Re: Spammer got into my Webmail

[Ben Spencer <ben.spencer () MOODY EDU>]

Probably no help with this specific case or cleaning up, but, you might find
it useful to join the HIED-EMAILADMIN list (
<http://listserv.nd.edu/archives/hied-emailadmin.html>
http://listserv.nd.edu/archives/hied-emailadmin.html). That might also lead
you to  <http://code.google.com/p/anti-phishing-email-reply/>
http://code.google.com/p/anti-phishing-email-reply/ and
<http://groups.google.com/group/anti-phishing-email-reply-discuss>
http://groups.google.com/group/anti-phishing-email-reply-discuss list which
discuss these things and publish reply-to addresses which can be blocked
(once they are known) which all might be helpful with email matters (and
protecting yourself from future such issues).



Benji Spencer

System Administrator



Moody Bible Institute

Phone: 312-329-2288

Fax: 312-329-8961



From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Robin Polak
Sent: Tuesday, September 09, 2008 9:04 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Spammer got into my Webmail



Hello,

   One of my webmail users was fooled into revealing his credentials to a
spammer and now I am dealing with the backlash of all this spam having left
our smtp servers as well as much mail still left in the outbound sendmail
queues.  Is there any advice that any of you could provide me as far as
filtering out the spam from my sendmail queues as well as any procedures I
could follow to counteract the effects of blacklisting such as a generally
checked whitelist?  In addition, as a result of this incident I have found a
flaw in the tracking of mail between our webmail (Horde/IMP), Cyrus IMAP,
and Sendmail.  What sort of suggestion could be made as far as effectively
being able to correlate my logs?  Is there a way to put a header into a
message leaving IMP indicating the user-name that was used to login to
Horde?  This would have been quite usefull since in some way the spammer was
able to spoof the From address in the message to be a yahoo.com  address.

--
Robin Polak, Network Manager
College of Mount Saint Vincent
E-Mail: robin.polak () gmail com
V. 718-405-3293

Attachment: smime.p7s
Description: