Many of my users today got email from firstname.lastname@example.org (where docs# was between docs0 and docs8 or so, and mydomain.com is obviously changed from my real domain name), with the sender name of "Administrator." The message had subject "New Voice message" and message: "You have received a voice mail message. Message length is 00:06:11." It was sent to many different users and distribution groups, a weird mix of different departments that wouldn't normally make sense (email to our customer service group, plus our CFO, plus a random IT member? Weird). There was an attachment: ATT00001..txt, a text file.
Some research online shows this to be a virus attempt possibly from CryptoLocker (yikes!!!), and the remaining text file is what was left after being stripped upon arrival, either by our spam filtering service (I don't think so, based on logs), our SonicWALL gateway (I believe it's this that saved us), or a virus scanner built in to Outlook (nope, Webmail shows the same attachment). We use Postini for our spam filtering service, so our MX records direct all email there and our squid proxy server only accepts mail from Postini, does some filtering, and passes it on to our Exchange server.
Based on the email header, I've figured out this route that the email has allegedly taken (Domain and our public IP have been changed):
docs9718.mydomain.com (10.139.106.94) --> smtp.mydomain.com (10.0.0.18)
docs844.mydomain.com (10.0.0.18) --> mydomain.com (10.0.0.147)
ABTS-KK-dynamic-188.8.131.52.airtelbroadband.in ([184.108.40.206]) --> exprod5mx283.postini.com ([220.127.116.11])
psmtp.com (exprod5mx283.postini.com [18.104.22.168]) --> proxy2.mydomain.com
proxy2.mydomain.com ([127.0.0.1]) --> localhost (proxy2.mydomain.com [127.0.0.1])
localhost (localhost.localdomain [127.0.0.1]) --> proxy2.mydomain.com
proxy2.mydomain.com (22.214.171.124) --> proteus.mydomain.com (192.168.200.3)
Postini was allowing these messages through, even though there were a couple of strange things about them. For example, the SMTP Message-ID is a unique string that is set by the first message server that handles the message, and is normally not messed with by any subsequent servers. Yet this email's Message-ID was WPU1PYS3Y86EVSN2PK75E3MI0SPZGWSTD0W1EU@mydomain.com instead of, for example if I got something from Dell, it would say SomethingSomething@Dell.com. It has my domain in its Message-ID.
But that's when I realized, the first servers to handle the message DID have my domain name! That's how the SMTP Message-ID was spoofed, I presume. In fact, that residential address in India (ABTS-KK-dynamic...) is probably a home user with a virus, and that virus made up the first few addresses.
The problem there is those 10.x.x.x addresses are not only in the private ARPA IP range, but they obviously don't really correspond to our domain (altered, but in this example my "real" IP is 126.96.36.199). Another issue is that there is a gap between the fake mydomain.com and the Indian computer.
How do our mail servers not account for a major gap in the headers? And does it not verify anything about the originating server, just takes its word for it? Because not only is it not a valid IP, it doesn't match DNS records for that domain it says, plus the originating domain is the same as the destination domain! That wouldn't normally make sense, as that mail would be internal.
Also, am I right about this SMTP Message-ID spoofing technique? I can't find anything like it online. But the tactic makes sense - If I say it came from some bogus mydomain.com servers and the middle servers never verify that, the final server will believe it really came from my domain. Simple MAIL FROM: spoofing on an open relay won't work on our server, but something like this apparently can. I'm just not sure if that's what's being done here.
Here's the entire faked headers file (renamed public IP, domain, and To: email addresses only): Pastebin link