Re: Compromise Email Accounts

[Steven Tardy <sjt5 () ITS MSSTATE EDU>]

Jeremy Mooney wrote:
> Steven Tardy wrote on 2/3/09 14:10 :
> > i had a "lightbulb" moment a few months ago.
> >
> > most of the compromised logins are from ip's contained in the spamhaus sbl list.
> > 1) check every login against the spamhaus sbl list.
>
> I'm curious if there was any fallout from traveling users, especially
> those in other countries. We've had many legitimate logins from users
> traveling in specific areas of the world come from the same IP
> blocks/ISPs used to access compromised accounts.  I haven't specifically
> looked for sbl listings, but when analyzing some compromises had
> problems expanding the search scope (IIRC even to the /24 level) to find
> possibly related activity (too much noise from legitimate traffic). I'm
> concerned that this approach may either be ineffective or have many
> false positives.

we've had 0 false positives using this method.
the spamhaus sbl is the "spammer" list.
the spamhaus pbl is the "policy" list(which includes dial-up/dynamic pools).
the spamhaus sbl does NOT include the spamhaus pbl.

i mentioned this for others to detect compromises sooner, at login, before spam are sent.
if all you do is warn based on this, it's a step in the right direction.
knowing is half the battle. (:

> > 2) reject email's with "X-Originating-IP" in the spamhaus sbl list.
>
> Do you mean this header as inserted by your local webmail system or your
> edge system, or are you filtering incoming SMTP messages based on where
> it originated before the sending SMTP server?

both.
this was an unforeseen yet beneficial side effect.
currently we only do this outbound, but are investigating inbound as well.
if you're not going to accept email sent from a spamhaus sbl ip,
why accept email with an X-Originating-IP from a spamhaus sbl ip?

i mistyped, we don't reject, we quarantine.
that way if someone contacts us about emails that didn't go through, the emails can be
identified and processed at a later date.

--
steven tardy
network services
mississippi state university