TetraWiki - User contributions [en]

Spam Issue on Triburg and its troubleshoot of which account got compromised in ZImbra

2014-11-25T18:07:35Z

Yogesh:

[[category:Triburg]]

==ISSUE==

One of the account got compromised and Spam mails were sent using that account credentials .

== Finding Methodology ==

# check the mailq ( as zimbra user ) if traces of those mails are available
# Check /var/log/zimbra.log and identify the IP
# Check /opt/zimbra/log/audit.log for the authentication information against that IP and at that time

== Finding ==

Check the mailq , but only the bounce traces of mails were available , which did not reveal the sender information , but showed that Spamming has been done via this server

Next , Checked the zimbra.log found traces of the spam mail ID.

Feb 6 04:15:49 mail postfix/qmgr[17520]: AB0B2B4B8096: from=<041700@unmsm.edu.pe>, size=1293, nrcpt=50 (queue active)
Feb 6 04:15:49 mail postfix/qmgr[17520]: 2CF51190049: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 29F4F190048: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 5932E190042: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 62B5D1901C1: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)

The From ID 041700@unmsm.edu.pe is the spammer. We had to check for its traces the previous logs /var/log/zimbra.log.1 , and discovered the IP address

Feb 6 00:59:43 mail postfix/qmgr[17520]: 16DBEB4B801C: from=<041700@unmsm.edu.pe>, size=893, nrcpt=5 (queue active)
Feb 6 00:59:43 mail amavis[3538]: (03538-09) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20130206T004632-03538: <041700@unmsm.edu.pe> -> <chizobamjames@gmail.com>,<chizoba.j@rediff.com>,<chizoba.j@rediffmail.com>,<don_chizzy2000@yahoo.com>,<don_chizzy@ymail.com> SIZE=893 Received: from mail.triburg.co.in ([127.0.0.1]) by localhost (mail.triburg.co.in [127.0.0.1]) (amavisd-new, port 10024) with ESMTP; Wed, 6 Feb 2013 00:59:43 +0530 (IST)
Feb 6 00:59:43 mail amavis[3538]: (03538-09) Checking: uv8HJES+YMct '''[101.63.8.198]''' <041700@unmsm.edu.pe> -> <chizobamjames@gmail.com>,<chizoba.j@rediff.com>, <chizoba.j@rediffmail.com>,<don_chizzy2000@yahoo.com>,<don_chizzy@ymail.com>
Feb 6 00:59:43 mail amavis[3538]: (03538-09) Open relay? Nonlocal recips but not originating: chizobamjames@gmail.com, chizoba.j@rediff.com, chizoba.j@rediffmail.com , don_chizzy2000@yahoo.com , don_chizzy@ymail.com

And then the authentication information was discovered from /opt/zimbra/log/audit.log

2013-02-06 00:50:33,034 INFO [btpool0-474://localhost/service/soap/AuthRequest] '''[name=imran.khan@triburg.co.in;ip=101.63.8.198''';ua=zclient/6.0.14_GA_2928;] security - cmd=Auth; account=imran.khan@triburg.co.in; protocol=soap;

The Password was of the compromised account was immediately changed .
--------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------

==Another Method For Finding the Authenticated User For Spamming==

# grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username=//g' | sort | uniq -c | sort -nr | tail -n 1000 | less

Spam Issue on Triburg and its troubleshoot of which account got compromised in ZImbra

2014-11-25T15:44:27Z

Yogesh:

[[category:Triburg]]

==ISSUE==

One of the account got compromised and Spam mails were sent using that account credentials .

== Finding Methodology ==

# check the mailq ( as zimbra user ) if traces of those mails are available
# Check /var/log/zimbra.log and identify the IP
# Check /opt/zimbra/log/audit.log for the authentication information against that IP and at that time

== Finding ==

Check the mailq , but only the bounce traces of mails were available , which did not reveal the sender information , but showed that Spamming has been done via this server

Next , Checked the zimbra.log found traces of the spam mail ID.

Feb 6 04:15:49 mail postfix/qmgr[17520]: AB0B2B4B8096: from=<041700@unmsm.edu.pe>, size=1293, nrcpt=50 (queue active)
Feb 6 04:15:49 mail postfix/qmgr[17520]: 2CF51190049: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 29F4F190048: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 5932E190042: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)
Feb 6 04:15:50 mail postfix/qmgr[17520]: 62B5D1901C1: from=<041700@unmsm.edu.pe>, size=1292, nrcpt=50 (queue active)

The From ID 041700@unmsm.edu.pe is the spammer. We had to check for its traces the previous logs /var/log/zimbra.log.1 , and discovered the IP address

Feb 6 00:59:43 mail postfix/qmgr[17520]: 16DBEB4B801C: from=<041700@unmsm.edu.pe>, size=893, nrcpt=5 (queue active)
Feb 6 00:59:43 mail amavis[3538]: (03538-09) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20130206T004632-03538: <041700@unmsm.edu.pe> -> <chizobamjames@gmail.com>,<chizoba.j@rediff.com>,<chizoba.j@rediffmail.com>,<don_chizzy2000@yahoo.com>,<don_chizzy@ymail.com> SIZE=893 Received: from mail.triburg.co.in ([127.0.0.1]) by localhost (mail.triburg.co.in [127.0.0.1]) (amavisd-new, port 10024) with ESMTP; Wed, 6 Feb 2013 00:59:43 +0530 (IST)
Feb 6 00:59:43 mail amavis[3538]: (03538-09) Checking: uv8HJES+YMct '''[101.63.8.198]''' <041700@unmsm.edu.pe> -> <chizobamjames@gmail.com>,<chizoba.j@rediff.com>, <chizoba.j@rediffmail.com>,<don_chizzy2000@yahoo.com>,<don_chizzy@ymail.com>
Feb 6 00:59:43 mail amavis[3538]: (03538-09) Open relay? Nonlocal recips but not originating: chizobamjames@gmail.com, chizoba.j@rediff.com, chizoba.j@rediffmail.com , don_chizzy2000@yahoo.com , don_chizzy@ymail.com

And then the authentication information was discovered from /opt/zimbra/log/audit.log

2013-02-06 00:50:33,034 INFO [btpool0-474://localhost/service/soap/AuthRequest] '''[name=imran.khan@triburg.co.in;ip=101.63.8.198''';ua=zclient/6.0.14_GA_2928;] security - cmd=Auth; account=imran.khan@triburg.co.in; protocol=soap;

The Password was of the compromised account was immediately changed .
--------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------

==
'''Another Method For Finding the Authenticated User For Spamming''' ==

# grep sasl_user /var/log/zimbra.log | sed 's/.*sasl_username//g' | sort | uniq -c | sort -nr | tail -n 1000 | less