3

I just received an email that corresponds to the description here, which was posted just a couple of hours ago:

https://myonlinesecurity.co.uk/pdfpart2-pdf-sent-from-my-samsung-galaxy-note-4-powered-by-three-js-malware-leads-to-locky-ransomware/

Since the sender was was admin@mydomain.tld, might someone have logged into my Ubuntu server, or was the email simply sent to the email service on my server, in which case it's just spam.

I couldn't find any evidence of unknown logins using last or in syslog, but there are an insane amount of these in syslog today:

postfix/smtpd[24558]: connect from jackofallthreads.co[128.199.182.74]
postfix/smtpd[24558]: lost connection after UNKNOWN from jackofallthreads.co[128.199.182.74]
postfix/smtpd[24558]: disconnect from jackofallthreads.co[128.199.182.74]

SSH login to my server requires a private key, and root login is disabled.

EDIT: Here is the email's Delivered history. Note I have email forward from $ME@$MYDOMAIN to $ME@gmail.com. How can glean from this whether my server was compromised?

Delivered-To: $ME@gmail.com
Received: by $SOMEIP with SMTP id $ID;
        $DATE
Received: from localhost ($MYHOSTNAME. [$MYIP])
        by mx.google.com with ESMTP id $ID
        for <$ME@gmail.com>;
        $DATE
Received-SPF: neutral (google.com: $MYIP is neither ... admin@$MYDOMAIN) client-ip=$MYIP;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: $MYIP is neither ... admin@$MYDOMAIN) smtp.mailfrom=admin@MYDOMAIN
Received: from [$SOMEIP] (unknown [$SOMEIP])
    by localhost (Postfix) with ESMTP id $ID
    for <$ME@$MYDOMAIN>; $DATE
  • 3
    Anybody can set any email address in the From:-line of an email. The address in itself is not grounds for worry. – Jenny D Mar 17 '16 at 15:03
  • If you want to be sure, do the usual reactionary stuff. Change all your passwords to the server / webhost, check your server for any newly created files and make sure you or someone else with access can account for their creation, and keep a close eye on the logs at times someone might assume you normally wouldn't. – WorseDoughnut Mar 17 '16 at 15:12
  • If in doubt, preserve your oldest backup (and take if offline) before proceeding. – RedGrittyBrick Mar 17 '16 at 16:52
3

SSH login to my server requires a private key, and root login is disabled.

Is a sensible precaution for ssh.

Since the sender was was admin@mydomain.tld

If you take precautions for your ssh, do you apply the same to your SMTP? You should at least have SPF configured for your domain. Do you? Is the SPF validated by your receiving MTA? This should prevent you getting emails not from a legitimate source (or at least cut down the noise).

Assuming tat SPF is not working end-to-end for whatever reason, have you checked the email headers to see if it really did originate on your servers? I think it's very unlikely it did, but if this is the case, then you have good reason to suspect that your server or the hosting environment has been compromised.

If not, then think of it as a wee prompt to get your email security sorted out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.