Quote:
|
Originally Posted by outletseason
Hi,
Today i had another nasty experience i was cheking my own mail from my own domain and I got a mail from 'admin' telling me my email account is expiring, really weird because I control the email accounts, this is the first time it happens to me so I decided to change the password immediately. But i really want to know what kind of technique they used in order to do that, since i don't control the mail server rules, my host provider does, I don't know where the security flaw might be and how to prevent this in the future.
|
Well, that's a virus there.
The MiMail virus
http://vil.nai.com/vil/content/v_100523.htm spoofs an admin@ e-mail address. Your server has not been compromised... there's no security flaw... don't panic. :-)
I've gotten e-mails claiming to be from every admin@ from every site I deal with, and it's all bunk.
Learn how to read mail headers... it's pretty simple, and it goes a long way to helping determine where stuff originates.
For instance, the new MyDoom virus that's sweeping the nation, starts out by casually appearing from one site, when it's really from another. The headers show this rather quickly...
Return-Path: <maria@www.bogusdomain.xxx>
Delivered-To:
my@address.bogus
Received: from
www.bogusdomain.xxx (297-977-159-186.in-addr.anotherbogusone.com [297.977.159.186])
So, my mailer shows the mail is from "maria@www.bogusdomain.xxx" but by looking at the headers, I can see the virus attempted to spoof the domain:
"Received: from www.bogusdomain.xxx"
but the server picked up the real IP address of the server it was sent from: "(297-977-159-186.in-addr.anotherbogusone.com [297.977.159.186])" so I could (in theory) send a note to the admin of anotherbogusone.com and tell him one of his users has the virus... but then we admins would all be swimmming in that kind of mail. :)
There is very little hacking going on, and lots and lots of viruses and worms that forge an e-mail address rather easily.
Also, don't assume that a spammer is sending out millions of e-mails with your domain name; it may just be targeted towards you since your filters are more likely to let something thru from someone at the same domain as you than not.