More on that Domino relayA number of hypotheses were put forward regarding how this might have been achieved, for example:
- Certain sending IPs had been explicitly permitted relay - this can be discounted because of the very large number of distinct source IPs in many countries and generally assigned to cable/DSL dynamically assigned pools; a somewhat odd choice of IPs from which to have permitted unrestricted relay and very difficult to administer...
- Spams were forged bounces where the local victim was a non-existent address and the apparent sender (either envelope MAIL FROM or else header "from") was some innocent bystander who thus received the spam as an NDR - of course this is possible, but the spams we have been receiving are not NDRs.
But this last suggestion got me to thinking - if the email doesn't look like a relay (i.e. is addressed to a "local" recipient), then the Domino server will accept it - but what if that recipient is not in fact local?
And here, I think, we have our answer. It transpires that the company in question is one we have worked with in the past and I suspect that, to facilitate this collaboration, the administrator there has created a group or groups containing the email addresses of parties involved in aspects of that collaboration. The spammers have just got lucky in that they have obtained the email addresses of those groups and are using them in direct-to-MX spam runs from trojaned proxy servers. When this Domino server receives spams addressed to these local groups, the members of which are not local, it simply reflects the email back out to every member of the group in question.
I tested this by simulating it on a server here and the test email that I sent to a local group was indeed sent out to the non-local member of that group (my own Yahoo! mail account) with headers that look exactly like the headers of the spams we have been receiving from the "compromised" host in India.
So the good news is that there is no new vulnerability in Domino. The bad news is that sites using groups to reflect email to non-local recipients (something we do ourselves in fact) will probably have to rethink this strategy.
Category: Domino: Administration
Technorati: Domino: Administration
Unable to post a comment? Please read this for a possible explanation...
-