You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Kenneth Porter <sh...@sewingwitch.com> on 2006/03/10 05:25:22 UTC
Spammer forums
Saw a story on SlashDot today that mentions this spammer forum site:
<http://www.specialham.com/specialham/>
Here's the SlashDot mention:
<http://yro.slashdot.org/comments.pl?sid=179751&cid=14885196>
Re: Via HTTP??
Posted by Kenneth Porter <sh...@sewingwitch.com>.
On Friday, March 10, 2006 9:52 AM -0800 Kelson <ke...@speed.net> wrote:
> Hmm, Fedora Core 2 is officially EOL'd. Are you updating things
> manually, or through Fedora Legacy?
>
> Fedora Legacy does show an Apache update released on Feb. 18:
> http://fedoralegacy.org/updates/FC2/
And subscribe to the fedora-legacy mailing list. Announcements of packages
in testing appear there. I've added the updates-testing repo to my yum
list, as the packages there are pretty stable and only lacking in enough
testers voting to release the update.
Re: Via HTTP??
Posted by Kelson <ke...@speed.net>.
NW7US, Tomas wrote:
> I run Fedora 2 (RedHat) Linux. I've updated most everything. I've not
> updated to the very latest Apache. Perhaps that's needed.
Hmm, Fedora Core 2 is officially EOL'd. Are you updating things
manually, or through Fedora Legacy?
Fedora Legacy does show an Apache update released on Feb. 18:
http://fedoralegacy.org/updates/FC2/
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Via HTTP??
Posted by Duncan Hill <sa...@nacnud.force9.co.uk>.
On Saturday 11 March 2006 04:25, NW7US, Tomas wrote:
> My scripts are really buttoned down, those that I have written myself.
> The perl scripts do use the CGI code, latest. And I do my own regex
> stuff. I'll double-check my tests. I just don't yet see how the messages
> are getting through. If I could figure out what script... I've got to
> figure out some way to audit...
If you've got hosted domains, grep -r 'mail(' /path/to/webroots :) It'll
at least give you a starting list of scripts that use mail().
Then, using that list of scripts, build a script that can check your web
server access logs - either in real time or post-mortem. Cross reference the
header injection times with the results from the log search and you'll have a
rough idea of which scripts were responsible.
Re: Via HTTP??
Posted by "NW7US, Tomas" <nw...@hfradio.org>.
I'll be going through all scripts installed on the server. I've limited
quite a bit, already. PHP is really really bad. But, I've done a heck of
a lot to close things down. I'm sure I missed something, somewhere, in
the scripts. What a pain, running multiple domains for others.
My scripts are really buttoned down, those that I have written myself.
The perl scripts do use the CGI code, latest. And I do my own regex
stuff. I'll double-check my tests. I just don't yet see how the messages
are getting through. If I could figure out what script... I've got to
figure out some way to audit...
On Fri, 10 Mar 2006 17:00:02 -0800, Kenneth Porter <sh...@sewingwitch.com>
wrote:
> On Friday, March 10, 2006 4:17 PM -0800 jdow <jd...@earthlink.net> wrote:
>
>> But also check out the mail scripts you have. I don't have any such so I
>> don't pay attention to specifics. But they have been known to have
>> various
>> vulnerabilities that get addressed over time. If you got the script from
>> somewhere else you might check if there is an update.
>
> PHP is notorious for its poor mail API's and its system() API. It's
> pretty easy to write bad code that can be easily exploited, and a lot of
> exuberant but novice coders have splattered poor security around the
> web. (Web forum software, pre-nms formmail, and Twiki come to mind.) If
> you have any PHP that sends mail, make sure it's been audited by someone
> with enough experience to know what to look for.
--
73 de Tomas, NW7US
: Propagation Editor for CQ, CQ VHF, Popular Communications :
: Contributing Editor for Monitoring Times - on Propagation :
: Creator; live propagation center http://prop.hfradio.org/ :
: Associate Member of Propagation Studies Committee of RSGB :
: 122.93W 47.67N / Brinnon, Washington USA CN87 CW/SSB/DIGI :
: Website/software/database design http://newwebmakers.com/ :
: 10x56526, FISTS 7055, FISTS NW 57, Lighthouse Society 144 :
Re: Via HTTP??
Posted by Kenneth Porter <sh...@sewingwitch.com>.
On Friday, March 10, 2006 4:17 PM -0800 jdow <jd...@earthlink.net> wrote:
> But also check out the mail scripts you have. I don't have any such so I
> don't pay attention to specifics. But they have been known to have various
> vulnerabilities that get addressed over time. If you got the script from
> somewhere else you might check if there is an update.
PHP is notorious for its poor mail API's and its system() API. It's pretty
easy to write bad code that can be easily exploited, and a lot of exuberant
but novice coders have splattered poor security around the web. (Web forum
software, pre-nms formmail, and Twiki come to mind.) If you have any PHP
that sends mail, make sure it's been audited by someone with enough
experience to know what to look for.
Re: Via HTTP??
Posted by jdow <jd...@earthlink.net>.
From: "NW7US, Tomas" <nw...@hfradio.org>
> JDOW:
>
> I run Fedora 2 (RedHat) Linux. I've updated most everything. I've not
> updated to the very latest Apache. Perhaps that's needed.
>
> How would I go about determining if indeed I have a vulnerability such as
> what you are hinting at? I watch logs pretty closely, but cannot farret
> out this one.
As noted already there is an Apache update on Fedora Legacy. I'd get it.
But also check out the mail scripts you have. I don't have any such so I
don't pay attention to specifics. But they have been known to have various
vulnerabilities that get addressed over time. If you got the script from
somewhere else you might check if there is an update.
All that said, what does a NORMAL header coming into your machine look
like? That should tell you a lot about the bad one. If they look very
much the same then your script was used somehow.
(There is a very obvious hack on these scripts for sending spam to the
owner of the machine. But it's probably not worth spammer's exploiting.
But if the prefilled out address in the script can get changed somehow
the tool becomes a generic spam relay.)
{^_^}
Re: Via HTTP??
Posted by Mike Jackson <mj...@barking-dog.net>.
>> And I note that the .67 machine alias "prop.hfradio.org" includes a
>> comments page. That script could be vulnerable if updates to the OS
>> are not fully installed.
>
> I've done quite a bit of buttoning up, here. I'll take a closer look at
> this, too.
Maybe this is obvious, but from experience, make sure that any script input
that gets put into an email header field is rigorously sanitized. I strip
out anything that appears after a newline character, then pass email
addresses (or what should be email addresses) through a validator (a simple
regex is fine, but to be more rigorous you can check the right-hand part for
a matching MX or A record).
Re: Via HTTP??
Posted by "NW7US, Tomas" <nw...@hfradio.org>.
JDOW:
I run Fedora 2 (RedHat) Linux. I've updated most everything. I've not
updated to the very latest Apache. Perhaps that's needed.
How would I go about determining if indeed I have a vulnerability such as
what you are hinting at? I watch logs pretty closely, but cannot farret
out this one.
On Fri, 10 Mar 2006 03:20:33 -0800, jdow <jd...@earthlink.net> wrote:
>>>> version=3.1.0 Received: from [11.54.168.176] by
>>>> mail.swbell.net; Fri, 10 Mar 2006 08:17:42 X-Originating-IP:
>>>> [60.170.26.144] via HTTP from
>>>> webmail.swbell.net; Fri, 10 Mar 2006 08:17:42
>>>> Message-ID: <11...@swbell.net>
> What I am REALLY interested in, Matt, is the DoD network that was hacked
> so that the Received: line could happen. And is that the normal format
> for a mail.swbell.net header? If it is forged then it got into his
> machine directly without his machine logging it in. That COULD mean an
> http vulnerability.
>
> It would appear that helios does have a working http on it with a simple
> pointer to the .67 address. So I might be moved to investigate the server
> at helios for a vulnerability.
What would I look for?
> But at the same time I would review how mail can get into helios
> without ever being logged. That is a "bad thing".
I agree. How, again, do I start "looking" for this?
> And I note that the .67 machine alias "prop.hfradio.org" includes a
> comments page. That script could be vulnerable if updates to the OS
> are not fully installed.
I've done quite a bit of buttoning up, here. I'll take a closer look at
this, too.
73 de Tomas, NW7US
: Propagation Editor for CQ, CQ VHF, Popular Communications :
: Contributing Editor for Monitoring Times - on Propagation :
: Creator; live propagation center http://prop.hfradio.org/ :
: Associate Member of Propagation Studies Committee of RSGB :
: 122.93W 47.67N / Brinnon, Washington USA CN87 CW/SSB/DIGI :
: Website/software/database design http://newwebmakers.com/ :
: 10x56526, FISTS 7055, FISTS NW 57, Lighthouse Society 144 :
Re: Via HTTP??
Posted by jdow <jd...@earthlink.net>.
From: "Matt Kettler" <mk...@comcast.net>
> NW7US, Tomas wrote:
>> Ok, this one is new to me. Can someone guide me as to where my
>> security is broken, if I get these headers on a message?
>>
>>> Return-path: <ab...@swbell.net>
>>> X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on
>>> helios.hfradio.org
>>> X-Spam-Status: No, score=-0.8 required=1.0
>>> tests=BAYES_05,FORGED_RCVD_HELO, TO_CC_NONE autolearn=no
>>> version=3.1.0
>>> Received: from [11.54.168.176] by mail.swbell.net; Fri, 10 Mar
>>> 2006 08:17:42
>>> X-Originating-IP: [60.170.26.144] via HTTP from
>>> webmail.swbell.net; Fri, 10 Mar 2006 08:17:42
>>> Message-ID: <11...@swbell.net>
>>> From: "Aimee Belcher" <ab...@swbell.net>
>>> Subject: Two Super Hot Picks, Get In Early! n23ui
>>> Date: Fri, 10 Mar 2006 00:17:15 -0800
>>> X-IMAPbase: 1135281538 18330
>>> Status: O
>>> X-UID: 18330
>>> Content-Length: 743
>>> X-Antivirus: AVG for E-mail 7.1.375 [268.2.1/277]
>>> MIME-Version: 1.0
>>> Content-Transfer-Encoding: 8bit
>>> Content-Type: text/plain; charset=us-ascii
>>
>> the message has no To: header. If I read this right, my server is not
>> getting this via HTTP, right? The original was entered into the
>> stream via HTTP, but then that server sent it out... relaying it to my
>> server. Or, do I have a security issue via HTTP port??
>
> I think your analysis might be correct.
>
> HOWEVER, there is one thing that concerns me.. Where's the Received:
> header generated by your server?? There doesn't appear to be one!
>
> SA is running on helios.hfradio.org, but the only Received: header shows
> it being delivered to mail.swbell.net. How'd it get from there to helios?
>
> I'd suspect the message headers are corrupted, or the message was
> inserted into your mail system WITHOUT going over SMTP.
What I am REALLY interested in, Matt, is the DoD network that was hacked
so that the Received: line could happen. And is that the normal format
for a mail.swbell.net header? If it is forged then it got into his machine
directly without his machine logging it in. That COULD mean an http
vulnerability.
Now, I notice that:
hfradio.org has address 66.152.65.67
mail.hfradio.org has address 66.152.66.10
www.hfradio.org has address 66.152.65.67
10.66.152.66.in-addr.arpa domain name pointer helios.hfradio.org.
It would appear that helios does have a working http on it with a simple
pointer to the .67 address. So I might be moved to investigate the server
at helios for a vulnerability. But at the same time I would review how
mail can get into helios without ever being logged. That is a "bad thing".
And I note that the .67 machine alias "prop.hfradio.org" includes a comments
page. That script could be vulnerable if updates to the OS are not fully
installed. (That is presuming a ham would be canny enough NOT to run Windows
for this sort of an operation. If he is using Windows then it's entirely up
for grabs.)
{^_^} Joanne, W6MKU
Re: Via HTTP??
Posted by Matt Kettler <mk...@comcast.net>.
NW7US, Tomas wrote:
> Ok, this one is new to me. Can someone guide me as to where my
> security is broken, if I get these headers on a message?
>
>> Return-path: <ab...@swbell.net>
>> X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on
>> helios.hfradio.org
>> X-Spam-Status: No, score=-0.8 required=1.0
>> tests=BAYES_05,FORGED_RCVD_HELO, TO_CC_NONE autolearn=no
>> version=3.1.0
>> Received: from [11.54.168.176] by mail.swbell.net; Fri, 10 Mar
>> 2006 08:17:42
>> X-Originating-IP: [60.170.26.144] via HTTP from
>> webmail.swbell.net; Fri, 10 Mar 2006 08:17:42
>> Message-ID: <11...@swbell.net>
>> From: "Aimee Belcher" <ab...@swbell.net>
>> Subject: Two Super Hot Picks, Get In Early! n23ui
>> Date: Fri, 10 Mar 2006 00:17:15 -0800
>> X-IMAPbase: 1135281538 18330
>> Status: O
>> X-UID: 18330
>> Content-Length: 743
>> X-Antivirus: AVG for E-mail 7.1.375 [268.2.1/277]
>> MIME-Version: 1.0
>> Content-Transfer-Encoding: 8bit
>> Content-Type: text/plain; charset=us-ascii
>
> the message has no To: header. If I read this right, my server is not
> getting this via HTTP, right? The original was entered into the
> stream via HTTP, but then that server sent it out... relaying it to my
> server. Or, do I have a security issue via HTTP port??
I think your analysis might be correct.
HOWEVER, there is one thing that concerns me.. Where's the Received:
header generated by your server?? There doesn't appear to be one!
SA is running on helios.hfradio.org, but the only Received: header shows
it being delivered to mail.swbell.net. How'd it get from there to helios?
I'd suspect the message headers are corrupted, or the message was
inserted into your mail system WITHOUT going over SMTP.
Via HTTP??
Posted by "NW7US, Tomas" <nw...@hfradio.org>.
Ok, this one is new to me. Can someone guide me as to where my security
is broken, if I get these headers on a message?
> Return-path: <ab...@swbell.net>
> X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on
> helios.hfradio.org
> X-Spam-Status: No, score=-0.8 required=1.0
> tests=BAYES_05,FORGED_RCVD_HELO, TO_CC_NONE autolearn=no version=3.1.0
> Received: from [11.54.168.176] by mail.swbell.net; Fri, 10 Mar 2006
> 08:17:42
> X-Originating-IP: [60.170.26.144] via HTTP from webmail.swbell.net;
> Fri, 10 Mar 2006 08:17:42
> Message-ID: <11...@swbell.net>
> From: "Aimee Belcher" <ab...@swbell.net>
> Subject: Two Super Hot Picks, Get In Early! n23ui
> Date: Fri, 10 Mar 2006 00:17:15 -0800
> X-IMAPbase: 1135281538 18330
> Status: O
> X-UID: 18330
> Content-Length: 743
> X-Antivirus: AVG for E-mail 7.1.375 [268.2.1/277]
> MIME-Version: 1.0
> Content-Transfer-Encoding: 8bit
> Content-Type: text/plain; charset=us-ascii
the message has no To: header. If I read this right, my server is not
getting this via HTTP, right? The original was entered into the stream
via HTTP, but then that server sent it out... relaying it to my server.
Or, do I have a security issue via HTTP port??
Thanks,
--
73 de Tomas, NW7US
: Propagation Editor for CQ, CQ VHF, Popular Communications :
: Contributing Editor for Monitoring Times - on Propagation :
: Creator; live propagation center http://prop.hfradio.org/ :
: Associate Member of Propagation Studies Committee of RSGB :
: 122.93W 47.67N / Brinnon, Washington USA CN87 CW/SSB/DIGI :
: Website/software/database design http://newwebmakers.com/ :
: 10x56526, FISTS 7055, FISTS NW 57, Lighthouse Society 144 :
Re: Spammer forums
Posted by Patrick Sneyers <cg...@bulckens.com>.
http://lists.jammed.com/crime/2003/08/0146.html
Seems it has been around for some time.
Patrick
Op 10-mrt-06, om 05:25 heeft Kenneth Porter het volgende geschreven:
> Saw a story on SlashDot today that mentions this spammer forum site:
>
> <http://www.specialham.com/specialham/>
>
> Here's the SlashDot mention:
>
> <http://yro.slashdot.org/comments.pl?sid=179751&cid=14885196>