Re: 12.177.9.5

Hello.

On 09/13/2005 05:33 PM, David Cornett wrote:

> Is there any testing process that we can request before we try your removal
> process.

This maillist is a right place for this request. The standard test based
on real spammer activity is in progress now.

...Oops. It had an effect:

Server accepted message
AUTH=cram-md5 USER=backup PASS=backup IP=12.177.9.5

The situation is much more serious than an open relay. In difference
from "test", "backup" is an administrative account. It is VERY POSSIBLE
that whole system has been compromised and backdoored already through
this account. The practical recommendation is simple: disconnect,
reinstall from scratch, set new passwords for all accounts, apply
security audits. Sorry.

>  We have gotten rid of our open relay and also the test / test
> account.

I believe, a proper action could be to use any automated tool for
internal password auditing. There is a plenty of security tools being
able to detect accounts with weak passwords. Any external test will not
be so effective and can miss something important.

best,
Alexey
DSBL volunteer

>  We are about to do the removal process again but don't want to
> have something wrong and go through this time consuming process again.
> 
>  
> 
> David Cornett
> 
>  
> 
> RBSK Partners PC
> 
> 224 N. Broadway Street
> 
> P.O. Box 200
> 
> Greensburg, IN 47240
> 
> Phone: (812) 663-7567, Ext. 227
> 
> Fax: (812) 663-8886
> 
> [email protected]
> 
>  
> 
>  
> 
> FEDERAL TAX ADVICE DISCLAIMER
> 
> To comply with IRS Regulations, we inform you that any discussion of Federal
> tax issues contained in this email (including any attachments) was not
> intended or written to be used, and cannot be used (i) to avoid any
> penalties imposed under the Internal Revenue Code or (ii) to promote, market
> or recommend to another party any transaction or matter addressed herein.
> 
>  
> 
> CONFIDENTIALITY NOTICE
> 
> This e-mail message is for the sole use of the intended recipient(s) and may
> contain information that is privileged and confidential.  Any unauthorized
> review, use, disclosure or distribution is prohibited.  If you are not the
> intended recipient(s), please contact the sender by reply e-mail and destroy
> the original message and any copies of the message as well as any
> attachments.
> 
>  
> 
>