Re: Exchange/Microsoft SMTP Authenticated User spam?

[Harlan Carvey <keydet89 () yahoo com>]

> We've had two calls in the past month regarding
> supposed authenticated users sending out spam and
> using their external mail 
> servers as relays. I was just curious if anyone else
> has seen this type of activity.

Similar activity was reported over on the
incidents.org list.  Sadly, the "incident response"
seemed to be performing a Google search, rather than
going to the boxes themselves and looking.  In the
case where someone did look at the boxes, his IR
activities consisted of checking netstat, Task
Manager, and then heaping on a considerable amount of
speculation.  

> Has anyone seen any scripts that 
> do this type of attack? Or has anyone else had this
> happen to them or someone they know? We would like
> to give our client a bit 
> more information then 'change all your passwords.'

Changing passwords may not work.  Someone needs to go
to the boxes in question and perform some incident response.

---------------------------------------------------------------------------
----------------------------------------------------------------------------