SquirrelMail exploits?
|
View:
New views
12 Messages
—
Rating Filter:
Alert me
|
 |
SquirrelMail exploits?
by bwells
::
Rate this Message:
I have recently noticed a steady stream of email leaving my server that appears to be from my Squirrel Mail users. I upgraded from 1.4.10 to 1.4.15 in an effort to fix the issue. It went away for a couple of days, but is back now. I have some wireshark captures if anyone else is interested. I will have some more (for the v1.4.15 attacks soon as well). My Server is: Fedora Core v5 Php v4.3.9 UWIMAP 2004G I have access to the webmail disabled from the outside right now (we were already in the process of migrating away from SM when this happened. I’m open to suggestions, comments, flames, etc. I read in the archives about mailto.php, but it wasn’t made clear to me how to fix it, etc. I look forward to your responses! Thanks! ~Brant Wells, Network Administrator Tocco Falls College ------------------------------------------------------------------------- Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://sourceforge.net/services/buy/index.php ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users |
|
|
|
|
|
Re: SquirrelMail exploits?
by Marc Powell
::
Rate this Message:
On Jun 24, 2008, at 3:32 PM, Brant Wells wrote: > Hi All, > > I have recently noticed a steady stream of email leaving my server > that appears to be from my Squirrel Mail users. I upgraded from > 1.4.10 to 1.4.15 in an effort to fix the issue. It went away for a > couple of days, but is back now. > Are you certain that these are not victims of phishing attempts? We've seen attacks specifically targeting Squirrelmail users (and remote SM users as evidenced in the spam we're blocking from the Internet with SM message id's) to compromise their accounts and generate spam from them. http://sourceforge.net/mailarchive/message.php?msg_id=A7B0A9F02975A74A845FE85D0B95B8FA0A599A74%40misex01.ena.com -- Marc ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users |
|
|
Re: SquirrelMail exploits?
by Michel (M)
::
Rate this Message:
> > On Jun 24, 2008, at 3:32 PM, Brant Wells wrote: > >> Hi All, >> >> I have recently noticed a steady stream of email leaving my server >> that appears to be from my Squirrel Mail users. I upgraded from >> 1.4.10 to 1.4.15 in an effort to fix the issue. It went away for a >> couple of days, but is back now. >> > > Are you certain that these are not victims of phishing attempts? We've > seen attacks specifically targeting Squirrelmail users (and remote SM > users as evidenced in the spam we're blocking from the Internet with > SM message id's) to compromise their accounts and generate spam from > them. > > http://sourceforge.net/mailarchive/message.php?msg_id=A7B0A9F02975A74A845FE85D0B95B8FA0A599A74%40misex01.ena.com > hey, and how will that be possible what they say in this thread: always via SM (no other SMTP/ASMTP based attempts are logged) SM is no mta, so it can not send email ... michel **************************************************** Tecnologia Internet Matik http://info.matik.com.br Sistemas Wireless para o Provedor Banda Larga Hospedagem e Email personalizado - e claro, no Brasil. **************************************************** ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users |
|
|
Re: SquirrelMail exploits?
by Ken A
::
Rate this Message:
Michel wrote:
>> On Jun 24, 2008, at 3:32 PM, Brant Wells wrote: >> >>> Hi All, >>> >>> I have recently noticed a steady stream of email leaving my server >>> that appears to be from my Squirrel Mail users. I upgraded from >>> 1.4.10 to 1.4.15 in an effort to fix the issue. It went away for a >>> couple of days, but is back now. >>> >> Are you certain that these are not victims of phishing attempts? We've >> seen attacks specifically targeting Squirrelmail users (and remote SM >> users as evidenced in the spam we're blocking from the Internet with >> SM message id's) to compromise their accounts and generate spam from >> them. >> >> http://sourceforge.net/mailarchive/message.php?msg_id=A7B0A9F02975A74A845FE85D0B95B8FA0A599A74%40misex01.ena.com >> > > > hey, and how will that be possible what they say in this thread: > > always via SM (no other SMTP/ASMTP based attempts are logged) > > SM is no mta, so it can not send email ... > > SM is an email client 'MUA', and it sends mail only through an MTA, so you should have logs in your MTA that tell you what's going on. We are seeing a lot of phishing lately too, and have had a customer account compromised and used to send spam. Squirrelmail is easy to find via google I suppose, so it's an easy target. That doesn't mean there is a vuln in SM. Ken > > michel > > > > > **************************************************** > Tecnologia Internet Matik http://info.matik.com.br > Sistemas Wireless para o Provedor Banda Larga > Hospedagem e Email personalizado - e claro, no Brasil. > **************************************************** > > > ------------------------------------------------------------------------- > Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! > Studies have shown that voting for your favorite open source project, > along with a healthy diet, reduces your potential for chronic lameness > and boredom. Vote Now at http://www.sourceforge.net/community/cca08 > ----- > squirrelmail-users mailing list > Posting guidelines: http://squirrelmail.org/postingguidelines > List address: squirrelmail-users@... > List archives: http://news.gmane.org/gmane.mail.squirrelmail.user > List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users > -- Ken Anderson Pacific.Net ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users |
|
|
Re: SquirrelMail exploits?
by Marc Powell
::
Rate this Message:
On Jul 1, 2008, at 12:17 PM, Michel wrote: > hey, and how will that be possible what they say in this thread: > > always via SM (no other SMTP/ASMTP based attempts are logged) > > SM is no mta, so it can not send email ... > I never said it was. I have a dedicated MTA for Squirrelmail and all other SMTP clients use different MTA's making it easy to distinguish between mail sent from each. -- Marc ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users |
|
|
|
|
|
|
|
|
Re: SquirrelMail exploits?
by Michel (M)
::
Rate this Message:
> On Tue, Jul 1, 2008 at 7:39 PM, Res <res@...> wrote: >> On Tue, 24 Jun 2008, Brant Wells wrote: >> >>> Hi All, >>> >>> I have recently noticed a steady stream of email leaving my server that appears >>> to be from >>> my Squirrel Mail users. I upgraded from 1.4.10 to 1.4.15 in an effort to fix >>> the issue. It >>> went away for a couple of days, but is back now. >> >> I wont go over what others have said about it not being an MTA etc, as its > > <snip> > > And, as always, there are plugins that can help you identify when you > have an account on your server that has been compromised and is being > used to send spam. The best tools for this are your own server logs, > possibly augmented by the "Squirrel Logger" plugin, but if you could > also check out the "Restrict Senders" plugin and if you are trying to > be proactive against password attacks, etc., you can try the "CAPTCHA" > and "Lockout" plugins too. > even if you are right it does not help so much since the MTA should be configured to mail correctly so it does not matter if some else use the account because the spam origin comes back in first place to the relaying mta not to the user so it does not matter if you have users trying to send spam or not so long as your mta is "vacinated" against such attemps - so doen't matter if it is a legitimate user or not. I mean you try bringing the cow down with it's tail when trying to fight passwd attempts, on mta level you get it by it's horns I guess most attempts faking sm origin are not coming from the sm instalation itself but they are faked by relay attempts so with proper relay protection of your MTA all this goes away a good and easy protection is the greeting relay in first place and rate limit in second and then recepient limit count as third and so most spam/relay attempts are gone then michel **************************************************** Tecnologia Internet Matik http://info.matik.com.br Sistemas Wireless para o Provedor Banda Larga Hospedagem e Email personalizado - e claro, no Brasil. **************************************************** ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users |
|
|
Re: SquirrelMail exploits?
by Paul Lesniewski
::
Rate this Message:
On Wed, Jul 2, 2008 at 3:39 AM, Michel <Michel@...> wrote:
> >> On Tue, Jul 1, 2008 at 7:39 PM, Res <res@...> wrote: >>> On Tue, 24 Jun 2008, Brant Wells wrote: >>> >>>> Hi All, >>>> >>>> I have recently noticed a steady stream of email leaving my server that appears >>>> to be from >>>> my Squirrel Mail users. I upgraded from 1.4.10 to 1.4.15 in an effort to fix >>>> the issue. It >>>> went away for a couple of days, but is back now. >>> >>> I wont go over what others have said about it not being an MTA etc, as its >> >> <snip> >> >> And, as always, there are plugins that can help you identify when you >> have an account on your server that has been compromised and is being >> used to send spam. The best tools for this are your own server logs, >> possibly augmented by the "Squirrel Logger" plugin, but if you could >> also check out the "Restrict Senders" plugin and if you are trying to >> be proactive against password attacks, etc., you can try the "CAPTCHA" >> and "Lockout" plugins too. > > even if you are right it does not help so much since the MTA should be configured > to mail correctly so it does not matter if some else use the account because the > spam origin comes back in first place to the relaying mta not to the user You already made your point. I am pointing out other tools that can be used to identify problems like compromised accounts. > so it does not matter if you have users trying to send spam or not so long as your > mta is "vacinated" against such attemps - so doen't matter if it is a legitimate > user or not. I mean you try bringing the cow down with it's tail when trying to > fight passwd attempts, on mta level you get it by it's horns The README files of the necessary plugins already note that better solutions exist at the MTA level. It is NOT a bad thing to apply rules to the SM login page to reduce password guessing attacks, etc. > I guess most attempts faking sm origin are not coming from the sm instalation > itself but they are faked by relay attempts so with proper relay protection of your > MTA all this goes away Stop already. There IS in fact such thing as a compromised SM account being used to send spam. You make it sound like this can never happen. Wrong. > a good and easy protection is the greeting relay in first place and rate limit in > second and then recepient limit count as third and so most spam/relay attempts are > gone then Sure, of course. ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users |
|
|
|
|
|
|
| Free Forum Powered by Nabble | Forum Help |