMTP password possibly has been
leaked or cracked.
-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.

[toc] | [prev] | [next] | [standalone]

#159017

[Multipart message — attachments visible in raw view] — view raw

Stuart Longland:
> On 13/10/15 09:58, Stephen Powell wrote:
>>
>> Unfortunately, I don't.  Attached below is one of the mail delivery
>> failure notices, which includes the headers of the original message.
>> But I don't understand what it all means.
…
>> Authentication-Results:  smtp02.wow.cmh.synacor.com smtp.user=thecoughingcanary; auth=pass (LOGIN)
>>
> Not sure about this one.

It looks like the mail was delivered directly through
smtp02.wow.cmh.synacor.com by a user who successfully authenticated
using the username thecoughingcanary.

@Stephen: is that you? Who runs this mail service? If this is not your
username, you might want to contact the people who run the service and
have them reset the user's password.

I had a similar case on my self-administered mail host. A friend of mine
has an account there and random hosts from all over the world used his
credentials to send legitimately looking spam. We never found out how
this happened but changing the password was enough to make it stop.

J.
-- 
The news at ten makes me peevish but animal hospital makes me cry.
[Agree]   [Disagree]
                 <http://www.slowlydownward.com/NODATA/data_enter2.html>

[toc] | [prev] | [next] | [standalone]

#159051

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 13/10/2015 7:15 PM, Jochen Spieker wrote:
> Stuart Longland: I had a similar case on my self-administered mail
> host. A friend of mine has an account there and random hosts from
> all over the world used his credentials to send legitimately
> looking spam. We never found out how this happened but changing the
> password was enough to make it stop.

Odds on it was open WiFi somewhere, people trust public WiFi ... I
cannot understand why.  It is patently stupid [or ignorant at best] to
use public [or otherwise open] WiFi -- if you don't run it yourself or
you totally trust the person whom is running it, then leave it alone.

Linus had quite a fit over OpenSuSE handling of WiFi networks; it was
asking for root password to enable the WiFi (amongst other things) --
that I think is absolutely the right way to do this.  Admins should
allow network access specifically, not ordinary users, let alone
Linus' daughter whom otherwise should never need to know the root
password.

Of course, using VPN for everything and I do mean everything on an
untrusted WiFi /may/ help, but you better not be running an insecure
VPN like PPTP.

Cheers
A.

[1] https://plus.google.com/+LinusTorvalds/posts/1vyfmNCYpi5
 - and related write up about retiring kernel devs as a bonus:
    http://fossforce.com/2015/10/good-software-bad-behavior/


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlYdIbcACgkQqBZry7fv4vsOEAEAm9v7mwybNM05hKATeTr09Bgi
DET56kiMt89R6DXOalABAJetGdpSh9ee5Rz1LiOqBgC+MV/i+HVRDR/TiSKkgC4K
=2WiA
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#159062

On Wed 14 Oct 2015 at 02:22:34 +1100, Andrew McGlashan wrote:

> On 13/10/2015 7:15 PM, Jochen Spieker wrote:
> > Stuart Longland: I had a similar case on my self-administered mail
> > host. A friend of mine has an account there and random hosts from
> > all over the world used his credentials to send legitimately
> > looking spam. We never found out how this happened but changing the
> > password was enough to make it stop.
> 
> Odds on it was open WiFi somewhere, people trust public WiFi ... I
> cannot understand why.  It is patently stupid [or ignorant at best] to
> use public [or otherwise open] WiFi -- if you don't run it yourself or
> you totally trust the person whom is running it, then leave it alone.

Quite right! I run an open WiFi hotspot. I control it, so it is set up
to remove all vowels from email which is sent through it. Mind you, I
haven't yet found a way to access the computers which connect to the
router and then send spam using them. Perhaps you can give me a clue how
to do this in a surefire way.

> Linus had quite a fit over OpenSuSE handling of WiFi networks; it was
> asking for root password to enable the WiFi (amongst other things) --
> that I think is absolutely the right way to do this.  Admins should
> allow network access specifically, not ordinary users, let alone
> Linus' daughter whom otherwise should never need to know the root
> password.

For all the gory journalistic details start with

  http://www.zdnet.com/article/linus-torvalds-snarls-at-opensuse-desktop-linuxs-security/

If only Linus had the sense to use Debian. :)

[toc] | [prev] | [next] | [standalone]

#159074

[Multipart message — attachments visible in raw view] — view raw

Andrew McGlashan:
> On 13/10/2015 7:15 PM, Jochen Spieker wrote:
>>
>> Stuart Longland: I had a similar case on my self-administered mail
>> host. A friend of mine has an account there and random hosts from
>> all over the world used his credentials to send legitimately
>> looking spam. We never found out how this happened but changing the
>> password was enough to make it stop.
> 
> Odds on it was open WiFi somewhere, people trust public WiFi

My services do not allow him to send the password unencrypted, be it
over SMTP, IMAP or HTTP. So even if he had used an insecure network,
someone would still have had to MITM the TLS connections in order to
capture the password. I am not completely sure whether he would have
noticed that, but I do think so. And he said he didn't use this password
anywhere else.

Given that information, one probably has to assume that one of his
machines is infected.

J.
-- 
I often play sports / do exercise.
[Agree]   [Disagree]
                 <http://www.slowlydownward.com/NODATA/data_enter2.html>

[toc] | [prev] | [next] | [standalone]

#159103

On Tue, 13 Oct 2015 11:22:34 -0400 (EDT), Andrew McGlashan wrote:
> 
> On 13/10/2015 7:15 PM, Jochen Spieker wrote:
>> Stuart Longland: I had a similar case on my self-administered mail
>> host. A friend of mine has an account there and random hosts from
>> all over the world used his credentials to send legitimately
>> looking spam. We never found out how this happened but changing the
>> password was enough to make it stop.
> 
> Odds on it was open WiFi somewhere, people trust public WiFi ... I
> cannot understand why.  It is patently stupid [or ignorant at best] to
> use public [or otherwise open] WiFi -- if you don't run it yourself or
> you totally trust the person whom is running it, then leave it alone.

That may have been the case for Stuart's friend, but it is not the case
with me.  I use only wired ethernet.

-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [prev] | [next] | [standalone]

#159102

On Tue, 13 Oct 2015 04:15:21 -0400 (EDT), Jochen Spieker wrote:
> 
> Stuart Longland:
>> On 13/10/15 09:58, Stephen Powell wrote:
>>>
>>> Unfortunately, I don't.  Attached below is one of the mail delivery
>>> failure notices, which includes the headers of the original message.
>>> But I don't understand what it all means.
> …
>>> Authentication-Results:  smtp02.wow.cmh.synacor.com smtp.user=thecoughingcanary; auth=pass (LOGIN)
>>>
>> Not sure about this one.
> 
> It looks like the mail was delivered directly through
> smtp02.wow.cmh.synacor.com by a user who successfully authenticated
> using the username thecoughingcanary.
> 
> @Stephen: is that you?

No.  My id on this mail server is "zlinuxman".  I have no idea who
"thecoughingcanary" is.  Nor do I understand why the SMTP server would
allow "thecoughingcanary" to send out e-mails in my name, unless
"thecoughingcanary" is an administrator account.

> Who runs this mail service?

Wide Open West, or "Wow!" as they market themselves.

   http://wowway.net/

It's basically a cable TV company.  I have a bundle of cable, internet,
and phone service from them.  They provide free e-mail and a free
web-hosting service to all who subscribe to their internet service.
My connectivity is through a cable modem which they provide.
I have my own wired ethernet router connected to it, and my computers
connect to that.
> 
> If this is not your
> username, you might want to contact the people who run the service and
> have them reset the user's password.

I may do that.  But first, I have to be sure that I know what I'm talking
about.  They will probably try to avoid blame if they can.  It's human nature.
>  
> I had a similar case on my self-administered mail host.  A friend of mine
> has an account there and random hosts from all over the world used his
> credentials to send legitimately looking spam. We never found out how
> this happened but changing the password was enough to make it stop.

Of course, changing my own password won't help if they authenticated via
"thecoughingcanary".  Are you sure that the credentials of "thecoughingcanary"
were used to send the e-mails?

If it was my credentials which were used, then I need to know that, and I
need to know how my password was obtained and plug that leak.  Otherwise, they
will obtain the new password the same way that they obtained the old one,
and I'll be right back to square one.

-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [prev] | [next] | [standalone]

#159104

[Multipart message — attachments visible in raw view] — view raw

On 14/10/15 11:53, Stephen Powell wrote:
> On Tue, 13 Oct 2015 04:15:21 -0400 (EDT), Jochen Spieker wrote:
>>
>> Stuart Longland:
>>> On 13/10/15 09:58, Stephen Powell wrote:
>>>>
>>>> Unfortunately, I don't.  Attached below is one of the mail delivery
>>>> failure notices, which includes the headers of the original message.
>>>> But I don't understand what it all means.
>> …
>>>> Authentication-Results:  smtp02.wow.cmh.synacor.com smtp.user=thecoughingcanary; auth=pass (LOGIN)
>>>>
>>> Not sure about this one.
>>
>> It looks like the mail was delivered directly through
>> smtp02.wow.cmh.synacor.com by a user who successfully authenticated
>> using the username thecoughingcanary.
>>
>> @Stephen: is that you?
> 
> No.  My id on this mail server is "zlinuxman".  I have no idea who
> "thecoughingcanary" is.  Nor do I understand why the SMTP server would
> allow "thecoughingcanary" to send out e-mails in my name, unless
> "thecoughingcanary" is an administrator account.

This is making a lot more sense now.  So 'wowway.com' is your ISPs
server, and 'thecoughingcanary' is another customer of theirs.  Likely a
compromised one.  Your ISP needs to know about this.

Why did it allow the email to be relayed?  Well, the credentials were
correct, that's all that was needed.  (Yes, SMTP is that basic.)

You'd probably find you can send email from *any* email address you
choose, provided that the email address domain permits that server to
send emails from that domain.

(e.g. my domain has SPF records that only permit a small handful of
servers to send emails with a 'longlandclan.id.au' domain.  Anyone else
will trigger a "soft-failure".)

This isn't level 1 helpdesk material, you'll actually need a technical
contact there.

> Registrant Name: WIDEOPENWEST LLC
> Registrant Organization: WIDEOPENWEST LLC
> Registrant Street: 1323 Bond St.
> Registrant City: Naperville
> Registrant State/Province: IL
> Registrant Postal Code: 60563
> Registrant Country: US
> Registrant Phone: +1.6305363161
> Registrant Phone Ext: 
> Registrant Fax: +1.6305363108
> Registrant Fax Ext: 
> Registrant Email: unixadmins@wideopenwest.com

My first point of call would be that 'unixadmins@wideopenwest.com' as it
now appears you're seeing the bounce traffic from another customer's
compromised host.  I'd forward them a sample of the bounce traffic.
-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.

[toc] | [prev] | [next] | [standalone]

#159108

On Tue, 13 Oct 2015 22:09:53 -0400 (EDT), Stuart Longland wrote:
> 
> This isn't level 1 helpdesk material, you'll actually need a technical
> contact there.

Their level 1 help desk isn't much help anyway, if you're a Linux user.
The last time I called their level 1 help desk for technical support, the
conversation went something like this:

Me:   I'm having an internet connectivity problem.  I can't ....
Them: What release of Windows are you running?
Me:   I don't run Windows; I run Linux.
Them: I'm sorry, sir, we don't support Linux.
Me:   This is not a Linux problem.  This is an internet connectivity problem.
      I can't ...
Them: I'm sorry, sir, we don't support Linux.  Is there anything else we
      can help you with today, sir?
Me:   No, I don't think so.

And that was that.  They'll gladly take the money of a Linux user.
But if you have problems, you're on your own.  That was a few years ago.
Maybe it's better now.

-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [prev] | [next] | [standalone]

#159109

[Multipart message — attachments visible in raw view] — view raw

On 14/10/15 12:51, Stephen Powell wrote:
> Their level 1 help desk isn't much help anyway, if you're a Linux user.
> The last time I called their level 1 help desk for technical support, the
> conversation went something like this:

Yep, familiar story.  Some can't get it through their thick heads that
you want support for the *internet connection* and not the computer
connected to it.  If it isn't in their script, they don't know anything
about it and don't want to know.

> And that was that.  They'll gladly take the money of a Linux user.
> But if you have problems, you're on your own.  That was a few years ago.
> Maybe it's better now.

True, as I said, this isn't L1 helpdesk material, I gave details of a
WHOIS look-up that gave an email address and telephone number you could
contact.

You'll probably note this is a different email address to your regular
helpdesk contact details, and for good reason.  It is for a totally
different audience: a technical one who know how to work the `whois`
tool, know what an IP address is, and know that a serial port isn't a
place for sailors to eat breakfast.

Forward them the bounce emails you've been getting, then the ball is in
their court.  I do know what it is like to deal with a clueless
helpdesk, spent many hours on the phone with a few here.

-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.

[toc] | [prev] | [next] | [standalone]

#159110

On 10/13/2015 09:51 PM, Stephen Powell wrote:
> On Tue, 13 Oct 2015 22:09:53 -0400 (EDT), Stuart Longland wrote:
>> This isn't level 1 helpdesk material, you'll actually need a technical
>> contact there.
> Their level 1 help desk isn't much help anyway, if you're a Linux user.
> The last time I called their level 1 help desk for technical support, the
> conversation went something like this:
>
> Me:   I'm having an internet connectivity problem.  I can't ....
> Them: What release of Windows are you running?
> Me:   I don't run Windows; I run Linux.
> Them: I'm sorry, sir, we don't support Linux.
> Me:   This is not a Linux problem.  This is an internet connectivity problem.
>        I can't ...
> Them: I'm sorry, sir, we don't support Linux.  Is there anything else we
>        can help you with today, sir?
> Me:   No, I don't think so.
>
> And that was that.  They'll gladly take the money of a Linux user.
> But if you have problems, you're on your own.  That was a few years ago.
> Maybe it's better now.
>
Not likely any better now. You should just lie to them about what you're 
using.

[toc] | [prev] | [next] | [standalone]

#159113

Stephen Powell writes:
> And that was that.  They'll gladly take the money of a Linux user.
> But if you have problems, you're on your own.

Lie.  Tell them you're running Windows 95.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#159114

[Multipart message — attachments visible in raw view] — view raw

On 14/10/15 13:23, John Hasler wrote:
> Lie.  Tell them you're running Windows 95.

"Ohh sorry, we only support Windows 7 or 8"

-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.

[toc] | [prev] | [next] | [standalone]

#159133

Say that you are using the Desktop version of Android(tm). It's pretty 
close to the truth.

On 10/14/15 05:33, Stuart Longland wrote:
> On 14/10/15 13:23, John Hasler wrote:
>> Lie.  Tell them you're running Windows 95.
> "Ohh sorry, we only support Windows 7 or 8"
>

[toc] | [prev] | [next] | [standalone]

#159149

On Wed, Oct 14, 2015 at 01:33:02PM +1000, Stuart Longland wrote:
> On 14/10/15 13:23, John Hasler wrote:
> > Lie.  Tell them you're running Windows 95.
> 
> "Ohh sorry, we only support Windows 7 or 8"

I can truthfully say that my Android-based tablet can't get access. It's
hard for ISPs not to support tablets.
-- 
Carl Fink                           nitpicking@nitpicking.com 

Read my blog at blog.nitpicking.com.  Reviews!  Observations!
Stupid mistakes you can correct!

[toc] | [prev] | [next] | [standalone]

#159112

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

On 14/10/2015 1:09 PM, Stuart Longland wrote:
>> No.  My id on this mail server is "zlinuxman".  I have no idea
>> who "thecoughingcanary" is.  Nor do I understand why the SMTP
>> server would allow "thecoughingcanary" to send out e-mails in my
>> name, unless "thecoughingcanary" is an administrator account.

Yes, that can be a serious problem; any ONE user can compromise others.

> This is making a lot more sense now.  So 'wowway.com' is your ISPs 
> server, and 'thecoughingcanary' is another customer of theirs.
> Likely a compromised one.  Your ISP needs to know about this.

Yep.

> Why did it allow the email to be relayed?  Well, the credentials
> were correct, that's all that was needed.  (Yes, SMTP is that
> basic.)

Right.

> You'd probably find you can send email from *any* email address
> you choose, provided that the email address domain permits that
> server to send emails from that domain.
> 
> (e.g. my domain has SPF records that only permit a small handful
> of servers to send emails with a 'longlandclan.id.au' domain.
> Anyone else will trigger a "soft-failure".)

SPF is only good if the receiving server does proper checks and you
don't have a soft fail in your setup.  Too many servers don't seem to
care about SPF failing, which is why back scatter is [or was] a much
greater problem that it should ever have been.

A.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlYdyoQACgkQqBZry7fv4vuA9gD+IvJyS7o4qSNJo/hKW+heUe11
zmxAEtvo5lI9NvR65JMBAJUnLst8W/l+gj0lysa2B7G2oVfcRQzUGvu0b7c+NNyv
=Eshk
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | linux.debian.user

csiph-web