Exchange Server Being Used to Spam

[coop1984]

For the past couple of days our Exchange server has been used to spam people. When I look through the Message tracking centre I see messages from [email protected] thousands of times. I have checked different knowledge bases and our server isnt an open relay from what I Can gather. Does anybody have any ideas of how to stop this?

 

Thanks.

[srochford]

Are the people being spammed external to you and the sender IP also external to you? If so, then you do have an open relay - let me know the address of your server and I'll check if you like.

 

If the sender IP address is internal then it could still be an open relay (but you may be deliberately allowing internal email to relay) - you need to check the IP the message is coming from internally and fix the machine/kill the owner :-)

 

In Exchange, check the properties of the "SMTP virtual server" and make sure relaying is not allowed.

[Jona]

I think the first thing you need to do is stop this happening, take the server offline if you have to.....

 

Then you need to look at your security and tighten it up so you have to be authenticed and/or from an internal address to send messages.

 

If your sure your not running an open relay someone may have a user password?

 

It may be your server it's self or an internal client has been compromised, don't under estimate the potential seriousness of this.

 

Cheers

Jona

Edited June 27, 2008 by Jona

[maniac]

I wonder if it's the same trick someone was using on our exchange server. What they were doing is sending messages to accounts on our system that doesn't exist, so it then bounces the message from our exchange server. The trick is the message has modified headers, so the message bounces to a different address from which is was sent, with the origenal message attached, so they are effectively using your server to spam people by exploiting the default 'not delivered' policy in exchange. There is a way of changing this so it doesn't attach the origenal messgae, just merely sends a cannot be delivered message, which makes it useless for the spammers, so they'll move onto someone else.

 

There is a good guide on exchange servers and spam problems here Exchange - NDR and Open Relay Spam Clean Up | Amset.info

 

Mike.