Solved

exchange 2003, user spoof, sending spam using one of our users

Posted on 2013-06-11
10
396 Views
Last Modified: 2013-06-16
I have a mail server, in Queue, there's multiple outgoing mails are stuck on sending from a specific user. But the user's outlook doesn't show she sent mails out. The outgoing emails are also seem to be spam going to external random addresses. I think changing/correcting settings at SMTP virtual server of the mail server can resolve this problem. Can you advise?

Relay under SMTP virtual server/properties/Access/Relay is restricted to our LAN IPs of a few servers.

Under SMTP virtual server/properties/Access/Authentication, both Anonymous access and Integrated Windows Authentication are checked.

Unser SMTP virtual server/properties/Delivery/Outbound Security, Anonymous access is checked.

Windows 2003 SP2
Exhcnage 2003 SP2
0
Comment
Question by:crcsupport
  • 5
  • 3
  • 2
10 Comments
 
LVL 52

Assisted Solution

by:Manpreet SIngh Khatra
Manpreet SIngh Khatra earned 250 total points
ID: 39238465
If you say your domain\connector isnt set to Open relay then yes it could be user so use Exmon and try to find the user and then clean his machine and disconnect his mailbox if you find it causing some issues as well

http://www.microsoft.com/en-us/download/details.aspx?id=11461

- Rancy
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238534
I was looking at SMTP virtual server.
Yes, I have a connector set up at Routing groups/First Routing Group/Connectors/Connector. It shows, Connector/properties/Delivery Restriction shows 'By default, messages from everyone are Accepted'.

Is there a way to restrict to accept messages only from LAN IPs? We have a dummy email (no mailbox) addresss 'do-not-reply@mydomain.com' to send out some emails to clients. If I restrict by user account, I think the email won't work.

Also, is it possible any outside pc can telnet to the server and send out email using our mail server with 'from' as one of our user's email address even though relay is off?

I scanned the trouble user's pc, didn't find any problem.
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238542
I will test using exmon
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 76

Assisted Solution

by:Alan Hardisty
Alan Hardisty earned 250 total points
ID: 39238559
If anyone knows a useraccount and password, they will always be able to relay via your server if you have relaying enabled.

Hackers always enjoy cracking an Exchange 2003 server account and then abuse the hell out of it until you realise, stop the problem and prevent it from happening again.

Can you see the subject of the emails that are not going anywhere?  Are they spam-like?

Alan
0
 
LVL 52

Assisted Solution

by:Manpreet SIngh Khatra
Manpreet SIngh Khatra earned 250 total points
ID: 39238566
Also, is it possible any outside pc can telnet to the server and send out email using our mail server with 'from' as one of our user's email address even though relay is off? - If your server is allowed for Open relay compared to restricted IP's to be allowed for relay

Why dont you stop the SMTP service if possible and let emails pile and check their content or source and work with Sender\Recipient filtering options in Exchange

- Rancy
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238681
Yes, it's spam, subject shows all medicine stuffs... I changed the password of her and see what happens.

I have relay setting as shown in the attached image on my SMTP virtual server.
Basically it has 5 LAN IPs are allowed to relay, there's websites in dev and production to do relay to the mail server to send. But the 5 computers are all clean with virus. But I noticed that in the users tab, the Domain Users are allowed to relay. I can restrict this to certain users only, correct?
So in my case, relay is on...

Besides relay, what else can make possible for outside email client can send emails using our mail server pretending the troubled user account without knowing password?
relay.jpg
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238712
I changed her password, but it keeps sending mails out from her  account. So I think someone outside connecting to my mail server and send out emails without logging in with her account
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 250 total points
ID: 39238726
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238971
It looks like the account was hacked. I just checked again the queue, I don't see emails going out with her account.
Alanharddisty, thanks for the article. I need to set account lockout policy so that hacker can't run brute-force against our exchange server.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39239002
Yes - always a good plan, plus setting strong passwords and forcing regular changes is also a good way to minimise hacked accounts.

Alan
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Exchange 2010 Creating an alias & testing it 2 33
EXCHANGE 8 24
Group Policy - Setting deafult Home Page 3 19
EXCHANGE, OUTLOOK, CALENDAR 12 19
A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question