Timeline for Unusual mail headers show evidence of MTA attack. Have I been pwned?
Current License: CC BY-SA 4.0
23 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 12, 2019 at 12:03 | history | edited | usr-local-ΕΨΗΕΛΩΝ | CC BY-SA 4.0 |
added 98 characters in body
|
| Jun 26, 2019 at 6:26 | comment | added | forest | @Darren Learning the language most of your userspace is written in is a very useful skill. It's not that difficult to learn, especially because reading code is easier than writing it. While ostensibly a sysadmin might never need to know C, the reality is that many problems can be traced down to a bug in the code, and waiting potentially weeks, months, or years for it to be discovered independently isn't always a great solution when your web server suddenly stops accepting connections and maxes out all CPU cores. | |
| Jun 25, 2019 at 15:39 | history | edited | usr-local-ΕΨΗΕΛΩΝ | CC BY-SA 4.0 |
I have decided to remove references to 0-days
|
| S Jun 23, 2019 at 11:10 | history | suggested | koyae | CC BY-SA 4.0 |
Conventions - made some grammar improvements and expanded an acroynm at top for clarity
|
| Jun 21, 2019 at 23:57 | review | Suggested edits | |||
| S Jun 23, 2019 at 11:10 | |||||
| Jun 21, 2019 at 12:35 | comment | added | usr-local-ΕΨΗΕΛΩΝ |
@Nathan I had the same suspect but I had to admit that an executable malware downloaded and executed from tmp would obviously delete itself and conceal its presence under different directories. In your shoes, I would take a deep look at top, crontab and init.d. Answer only suggests Postfix is not vulnerable but who knows for sure
|
|
| Jun 20, 2019 at 14:48 | comment | added | Motomotes | @WBJ, I can't seriously read your reply it is so presumptive. Anyone is not everyone, somewhere is not everywhere, just because something is not everything and it is not everywhere does not mean it is not anywhere. | |
| Jun 20, 2019 at 13:58 | comment | added | Darren | @camp0, if I could downvote comments, I'd downvote yours. Why is it the first response of so many people to "look at the source code". That I know what I'm doing enough to run an MTA does not mean I can decipher and interpret source code of a package I'm using, any more than being able to drive makes me a qualified mechanic. | |
| Jun 20, 2019 at 13:17 | comment | added | WBT | @Motes Are you assuming that everyone who might possibly be vulnerable to the attack reads this SE and this question specifically, especially as quickly as it's posted? I don't think that's a fair assumption. | |
| Jun 20, 2019 at 4:22 | comment | added | Motomotes | @WBT, yes, it made me feel much better to see someone else with some information, anyone scanning this site to exploit such information must be outwitted by the true purpose of the followers of this site or else security.stackexchange itself is to be called into question. This site serves as the source of the cure of immediate issues, or it isn't as "hot network" frontline benefactor as might be hoped. | |
| Jun 19, 2019 at 20:45 | comment | added | WBT | "I would like to know if this [bit of code I am posting on a publicly accessible SEO-optimized website as part of a high-visibility Hot Network Question] is a recent known or 0-day vulnerability." If the answer was yes, do you think posting it here would really be the best course of action, for everybody else's security? (Meta discussion here.) | |
| Jun 19, 2019 at 16:03 | comment | added | Nathan |
I'm seeing this same attack pattern on one of the Postfix servers I manage which began yesterday around 3:13pm CT. The "Received" notations in the email led me to think there might have been a successful download but not seeing any obvious signs in /tmp.
|
|
| Jun 19, 2019 at 14:52 | history | became hot network question | |||
| Jun 19, 2019 at 12:28 | history | edited | usr-local-ΕΨΗΕΛΩΝ | CC BY-SA 4.0 |
I edited my question to better describe the context and make it helpful to others
|
| Jun 19, 2019 at 12:00 | history | tweeted | twitter.com/StackSecurity/status/1141314911286583296 | ||
| Jun 19, 2019 at 7:42 | comment | added | usr-local-ΕΨΗΕΛΩΝ | I have accepted @SteffeinUllrich answer (and going to add few lines of details) because it perfectly matches the attack pattern. This Q&A could potentially help others in the following days/weeks to urge to update EXIM if they use it. | |
| Jun 19, 2019 at 7:38 | vote | accept | usr-local-ΕΨΗΕΛΩΝ | ||
| Jun 19, 2019 at 7:37 | answer | added | Steffen Ullrich | timeline score: 92 | |
| Jun 19, 2019 at 7:19 | comment | added | cremefraiche | @usr-local-ΕΨΗΕΛΩΝ I did a cursory search and found a CVE that references ruby mail gem <2.5.5. Unsure if this help you cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9097 nvd.nist.gov/vuln/detail/CVE-2015-9097. Can't speak to the possibility of a zero-day but I would search around for command injection related to your mail stack and see if anything newer comes up. | |
| Jun 19, 2019 at 7:13 | comment | added | usr-local-ΕΨΗΕΛΩΝ | @cremefraiche excellent. Considering the article is dated 2015 and I keep my MTA up to date, I may assume this attack is not a 0-day and that I might be already protected against it. | |
| Jun 19, 2019 at 7:08 | comment | added | cremefraiche | This appears to be SMTP Injection via recipient email addresses. mbsd.jp/Whitepaper/smtpi.pdf | |
| Jun 19, 2019 at 7:03 | comment | added | camp0 | Looks like they are trying to exploit an issue on the X-Original-To header parser, this could be related to a Postfix issue or to other MTA, check on the postfix mailing list or look directly to the source code. | |
| Jun 19, 2019 at 6:41 | history | asked | usr-local-ΕΨΗΕΛΩΝ | CC BY-SA 4.0 |