Hi all,

I've been investigating this week how one of my customers was used as a spam
relay host - even though they are not an open relay host. It's a detailed
issue and according to a number of other sources is a new method the
spammers are using to "sell their products". I've written up an article
(rather than post something too long here) and posted it on www.sbsfaq.com
if your interested.

I'd be interested to hear feedback on the people who have seen this attack.

Regards,
Wayne Small [SBS-MVP]
MCSE+I MCSE 2000
Technical Director - Correct Solutions Pty Ltd
For all the answers on Small Business Server 2000 - check out www.sbsfaq.com

Re: IMPORTANT: New method for spammers to relay through you by Susan

Susan
Sat Jul 19 03:07:09 CDT 2003

http://www.sbsfaq.com/news/getArticle.asp?MessageID=000000001A447390AA6611CD9BC800AA002FC45A0900E049B559A334DD479C5D360FB473600B0000000187180000F401C41B681A9640A459B27C5FF7E6840000B1E572030000&path=News/

IMHO it's must read....

"Wayne Small [SBS MVP]" wrote:

> Hi all,
>
> I've been investigating this week how one of my customers was used as a spam
> relay host - even though they are not an open relay host. It's a detailed
> issue and according to a number of other sources is a new method the
> spammers are using to "sell their products". I've written up an article
> (rather than post something too long here) and posted it on www.sbsfaq.com
> if your interested.
>
> I'd be interested to hear feedback on the people who have seen this attack.
>
> Regards,
> Wayne Small [SBS-MVP]
> MCSE+I MCSE 2000
> Technical Director - Correct Solutions Pty Ltd
> For all the answers on Small Business Server 2000 - check out www.sbsfaq.com

--
"Don't lose sight of security. Security is a state of being, not a
state of budget. He with the most firewalls still does not win.
Put down that honeypot and keep up to date on your patches. Demand
better security from vendors and hold them responsible. Use what
you have, and make sure you know how to use it properly and effectively."
~ Rain Forest Puppy

http://www.wiretrip.net/rfp/txt/evolution.txt



Re: IMPORTANT: New method for spammers to relay through you by Kevin

Kevin
Sat Jul 19 07:23:39 CDT 2003

Great write up, Wayne!
-kw

"Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
news:u6q2htcTDHA.2280@TK2MSFTNGP12.phx.gbl...
> Hi all,
>
> I've been investigating this week how one of my customers was used as a
spam
> relay host - even though they are not an open relay host. It's a detailed
> issue and according to a number of other sources is a new method the
> spammers are using to "sell their products". I've written up an article
> (rather than post something too long here) and posted it on www.sbsfaq.com
> if your interested.
>
> I'd be interested to hear feedback on the people who have seen this
attack.
>
> Regards,
> Wayne Small [SBS-MVP]
> MCSE+I MCSE 2000
> Technical Director - Correct Solutions Pty Ltd
> For all the answers on Small Business Server 2000 - check out
www.sbsfaq.com
>
>



Re: IMPORTANT: New method for spammers to relay through you by Rick

Rick
Sat Jul 19 09:09:47 CDT 2003

So do you recommend to UNCHECK; Allow all computers which successfully
authenticate to relay, regardless of the list above.? And of course, to use
strong passwords.
Or is there a setting somewhere else to do?

Rick in the Midwest

"Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
news:u6q2htcTDHA.2280@TK2MSFTNGP12.phx.gbl...
> Hi all,
>
> I've been investigating this week how one of my customers was used as a
spam
> relay host - even though they are not an open relay host. It's a detailed
> issue and according to a number of other sources is a new method the
> spammers are using to "sell their products". I've written up an article
> (rather than post something too long here) and posted it on www.sbsfaq.com
> if your interested.
>
> I'd be interested to hear feedback on the people who have seen this
attack.
>
> Regards,
> Wayne Small [SBS-MVP]
> MCSE+I MCSE 2000
> Technical Director - Correct Solutions Pty Ltd
> For all the answers on Small Business Server 2000 - check out
www.sbsfaq.com
>
>



Re: IMPORTANT: New method for spammers to relay through you by Javier

Javier
Sat Jul 19 09:11:52 CDT 2003

Very interesting article...

BTW, is there a KB article on how to "disable the SMTP Server services'
ability to relay for anyone other than the internal IP subnet and external
network card regardless of authentication"??? Or anyone care to give the
steps/instructions?

Thanks,

Javier

"Kevin Weilbacher" <kweilbac@gte.net> wrote in message
news:OxKxWCfTDHA.2512@TK2MSFTNGP10.phx.gbl...
> Great write up, Wayne!
> -kw
>
> "Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
> news:u6q2htcTDHA.2280@TK2MSFTNGP12.phx.gbl...
> > Hi all,
> >
> > I've been investigating this week how one of my customers was used as a
> spam
> > relay host - even though they are not an open relay host. It's a
detailed
> > issue and according to a number of other sources is a new method the
> > spammers are using to "sell their products". I've written up an article
> > (rather than post something too long here) and posted it on
www.sbsfaq.com
> > if your interested.
> >
> > I'd be interested to hear feedback on the people who have seen this
> attack.
> >
> > Regards,
> > Wayne Small [SBS-MVP]
> > MCSE+I MCSE 2000
> > Technical Director - Correct Solutions Pty Ltd
> > For all the answers on Small Business Server 2000 - check out
> www.sbsfaq.com
> >
> >
>
>



Re: IMPORTANT: New method for spammers to relay through you by Mark

Mark
Sat Jul 19 21:28:01 CDT 2003

Even more reason why sub 50 user networks should have their email
professionally hosted and POP out for their mail. Sorry, but I've been
enterprise and SMB does NOT have the budget to do in-house correctly.

--
Sincerely,
Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
www.MCSE2000.com
www.AppLauncher.com



"Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
news:u6q2htcTDHA.2280@TK2MSFTNGP12.phx.gbl...
> Hi all,
>
> I've been investigating this week how one of my customers was used as a
spam
> relay host - even though they are not an open relay host. It's a detailed
> issue and according to a number of other sources is a new method the
> spammers are using to "sell their products". I've written up an article
> (rather than post something too long here) and posted it on www.sbsfaq.com
> if your interested.
>
> I'd be interested to hear feedback on the people who have seen this
attack.
>
> Regards,
> Wayne Small [SBS-MVP]
> MCSE+I MCSE 2000
> Technical Director - Correct Solutions Pty Ltd
> For all the answers on Small Business Server 2000 - check out
www.sbsfaq.com
>
>



Re: IMPORTANT: New method for spammers to relay through you by Susan

Susan
Sat Jul 19 21:34:19 CDT 2003

And a large external ISP also got caught doing this. We're all in the same
boat. Sorry... I've seen POP connector fall over too many times with junk and
malformed emails.

Mark Mancini wrote:

> Even more reason why sub 50 user networks should have their email
> professionally hosted and POP out for their mail. Sorry, but I've been
> enterprise and SMB does NOT have the budget to do in-house correctly.
>
> --
> Sincerely,
> Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
> www.MCSE2000.com
> www.AppLauncher.com
>
> "Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
> news:u6q2htcTDHA.2280@TK2MSFTNGP12.phx.gbl...
> > Hi all,
> >
> > I've been investigating this week how one of my customers was used as a
> spam
> > relay host - even though they are not an open relay host. It's a detailed
> > issue and according to a number of other sources is a new method the
> > spammers are using to "sell their products". I've written up an article
> > (rather than post something too long here) and posted it on www.sbsfaq.com
> > if your interested.
> >
> > I'd be interested to hear feedback on the people who have seen this
> attack.
> >
> > Regards,
> > Wayne Small [SBS-MVP]
> > MCSE+I MCSE 2000
> > Technical Director - Correct Solutions Pty Ltd
> > For all the answers on Small Business Server 2000 - check out
> www.sbsfaq.com
> >
> >

--
"Don't lose sight of security. Security is a state of being, not a
state of budget. He with the most firewalls still does not win.
Put down that honeypot and keep up to date on your patches. Demand
better security from vendors and hold them responsible. Use what
you have, and make sure you know how to use it properly and effectively."
~ Rain Forest Puppy

http://www.wiretrip.net/rfp/txt/evolution.txt



Re: IMPORTANT: New method for spammers to relay through you by Javier

Javier
Sat Jul 19 23:18:17 CDT 2003

Mark,

Could you explain to me your reasoning? For this particular issue?

As I see it... even if you outsource your e-mail you can still be caught on
this. If you allow to relay mail tru your server... it won't matter that you
were using POP3 or SMTP to receive mail. Or I'm wrong?

-Javier

"Susan Bradley, CPA aka Ebitz SBS Rocks [MVP]" <sbradcpa@pacbell.net> wrote
in message news:3F19FFAB.8E452467@pacbell.net...
> And a large external ISP also got caught doing this. We're all in the
same
> boat. Sorry... I've seen POP connector fall over too many times with junk
and
> malformed emails.
>
> Mark Mancini wrote:
>
> > Even more reason why sub 50 user networks should have their email
> > professionally hosted and POP out for their mail. Sorry, but I've been
> > enterprise and SMB does NOT have the budget to do in-house correctly.
> >
> > --
> > Sincerely,
> > Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
> > www.MCSE2000.com
> > www.AppLauncher.com
> >
> > "Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
> > news:u6q2htcTDHA.2280@TK2MSFTNGP12.phx.gbl...
> > > Hi all,
> > >
> > > I've been investigating this week how one of my customers was used as
a
> > spam
> > > relay host - even though they are not an open relay host. It's a
detailed
> > > issue and according to a number of other sources is a new method the
> > > spammers are using to "sell their products". I've written up an
article
> > > (rather than post something too long here) and posted it on
www.sbsfaq.com
> > > if your interested.
> > >
> > > I'd be interested to hear feedback on the people who have seen this
> > attack.
> > >
> > > Regards,
> > > Wayne Small [SBS-MVP]
> > > MCSE+I MCSE 2000
> > > Technical Director - Correct Solutions Pty Ltd
> > > For all the answers on Small Business Server 2000 - check out
> > www.sbsfaq.com
> > >
> > >
>
> --
> "Don't lose sight of security. Security is a state of being, not a
> state of budget. He with the most firewalls still does not win.
> Put down that honeypot and keep up to date on your patches. Demand
> better security from vendors and hold them responsible. Use what
> you have, and make sure you know how to use it properly and effectively."
> ~ Rain Forest Puppy
>
> http://www.wiretrip.net/rfp/txt/evolution.txt
>
>



Re: IMPORTANT: New method for spammers to relay through you by James

James
Sun Jul 20 07:42:38 CDT 2003


"Javier Gomez" <javier_gomez@remove-this-bit.engineer.com> wrote in message
news:eJum0XnTDHA.2324@TK2MSFTNGP12.phx.gbl...
> Mark,
>
> Could you explain to me your reasoning? For this particular issue?
>
> As I see it... even if you outsource your e-mail you can still be caught
on
> this.

Not if you collect it via POP3. For those people who might not be 100% how
to configure Exchange not to relay, it's probably safer to keep tcp port 25
closed *inbound* and then they just pop3 the mail from their ISP.

> If you allow to relay mail tru your server... it won't matter that you
> were using POP3 or SMTP to receive mail. Or I'm wrong?

pop3 download is trigged by an initial *outbound* connection (from SBS
random high-numbered port to remote ISP mailserver port 110), so there is
never an inbound open port, so there's nothing to attack on an SBS which
only collects mail using the pop3 connector.

James



Re: IMPORTANT: New method for spammers to relay through you by Mark

Mark
Sun Jul 20 07:46:50 CDT 2003

Javier,
That is my point....you DON'T allow relay or open ports 25&110. If you
have a pro host getting your mail and all your ports are closed but you use
Popbeamer to pull your mail from the host every 5 minutes then you have the
security of not opening Exchange to the world, more reliability, and the
burden of upkeep on them. Many large companies (enterprise) use Unix smart
hosts in front of their firewall and then forward them to their Excahnge
boxes securely. Companies (smaller ones) that do business with Asia often
purchase something like an esoft appliance that does the same thing for
under $1000 and is a Linux based appliance. My clients use my pro hosting
services which is a CPanel box located in a well known datacenter. Since
I've done this I have NEVER had a lost email, Exchange security concern, or
worry. The client gets great web stats and the ability to control their own
DNS zone so we usually use remote.domain.com to their static IP for TS as
well as a safe haven for FTP if needed. With other scripts like Fantastico
they get shopping carts, forums, web calendars, etc...
People here fight me instead of giving it a shot with a couple clients
and see for themselves. Some others here also do this but aren't as adamant
as I am. I think all consultants should maintain and resell hosting space
with a CPanel server and have clients POP for their mail than to try and be
the only mailserver in a manner that SBS is really not suited for if you
want high reliability/availability. Some people use secondary MX records to
their ISP for when their server is down and this isn't a bad idea BUT since
you need to get web hosting anyway, why not outsource the mail too?
My clients are accountants, lawyers, doctors and other professionals
that just cannot be down. 1 Exchange box on a DSL or T1 line has too much
room for error and if you ask others that do this practice you will see that
their admin time on servers is a LOT lower than others. My 2 cents but hey
I've only bee doing this 20 years.

--
Sincerely,
Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
www.MCSE2000.com
www.AppLauncher.com



"Javier Gomez" <javier_gomez@remove-this-bit.engineer.com> wrote in message
news:eJum0XnTDHA.2324@TK2MSFTNGP12.phx.gbl...
> Mark,
>
> Could you explain to me your reasoning? For this particular issue?
>
> As I see it... even if you outsource your e-mail you can still be caught
on
> this. If you allow to relay mail tru your server... it won't matter that
you
> were using POP3 or SMTP to receive mail. Or I'm wrong?
>
> -Javier
>
> "Susan Bradley, CPA aka Ebitz SBS Rocks [MVP]" <sbradcpa@pacbell.net>
wrote
> in message news:3F19FFAB.8E452467@pacbell.net...
> > And a large external ISP also got caught doing this. We're all in the
> same
> > boat. Sorry... I've seen POP connector fall over too many times with
junk
> and
> > malformed emails.
> >
> > Mark Mancini wrote:
> >
> > > Even more reason why sub 50 user networks should have their email
> > > professionally hosted and POP out for their mail. Sorry, but I've
been
> > > enterprise and SMB does NOT have the budget to do in-house correctly.
> > >
> > > --
> > > Sincerely,
> > > Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
> > > www.MCSE2000.com
> > > www.AppLauncher.com
> > >
> > > "Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
> > > news:u6q2htcTDHA.2280@TK2MSFTNGP12.phx.gbl...
> > > > Hi all,
> > > >
> > > > I've been investigating this week how one of my customers was used
as
> a
> > > spam
> > > > relay host - even though they are not an open relay host. It's a
> detailed
> > > > issue and according to a number of other sources is a new method the
> > > > spammers are using to "sell their products". I've written up an
> article
> > > > (rather than post something too long here) and posted it on
> www.sbsfaq.com
> > > > if your interested.
> > > >
> > > > I'd be interested to hear feedback on the people who have seen this
> > > attack.
> > > >
> > > > Regards,
> > > > Wayne Small [SBS-MVP]
> > > > MCSE+I MCSE 2000
> > > > Technical Director - Correct Solutions Pty Ltd
> > > > For all the answers on Small Business Server 2000 - check out
> > > www.sbsfaq.com
> > > >
> > > >
> >
> > --
> > "Don't lose sight of security. Security is a state of being, not a
> > state of budget. He with the most firewalls still does not win.
> > Put down that honeypot and keep up to date on your patches. Demand
> > better security from vendors and hold them responsible. Use what
> > you have, and make sure you know how to use it properly and
effectively."
> > ~ Rain Forest Puppy
> >
> > http://www.wiretrip.net/rfp/txt/evolution.txt
> >
> >
>
>



Re: IMPORTANT: New method for spammers to relay through you by Dave

Dave
Sun Jul 20 15:17:47 CDT 2003

Wayne,

Thanks for the very informative article.

Looks like the sp*mmers are now willing to cross the line and break the law
to send out spam by trying and hack into a system to send sp*m. There may
finally be a way to nail these suckers good and hard. Especially for those
in the US where law enforcement agencies take these types of occurences
seriously.

If I tried to contact the Victoria Police or Australia Federal Police about
a hacking attempt, I just can't envision a very enthusiastic response from
them.

Dave Benet
Melbourne, Australia

"Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
news:u6q2htcTDHA.2280@TK2MSFTNGP12.phx.gbl...
> Hi all,
>
> I've been investigating this week how one of my customers was used as a
spam
> relay host - even though they are not an open relay host. It's a detailed
> issue and according to a number of other sources is a new method the
> spammers are using to "sell their products". I've written up an article
> (rather than post something too long here) and posted it on www.sbsfaq.com
> if your interested.
>
> I'd be interested to hear feedback on the people who have seen this
attack.
>
> Regards,
> Wayne Small [SBS-MVP]
> MCSE+I MCSE 2000
> Technical Director - Correct Solutions Pty Ltd
> For all the answers on Small Business Server 2000 - check out
www.sbsfaq.com
>
>



Re: IMPORTANT: New method for spammers to relay through you by Mark

Mark
Sun Jul 20 19:31:08 CDT 2003

no problem....25 and 110 are closed. Now, the server can initiate a request
out to retrieve mail but port 25 is closed. The only port I open is 3389.

--
Sincerely,
Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
www.MCSE2000.com
www.AppLauncher.com



"Javier Gomez" <javier_gomez@remove-this-bit.engineer.com> wrote in message
news:%23IOIXosTDHA.2308@TK2MSFTNGP12.phx.gbl...
> > People here fight me instead of giving it a shot with a couple
clients
> > and see for themselves. Some others here also do this but aren't as
> adamant
>
> Just to be clear... I wasn't fighting you. As an engineer, I like to
discuss
> things to see the reasoning behind them... as I'm sure you would also. I
> think your post (and James') were very informative and I would take that
> into consideration in the future. My point of confusion here was the issue
> that you could close port 25 inbound and I didn't see it that way (maybe
it
> was too late at night ;-) ).
>
> Thanks,
>
> Javier
>
>



Re: IMPORTANT: New method for spammers to relay through you by Karakas,

Karakas,
Mon Jul 21 00:31:09 CDT 2003

Can I mention our article here as well?

http://www.vamsoft.com/orf/authattack.asp

Gyula

"Susan Bradley, CPA aka Ebitz SBS Rocks [MVP]" <sbradcpa@pacbell.net> wrote
>
http://www.sbsfaq.com/news/getArticle.asp?MessageID=000000001A447390AA6611CD9BC800AA002FC45A0900E049B559A334DD479C5D360FB473600B0000000187180000F401C41B681A9640A459B27C5FF7E6840000B1E572030000&path=News/
>
> IMHO it's must read....
>
> > I've been investigating this week how one of my customers was used as a
spam
> > relay host - even though they are not an open relay host. It's a
detailed
> > issue and according to a number of other sources is a new method the



Re: IMPORTANT: New method for spammers to relay through you by Steve

Steve
Mon Jul 21 08:24:38 CDT 2003

Mark Mancini wrote:

> no problem....25 and 110 are closed. Now, the server can initiate a
> request out to retrieve mail but port 25 is closed. The only port I
> open is 3389.

Which some might opine (including me) is probably more dangerous. There
*are* known exploits against TS, yet there aren't any against SMTP
(AFAIK anyway).

--
Steve Foster [SBS MVP]
---------------------------------------
MVPs do not work for Microsoft. Please reply only to the newsgroups.

Re: IMPORTANT: New method for spammers to relay through you by Derek

Derek
Mon Jul 21 17:36:15 CDT 2003

What are the known exploits on TS?

Also how do i get failed logons to be audited? When I go into group policy
and enable the effective policy is not active. How many places do i have to
enable it in?
"Steve Foster [SBS MVP]" <steve.foster@picamar.co.uk> wrote in message
news:Oh6Vwt4TDHA.2252@TK2MSFTNGP12.phx.gbl...
> Mark Mancini wrote:
>
> > no problem....25 and 110 are closed. Now, the server can initiate a
> > request out to retrieve mail but port 25 is closed. The only port I
> > open is 3389.
>
> Which some might opine (including me) is probably more dangerous. There
> *are* known exploits against TS, yet there aren't any against SMTP
> (AFAIK anyway).
>
> --
> Steve Foster [SBS MVP]
> ---------------------------------------
> MVPs do not work for Microsoft. Please reply only to the newsgroups.



Re: IMPORTANT: New method for spammers to relay through you by Mark

Mark
Mon Jul 21 18:18:14 CDT 2003

Steve, in the 9 years since TS there haven't been any issues! How many have
their been with EVERY OTHER component? Get with it TS is safer than you
give credit to. There are smtp loopholes.

--
Sincerely,
Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
www.MCSE2000.com
www.AppLauncher.com



"Steve Foster [SBS MVP]" <steve.foster@picamar.co.uk> wrote in message
news:Oh6Vwt4TDHA.2252@TK2MSFTNGP12.phx.gbl...
> Mark Mancini wrote:
>
> > no problem....25 and 110 are closed. Now, the server can initiate a
> > request out to retrieve mail but port 25 is closed. The only port I
> > open is 3389.
>
> Which some might opine (including me) is probably more dangerous. There
> *are* known exploits against TS, yet there aren't any against SMTP
> (AFAIK anyway).
>
> --
> Steve Foster [SBS MVP]
> ---------------------------------------
> MVPs do not work for Microsoft. Please reply only to the newsgroups.



Re: IMPORTANT: New method for spammers to relay through you by Derek

Derek
Mon Jul 21 18:28:44 CDT 2003

Thanks Mark,

I have been using TS for about two years now and think it is one of MSofts
best kept secrets - it just works! I use it for connecting to the Office
over the internet and we use it company wide for everything. One program in
particular which we used to get data corruption on a weekly basis no longer
corrupts data since going to TS. We use the 128bit encryption.
"Mark Mancini" <info@NOSPAMmcse2000.com> wrote in message
news:uHOtL69TDHA.2188@TK2MSFTNGP11.phx.gbl...
> Derek,
> Don't listen to Steve about TS, I've been involved with TS for several
> years and there are none as long as you use 128bit encryption, good
> passwords and a lockout policy which are all standard. People not into TS
> have no clue just how secure it it. Post your question again to TS NGs
and
> get an accurate answer.
>
> --
> Sincerely,
> Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
> www.MCSE2000.com
> www.AppLauncher.com
>
>
>
> "Derek Daly" <derek.daly@btopenworld.com> wrote in message
> news:eaza8h9TDHA.2180@TK2MSFTNGP12.phx.gbl...
> > What are the known exploits on TS?
> >
> > Also how do i get failed logons to be audited? When I go into group
policy
> > and enable the effective policy is not active. How many places do i have
> to
> > enable it in?
> > "Steve Foster [SBS MVP]" <steve.foster@picamar.co.uk> wrote in message
> > news:Oh6Vwt4TDHA.2252@TK2MSFTNGP12.phx.gbl...
> > > Mark Mancini wrote:
> > >
> > > > no problem....25 and 110 are closed. Now, the server can initiate a
> > > > request out to retrieve mail but port 25 is closed. The only port I
> > > > open is 3389.
> > >
> > > Which some might opine (including me) is probably more dangerous.
There
> > > *are* known exploits against TS, yet there aren't any against SMTP
> > > (AFAIK anyway).
> > >
> > > --
> > > Steve Foster [SBS MVP]
> > > ---------------------------------------
> > > MVPs do not work for Microsoft. Please reply only to the newsgroups.
> >
> >
>
>



Re: IMPORTANT: New method for spammers to relay through you by Wayne

Wayne
Tue Jul 22 03:33:52 CDT 2003

Mark,

So you've not heard about tsgrinder then... tsgrinder is a DLL that attacks
ANY secured terminal server.
The point is that any hole may be an issue - and if your not a hacker
yourself then you can't say your safe. I don't presume for a minute that
despite all my good attempts that I am 100% safe. There is always that
thing that you don't know or the exploit not yet published widely that may
trip you up.

--
Regards,
Wayne Small [SBS-MVP]
MCSE+I, MCSE 2000
Correct Solutions Pty Ltd

For all the answers on Small Business Server 2000 check out www.sbsfaq.com

"Mark Mancini" <info@NOSPAMmcse2000.com> wrote in message
news:%23Abcb59TDHA.940@TK2MSFTNGP11.phx.gbl...
> Steve, in the 9 years since TS there haven't been any issues! How many
have
> their been with EVERY OTHER component? Get with it TS is safer than you
> give credit to. There are smtp loopholes.
>
> --
> Sincerely,
> Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
> www.MCSE2000.com
> www.AppLauncher.com
>
>
>
> "Steve Foster [SBS MVP]" <steve.foster@picamar.co.uk> wrote in message
> news:Oh6Vwt4TDHA.2252@TK2MSFTNGP12.phx.gbl...
> > Mark Mancini wrote:
> >
> > > no problem....25 and 110 are closed. Now, the server can initiate a
> > > request out to retrieve mail but port 25 is closed. The only port I
> > > open is 3389.
> >
> > Which some might opine (including me) is probably more dangerous. There
> > *are* known exploits against TS, yet there aren't any against SMTP
> > (AFAIK anyway).
> >
> > --
> > Steve Foster [SBS MVP]
> > ---------------------------------------
> > MVPs do not work for Microsoft. Please reply only to the newsgroups.
>
>



Re: IMPORTANT: New method for spammers to relay through you by Steve

Steve
Tue Jul 22 05:38:30 CDT 2003

Derek Daly wrote:

> What are the known exploits on TS?

There was MS02-051 for a start, although a fix for that one has been
released.


> Also how do i get failed logons to be audited? When I go into group
> policy and enable the effective policy is not active. How many places
> do i have to enable it in?

If it's the SBS itself, you need to use Admin. Tools | Domain
Controller Security Policy.

If you want to set it domain-wide (to include member servers), look at
Admin. Tools | Domain Security Policy.

Don't forget that group policies are only replicated on a periodic
basis (though you can force the issue with a command line tool secedit
IIRC).

--
Steve Foster [SBS MVP]
---------------------------------------
MVPs do not work for Microsoft. Please reply only to the newsgroups.

Re: IMPORTANT: New method for spammers to relay through you by Steve

Steve
Tue Jul 22 05:42:56 CDT 2003

Derek Daly wrote:

> Thanks Mark,
>
> I have been using TS for about two years now and think it is one of
> MSofts best kept secrets - it just works! I use it for connecting to
> the Office over the internet and we use it company wide for
> everything. One program in particular which we used to get data
> corruption on a weekly basis no longer corrupts data since going to
> TS. We use the 128bit encryption.

I've been using TS since NT4, and have worked with Citrix MetaFrame too
(a little), although once Win2K came along, I haven't touched Citrix at
all...

For remote usage, I always secure TS by using VPN. Of course, there's
usually less need to encrypt the TS traffic in that scenario, so if
speed becomes an issue, you can then reduce the level of TS encryption.

Since the VPN connection usually has to be there anyway for other
reasons, it also means I can avoid having to open another port.

--
Steve Foster [SBS MVP]
---------------------------------------
MVPs do not work for Microsoft. Please reply only to the newsgroups.

Re: IMPORTANT: New method for spammers to relay through you by Mark

Mark
Tue Jul 22 10:08:27 CDT 2003

Wayne, if you fail to rename your admin accountthen you deserved to get
hacked!

--
Sincerely,
Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
www.MCSE2000.com
www.AppLauncher.com



"Wayne Small [SBS MVP]" <wayne@correct.com.au> wrote in message
news:uXlSMwCUDHA.1912@tk2msftngp13.phx.gbl...
> Mark,
>
> So you've not heard about tsgrinder then... tsgrinder is a DLL that
attacks
> ANY secured terminal server.
> The point is that any hole may be an issue - and if your not a hacker
> yourself then you can't say your safe. I don't presume for a minute that
> despite all my good attempts that I am 100% safe. There is always that
> thing that you don't know or the exploit not yet published widely that may
> trip you up.
>
> --
> Regards,
> Wayne Small [SBS-MVP]
> MCSE+I, MCSE 2000
> Correct Solutions Pty Ltd
>
> For all the answers on Small Business Server 2000 check out www.sbsfaq.com
>
> "Mark Mancini" <info@NOSPAMmcse2000.com> wrote in message
> news:%23Abcb59TDHA.940@TK2MSFTNGP11.phx.gbl...
> > Steve, in the 9 years since TS there haven't been any issues! How many
> have
> > their been with EVERY OTHER component? Get with it TS is safer than you
> > give credit to. There are smtp loopholes.
> >
> > --
> > Sincerely,
> > Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
> > www.MCSE2000.com
> > www.AppLauncher.com
> >
> >
> >
> > "Steve Foster [SBS MVP]" <steve.foster@picamar.co.uk> wrote in message
> > news:Oh6Vwt4TDHA.2252@TK2MSFTNGP12.phx.gbl...
> > > Mark Mancini wrote:
> > >
> > > > no problem....25 and 110 are closed. Now, the server can initiate a
> > > > request out to retrieve mail but port 25 is closed. The only port I
> > > > open is 3389.
> > >
> > > Which some might opine (including me) is probably more dangerous.
There
> > > *are* known exploits against TS, yet there aren't any against SMTP
> > > (AFAIK anyway).
> > >
> > > --
> > > Steve Foster [SBS MVP]
> > > ---------------------------------------
> > > MVPs do not work for Microsoft. Please reply only to the newsgroups.
> >
> >
>
>



Re: IMPORTANT: New method for spammers to relay through you, slightly OT by Steve

Steve
Tue Jul 22 15:20:02 CDT 2003

JoeM wrote:

>
> "Steve Foster wrote:
> > If it's the SBS itself, you need to use Admin. Tools | Domain
> > Controller
> Security Policy.
>
> Steve,
>
> How does this relate to Active Directory?
>
> I want to log all logons, both TS and connected workstations. I added
> a group policy above the Default Domain Policy via the SBS
> Administrator Console Active Directory tree. In the policy I went to
> Computer configuration -> Windows Settings -> Security Settings ->
> Local Policies -> Audit Policy. I left Audit privilege use and
> process tracking undefined, set directory service access and object
> access to failure. Set rest to success/fail. I am getting log entries
> for account management operations, but nothing else.
>
> Is this something where I don't use Active Directory? If so, can you
> point me towards rules for when to work via AD and when use local
> policies?
>
> Thanks,
>
> Joe

It's all part of one big picture. Policies apply at different levels,
and to different objects. By default, there are 3 levels of GPO (Group
Policy Objects) to deal with in an SBS environment. There's the Domain
GP, the Domain Controller GP and Local GP.

If you're adding additional GPOs, that's fine, but you really need to
understand how they all interact. And that's where I'm going to run
away, because Jeff's the expert on GPO, not me.

All I know is that I usually land up looking in all of the three
default places to figure out what's going on... <g>

--
Steve Foster [SBS MVP]
---------------------------------------
MVPs do not work for Microsoft. Please reply only to the newsgroups.

Re: IMPORTANT: New method for spammers to relay through you by Wayne

Wayne
Tue Jul 22 15:31:37 CDT 2003

Steve,

Excellent point - most people don't even think about this.


--
Regards,
Wayne Small [SBS-MVP]
MCSE+I, MCSE 2000
Correct Solutions Pty Ltd

For all the answers on Small Business Server 2000 check out www.sbsfaq.com

"Steve Foster [SBS MVP]" <steve.foster@picamar.co.uk> wrote in message
news:eRhWU7IUDHA.1664@TK2MSFTNGP11.phx.gbl...
> Mark Mancini wrote:
>
> > Wayne, if you fail to rename your admin accountthen you deserved to
> > get hacked!
>
> Even that's no defence any more, now that there are tools that work
> with the well-known SIDs. You can rename administrator, but you cannot
> change its' SID.
>
> --
> Steve Foster [SBS MVP]
> ---------------------------------------
> MVPs do not work for Microsoft. Please reply only to the newsgroups.