Any spam experts on here?

[GeorgeG.]

I'm not talking about a home computer, I'm talking about a company being hit by spammers. So here's the situation...

Earlier this week, our mail queue started to fill up. After looking into it, it seems as though spammers are spoofing email and relaying it through our network even though we're not an open relay. So how are they getting through? I'm guessing either someone's credentials and/or laptop has been comprimised but I can't find anything that shows me where the source is.

I found a script that shows the number of active CAS users but can't seem to find info to identify those users. I've checked logs but can't seem to find anything useful either....

Any ideas?

[goofygrin]

what smtp server? IIS?

[abecx]

if its linux I can fix it for $50.

[diablo rojo]

I like to grill it in a pan (or hot plate) and garnish with pineapple rings.

[jw33]

I only eat that shit maybe once a year and I too cook it on the stove and eat it sandwich style.

[abecx]

Acting stupid about the internet isn't funny anymore.

[Geor!]

So then you no longer refer to yourself as the internet god then, right? Cause that shit was stupid.

[GeorgeG.]

Not Linux....

We're running Exch 2010 and using a Barracuda Spam and Virus firewall. I think what I'm trying to accomplish right now is identify, then block how this spammer is realying through our network. Once I can do that, then I can address the issue that about 50% of our laptops were issued to users with no AV... I can't say for certain that's how this all started, but it definitely shouldn't have happened regardless.

So in a nutshell, Barracuda filter, Exchange 2010 with a CAS array, round robin through a Netscaler. Checking the email headers, it shows that it's coming through our Netscaler IP but nothing more.

And yes, IIS for OWA

[Ratt]

And this is why network security engineers charge so much for their services...

[KevinFACE]

$5 says your barracuda has been compromised.

Not impossible.

[krazy kris]

spam and potaters

[GeorgeG.]

Finally figured it out...

So a few weeks ago, we swapped out some Cisco gear with an ASA and long story short, the IP address for OWA was allowing port 25 when all port 25 traffic should be going to the IP for our spam firewall. Been spam free for the past hour and a half so we'll see how it goes by morning.

What finally gave it away was while I was manually clearing the queue, I saw a spam email with a spoof sender/recipient but the subject field had the IP address for our webmail, so then I checked the NAT statements and the access lists....and there it was.

[32valves_of_pleasure]

so wait, your spam firewall prevents you from being an open relay?

but before you were an open relay? Hope you checked the the spam lists for your ip space.

[ELVIS]

I like to grill it in a pan (or hot plate) and garnish with pineapple rings.

you classy motherfucker!

god bless.

[Baron Von Crowder]

They have bacon spam now...