Re: Account probing for spam relay.

[kweiske () KATAAN ORG (Kurt Weiske)]

> Fromthe user name (Spade Relay Check) it looks like they were using Sam
Spade (http://www.spade.org). As far as I can tell, Sam Spade doesn't allow
for searching a range of addresses, making it an unlikely tool for a spammer
looking for relays.

It looks like your honeypot allowed the mail relay - maybe this person
received UCE/UBE relayed through your honeypot, found the IP address of your
system in the headers, and is investigating?

In the meantime, you might want to turn sendmail off on your system, or at
least confirm that it doesn't allow relay mail to be sent through it.

--k

-----Original Message-----
From: Incidents Mailing List [mailto:INCIDENTS () SECURITYFOCUS COM]On
Behalf Of Lance Spitzner
Sent: Sunday, June 11, 2000 9:58 AM
To: INCIDENTS () SECURITYFOCUS COM
Subject: Account probing for spam relay.

One of my honeypots was probed for spam relay.  I'm
attaching the signature here so you know what to look
for.  Needless to say, I sent our friend a nasty gram.
It is obvious he is using automated software to find
systems that he can use to relay his spam.  I've
changed the domain name of my honeynet to
mail.example.com for sanitization purposes.  However,
the source account launching the probe is valid :)

--- mail relay check ---

220 mail.example.com. Sendmail SMI-8.6/SMI-SVR4 ready at Sun, 11 Jun 2000
11:27:42 -0500
HELO MAIL.EXAMPLE.COM
250 mail.example.com. Hello [211.54.114.180], pleased to meet you
MAIL FROM:<woqjffirst_at_yahoo.com () MAIL EXAMPLE COM>
250 <woqjffirst_at_yahoo.com () MAIL EXAMPLE COM>... Sender ok
RCPT TO:<woqjffirst () yahoo com>
250 <woqjffirst () yahoo com>... Recipient ok
DATA
354 Enter mail, end with "." on a line by itself
qjffirst () yahoo com
From: woqjffirst () yahoo com (Spade relay check)
Subject: MAIL.EXAMPLE.COM relay check

.
250 LAA14291 Message accepted for delivery
QUIT
221 mail.example.com. closing connection

--- end probe ---

Lance Spitzner
http://www.enteract.com/~lspitz/papers.html