0

Recently I've set up two SMTP auth-enabled sendmails, and within a week and month both of them were used to send unsolicited mail using SMTP AUTH. Attackers were acting from different IP and using different users - but only one user for each server. First I thought that some malware just scanned victim's disk and got it's password, but when it happened for the second time I thought that now it's improbable - because the affected user was retired long ago, it's mailbox dropped, it's mail archives are probably nonexistent or stored on some abandoned and/or shelved disks - it existed only in sasl2 DB.

I've dropped the compromised user. I've tried to send a mail using SMTP AUTH and a telnet - and it looks like the server doesn't relay mail with empty or improper SMTP AUTH. I've searched for any sendmail or libsasl2 CVEs - both have multiple, but none recent, both systems had sendmail and libsasl2 patched at the time of the breach.

So, are there any other possibility to send mail that I'm not aware of ? The IP of one of the servers is 128.127.144.4, so you can try it in case you have an idea. Yeah, it's probably a bad idea to expose a server affected by some security flaw in a community, but the attackers have already found it anyway, and I'm still watching it's logs.

Here's a typical SMTP session:

egrep '187.111.57.236|w3CJ14gL016656' maillog.0
Apr 13 00:01:04 elf rmilter[1493]: <1002b962b6>; accepted connection from elf.hq.norma.perm.ru; client: 187.111.57.236:40595 ([187.111.57.236])
Apr 13 00:01:07 elf sm-mta[16656]: AUTH=server, relay=[187.111.57.236], authid=alex, mech=PLAIN, bits=0
Apr 13 00:01:10 elf rmilter[1493]: <1002b962b6>; mlfi_data: queue id: <w3CJ14gL016656>
Apr 13 00:01:12 elf opendkim[1961]: w3CJ14gL016656: can't parse From: header value ' alex'
Apr 13 00:01:12 elf sm-mta[16656]: w3CJ14gL016656: from=<alex>, size=334, class=0, nrcpts=1, msgid=<ndshcfz-60v0pd-50@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:01:12 elf rmilter[1493]: <1002b962b6>; msg done: queue_id: <w3CJ14gL016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:01:14 elf sm-mta[16728]: w3CJ14gL016656: to=<[email protected]>, delay=00:00:05, xdelay=00:00:02, mailer=esmtp, pri=30334, relay=cluster5.eu.messagelabs.com. [85.158.136.83], dsn=5.0.0, stat=Service unavailable
Apr 13 00:01:14 elf sm-mta[16728]: w3CJ14gL016656: w3CJ1EgK016728: DSN: Service unavailable
Apr 13 00:01:18 elf sm-mta[16656]: w3CJ14gN016656: from=<alex>, size=408, class=0, nrcpts=2, msgid=<EDCDCC98-B8B6-F39C-966D-807F6D1EB512@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:01:26 elf rmilter[1493]: <8c0b950267>; msg done: queue_id: <w3CJ14gN016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (2 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:01:32 elf sm-mta[16656]: w3CJ14gP016656: from=<alex>, size=433, class=0, nrcpts=2, msgid=<DF473463.5B8BE96E6707637A@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:01:35 elf rmilter[1493]: <1e60121bd1>; msg done: queue_id: <w3CJ14gP016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (2 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:01:40 elf sm-mta[16656]: w3CJ14gR016656: from=<alex>, size=352, class=0, nrcpts=1, msgid=<5rnocqr-7cbfza-4B@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:01:40 elf rmilter[1493]: <2566fbec9b>; msg done: queue_id: <w3CJ14gR016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:01:46 elf sm-mta[16656]: w3CJ14gT016656: from=<alex>, size=376, class=0, nrcpts=2, msgid=<nqa3edbggmlregbxzpp6s2gq.1238156633123@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:01:46 elf rmilter[1493]: <424091d28a>; msg done: queue_id: <w3CJ14gT016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (2 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:01:51 elf sm-mta[16656]: w3CJ14gV016656: from=<alex>, size=348, class=0, nrcpts=1, msgid=<g863qm7-nqfvlu-E6@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:01:59 elf rmilter[1493]: <24f70a9e90>; msg done: queue_id: <w3CJ14gV016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:02:05 elf sm-mta[16656]: w3CJ14gX016656: from=<alex>, size=387, class=0, nrcpts=2, msgid=<6qf0ejm-9zz62l-D9@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:02:05 elf rmilter[1493]: <99ffc4b437>; msg done: queue_id: <w3CJ14gX016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (2 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:02:10 elf sm-mta[16656]: w3CJ14gZ016656: from=<alex>, size=408, class=0, nrcpts=1, msgid=<C6AAC86D.0240677@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:02:10 elf rmilter[1493]: <f77b77d04f>; msg done: queue_id: <w3CJ14gZ016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:02:15 elf sm-mta[16656]: w3CJ14gb016656: from=<alex>, size=413, class=0, nrcpts=1, msgid=<C51C7275.3715C09DDFEBC27A@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:02:15 elf rmilter[1493]: <a5da79ba76>; msg done: queue_id: <w3CJ14gb016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:02:20 elf sm-mta[16656]: w3CJ14gd016656: from=<alex>, size=412, class=0, nrcpts=1, msgid=<A219E6DE-C17F-8C8E-2EED-6C11324F4856@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:02:26 elf rmilter[1493]: <d299e12ce5>; msg done: queue_id: <w3CJ14gd016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:02:32 elf sm-mta[16656]: w3CJ14gf016656: from=<alex>, size=459, class=0, nrcpts=2, msgid=<AC390E75-91F7-0748-98FC-08407D78C8D1@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:02:35 elf rmilter[1493]: <9924362f7a>; msg done: queue_id: <w3CJ14gf016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (2 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:02:41 elf sm-mta[16656]: w3CJ14gh016656: from=<alex>, size=359, class=0, nrcpts=2, msgid=<gxkj6otgb3u7fgog77dl029g.1300223824295@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:02:41 elf rmilter[1493]: <749b441efb>; msg done: queue_id: <w3CJ14gh016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (2 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:02:46 elf sm-mta[16656]: w3CJ14gj016656: from=<alex>, size=386, class=0, nrcpts=2, msgid=<w0dgjl1-yp38y1-B3@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:02:47 elf rmilter[1493]: <e8d8dcc43b>; msg done: queue_id: <w3CJ14gj016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (2 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:02:52 elf sm-mta[16656]: w3CJ14gl016656: from=<alex>, size=432, class=0, nrcpts=2, msgid=<32D7901C-5F09-E45D-42CA-ACF50859F4CA@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:02:56 elf rmilter[1493]: <32f5cc689b>; msg done: queue_id: <w3CJ14gl016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (2 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:03:01 elf sm-mta[16656]: w3CJ14gn016656: from=<alex>, size=390, class=0, nrcpts=1, msgid=<18B59E3D-8DE4-7F11-36C1-2135E903A2FB@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:03:08 elf rmilter[1493]: <d74707f221>; msg done: queue_id: <w3CJ14gn016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:03:13 elf sm-mta[16656]: w3CJ14gp016656: from=<alex>, size=343, class=0, nrcpts=1, msgid=<fo2xzb80ox1ljkrotbe28j4i.1151459227245@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:03:14 elf rmilter[1493]: <8dfcbdfa8e>; msg done: queue_id: <w3CJ14gp016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:03:18 elf sm-mta[16656]: w3CJ14gr016656: from=<alex>, size=395, class=0, nrcpts=1, msgid=<A3EB3BE1-8E1A-4345-0E04-CE7600F9B204@>, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]
Apr 13 00:03:28 elf rmilter[1493]: <7fa30f7963>; msg done: queue_id: <w3CJ14gr016656>; message id: <>; ip: 187.111.57.236; from: <alex>; rcpt: <[email protected]> (1 total); user: alex; spam scan: skipped, whitelisted; virus scan: clean; dkim: not signed, ignored
Apr 13 00:04:41 elf sm-mta[16656]: w3CJ14gt016656: collect: unexpected close on connection from [187.111.57.236], sender=<alex>
Apr 13 00:04:41 elf sm-mta[16656]: w3CJ14gt016656: from=<alex>, size=52, class=0, nrcpts=1, proto=ESMTPA, daemon=elf-as-mta, relay=[187.111.57.236]

Update: it was out-of-date roundcube installation.

Improve this question
4
  • What's in your logs? Otherwise this is just guessing.
    – Esa Jokinen
    Commented Apr 14, 2018 at 7:21
  • Added a sample session.
    – drookie
    Commented Apr 14, 2018 at 7:28
  • 2
    @drookie: How strong are the passwords for the users? Were there any logs in the past with lots of failed authentication which might indicate someone brute-forcing the authentication?
    – Steffen Ullrich
    Commented Apr 14, 2018 at 7:31
  • Your question led me to a coclusion that bother servers were attacked through an out-of-date Roundcube installation.
    – drookie
    Commented Apr 14, 2018 at 7:37

1 Answer 1

Reset to default
1 
$ telnet 128.127.144.4 smtp
Trying 128.127.144.4...
Connected to 128.127.144.4.
Escape character is '^]'.
220 elf.hq.norma.perm.ru ESMTP Sendmail 8.15.2/8.15.2; Sat, 14 Apr 2018 12:16:42 +0500 (YEKT)
ehlo yue
250-elf.hq.norma.perm.ru Hello ip-xxxxxxxxxx.net [58.xxx.xxx.xxx], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE 100000000
250-DSN
250-ETRN
250-AUTH LOGIN PLAIN DIGEST-MD5 CRAM-MD5
250-STARTTLS
250-DELIVERBY
250 HELP
quit

You're offering CRAM and DIGEST which means you're storing plaintext passwords (or the equivalent) somewhere. maybe the list has been compromised?

You're offering LOGIN and PLAIN over unsecured connections maybe the password was sniffed by packet inspection on a compromised router.

Or they could just have guessed it, I see lots of guessing going on.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .