RE: Website link for 63.87.94.131

I appreciate the further information regarding our listing.  After your
last description I was able to find the problem and I have now fixed
this host.  Any help you guys could provide would be greatly
appreciated.  Thanks in advance.

Regards, 

Brice Spreitzer 
Server Administrator 
CEC/OEG 
Phone: 847.851.5133


-----Original Message-----
From: Alexey Lobanov (dsbl) [mailto:[email protected]] 
Sent: Wednesday, September 28, 2005 12:15 AM
To: Brice Spreitzer
Cc: [email protected]
Subject: Re: [DSBL-Contact] Website link for 63.87.94.131

Hello.

On 28/09/05 07:28, Brice Spreitzer wrote:

> DSBL,
> 
> I have submitted the proper mail to de-list this server.  I am a
> little unclear as to how it could have gotten listed.

I am sorry, but this sequence of sentences seems to be a bit illogical.
If you are not sure where are the landmines, why do you try to remove
red flags?

>  I do not see
> the required cookie in the email your server received from our host.
> I have tested this and another of our servers with the same
> configuration (MS Exchange 2003), and all tests indicate this is not
> an open relay.

It is still open relay, because of empty password for "/webmaster"
account (and, possibly, other ones). This type of vulnerability is
widely used by professional spammers since mid-2002.

> 
> Please provide any further information that you have on this host, or
> any information that can help me to verify this host is secure.

Please read again the evidences in "Messages from this host" section at
http://dsbl.org/listing?63.87.94.131. Your host is really insecure, and
the recommended instant action is full internal security audit. It is
more than possible that same unprotected account (or accounts?) was used
for other types of invasion, and this system is backdoored already.

Best,
Alexey
DSBL volunteer


>  I
> have read your entire FAQ and the only thing left (in my mind) is a
> malicous user.  Is there any more to the header that your server
> received, maybe something including an end host IP address.  If it is
> an internal user or student, I would like to find out who, and why
> this occurred.
> 
> Thank you in advance.
> 
> Brice Spreitzer Server Administrator Career Education Corp. Online
> Education Group 847.851.5133