Newbie Question: Mailserver security

Hi Guys/Gals,

I have a problem with one of my client; he accuses his ISP of forwarding his email to the competition. So I was wondering what kind of action a hacker needs to take to realize this. I know that nothing is impossible but, is it plausible that this happened to my client?

The ISP assures us that this didn’t happen and I tent to believe them. So to get it clear if that the client has another security leak I need to get a global view of all the possible actions of a hacker. So I can create an overview and search for other possible leakages.

Can somebody help me with this?

Kind regards,
Arbi

Well im sure your [insert someone other than me here] is just paranoid. Leaks are fun to play with and there's probably a bazillion different ways to track 'em down without getting into murky legal waters. I don't know what exactly you're looking for by 'action of a hacker' but i don't think anyones gonna show you how to hack the Gibson here, if-yaknowwhadimean ;)

But your options all depend on what kind of business you're [insert someone other than me here] is in and what the competition could gain by reading the emails. It also helps if you know what type of mail reader the person is using. Outlook? What version? Or is he reading it at gmail? Or juliosdiscountemail.com? We need details.

btw, what is the esco in your name stand for?

ISPs don't intercept mail without a court order. OK they log activity but have no idea of what people are doing unless they analyse their logs.

The three likely sources are:

1. A keylogger.
2. Spyware that sends duplicates of e-mails.
3. An insider.

Quote:

---

Originally Posted by nihil

ISPs don't intercept mail without a court order.

---

Not unless you're AT&T, then you just shotgun everything to the NSA :)

What I would do is go to a friend's place. Logon to e-mail using their machine and change the password.

That would resolve the compromised account and insider possibilities.

Then format and reinstall............. that will get rid of spyware and most keyloggers.

:)

Quote:

---

Originally Posted by xiphias360

Well im sure your [insert someone other than me here] is just paranoid.

---

That I am sure about

Quote:

---

Originally Posted by xiphias360

I don't know what exactly you're looking for by 'action of a hacker' but i don't think anyones gonna show you how to hack the Gibson here, if-yaknowwhadimean ;)

---

:) Its not the goal of my question to get to hacking part... am more intrested in the information how i can defuse the situation. And thats why i posted it

Quote:

---

Originally Posted by xiphias360

But your options all depend on what kind of business you're [insert someone other than me here] is in and what the competition could gain by reading the emails. It also helps if you know what type of mail reader the person is using. Outlook? What version? Or is he reading it at gmail? Or juliosdiscountemail.com? We need details.

---

True, but i was more looking for global answers... i dint want to bore u with the juicy details... But seriously, as u said there about trillian (I can also make numbers up) ways to get to the emails. I Should have specified that am looking at ways that are currently are "mis"used and what the commonly used ways out there.

Quote:

---

Originally Posted by xiphias360

btw, what is the esco in your name stand for?

---

Its stands for *non of your business*, just kidding it stands for escobar. are u doing some social hacking? I can asure there is nothing to gain... My secrets are publicly known...

back to the problem at hand: He's problaly using an cheap hosted web based email system. Reading his email online and downloading his email true an pop3 server.

Nature of his business is more focussed on knowledge and his specialized network of clients.

I hope this will be enough for a short run down without the details of the common used practices...

MrEsco

Quote:

---

Originally Posted by nihil

ISPs don't intercept mail without a court order. OK they log activity but have no idea of what people are doing unless they analyse their logs.

The three likely sources are:

1. A keylogger.
2. Spyware that sends duplicates of e-mails.
3. An insider.

---

Yep, he changes frequently his passwords and the last week he's using a lot of diffrent computers (thats what he said).

Spyware: Yep, is possible but we didnt detected any known spyware/trojan...

Yep: thats our main focus but he claims that there are duplicate emails going around. People quoting his emails (yep sounds like poetry)

MrEsco

PS: and why the hell am i using "yep" alot? Might it be a virus?

Maybe you can tell him to send you mail with a photo from a webserver owned by you.
Then you can add a script that will log all the ips who are downloading this photo and you ll see whether someone intercepts his mail.
Then you can track the ip who viewed your photo and his mail ;)

its my 2nd post so be gentle :p

Hmmm,

Quote:

---

Nature of his business is more focussed on knowledge and his specialized network of clients.

---

Does he send the same or similar mails to them all? If so, the compromise might be outside of his business at a client? Is he sure that all his clients are genuine?

Quote:

---

Spyware: Yep, is possible but we didnt detected any known spyware/trojan...

---

What tools have you used? remember that conventional AV products are not very good at detecting trojans and spyware, particularly as the spyware may look like a legitimate application.

no social hacking, just curious. i live in a city called Escondido, right by San Diego. For short we call it Esco :)

Well, on to your options. I think the most used technique to find a leak is by sending false information and seeing if your suspect picks up on it. This is used by even the most un-tech savvy of computer users. Putting something in an juicy or interesting in an email and then casually bringing it up later in a conversation and seeing if the suspect lets out more than you have told him.

But if the person is using some cheap online email account you can add an IP/timestamp logger to your emails. Actually, depending on how you used it, it could probably work in the best of online email accounts. Anywho, here's the gist: you make a small perl script that does the following,

open log file;
store a line like "$ENV{REMOTE_ADDR} (ip of whoever opens the email) opened the email at $timestamp\n";
close log file;

open image file;
get image file;
print image file;
close image file;

This is something i used to use and it works. But today, sites like gmail automatically block images in emails, just like outlook, unless the user clicks a link to show the images. So if that's the case, you can create an email where the main focus is the data on some graph or other interesting image that would cause the user to download the image.

I had a pretty nice program back in the day. I modified my .htaccess so that .gif extensions were associated with cgi scripts (just to add to the realness ;) ) and i used sendmail to alert me whenever the image was triggered as well as logged everything to a file.

Quote:

---

Originally Posted by lazy13

Maybe you can tell him to send you mail with a photo from a webserver owned by you.
Then you can add a script that will log all the ips who are downloading this photo and you ll see whether someone intercepts his mail.
Then you can track the ip who viewed your photo and his mail ;)

its my 2nd post so be gentle :p

---

Not a bad idear, for a second post ;) We dont own the webserver...

MrEsco

Quote:

---

Originally Posted by xiphias360

Well, on to your options. I think the most used technique to find a leak is by sending false information and seeing if your suspect picks up on it. This is used by even the most un-tech savvy of computer users. Putting something in an juicy or interesting in an email and then casually bringing it up later in a conversation and seeing if the suspect lets out more than you have told him.

But if the person is using some cheap online email account you can add an IP/timestamp logger to your emails. Actually, depending on how you used it, it could probably work in the best of online email accounts. Anywho, here's the gist: you make a small perl script that does the following,

open log file;
store a line like "$ENV{REMOTE_ADDR} (ip of whoever opens the email) opened the email at $timestamp\n";
close log file;

open image file;
get image file;
print image file;
close image file;

This is something i used to use and it works. But today, sites like gmail automatically block images in emails, just like outlook, unless the user clicks a link to show the images. So if that's the case, you can create an email where the main focus is the data on some graph or other interesting image that would cause the user to download the image.

I had a pretty nice program back in the day. I modified my .htaccess so that .gif extensions were associated with cgi scripts (just to add to the realness ;) ) and i used sendmail to alert me whenever the image was triggered as well as logged everything to a file.

---

Good stuff, but now some root cause analysis... what is the common used way to 'hijak' an emailadres?

Thx for the input... i will razzle and dazzle them at the meeting of tommorow... for shizzl

MrEsco

Ahhh, and the hat turns black... I think account hijaking is beyond the scope of this forum. But as far as a common used way, there is none. It's not like you can just launch stealthisaccount.exe -a [email protected] and instantly have an account. It's more like invading a country... ;)

[rant]

Quote:

---

he accuses his ISP of forwarding his email to the competition.

---

:sigh: The problem is your client's an idiot. Why is it people who know nothing whatsoever about IT are always so unwaveringly convinced that they know the cause of the problem and who's at fault?

[/rant]

I seriously doubt you have a hacker on your hands. I'd bet you 95% that the problem is either:

1) Someone internal leaking info, or
2) User error.

Either way, I'd lay money on a people problem, not a system problem.

To echo the above poster, there is no "common way" to "hack" email. You're looking at a question with dozens of solutions.

xiphias360

Quote:

---

Ahhh, and the hat turns black... I think account hijaking is beyond the scope of this forum.

---

Whilst I appreciate and applaud your concern, we do actually discuss these matters within reason. Like I am not going to post links to skiddie tools or whatever, but I have reviewed commercial stuff of this nature in the past, as have many other members.

If you have any concerns about what you might want to post, please feel free to PM me or any other Mod or Admin. We do believe in full disclosure, but it is "responsible" full disclosure.

What our friend seems to have here is not the usual account hijacking scenario as I read things. This is a bit more along the lines of industrial/commercial espionage. Nasty, but unfortunately it happens.

Now, this may not even be a true "IT" issue. We could have a "mole" on the inside, his client's greed might have encouraged him (the client) to accept a "trojan horse" account (proper use of Trojan Horse there......... had to read that stuff for my ancient Greek exams :cool:)

I am still waiting to see if we have a general e-mail or client specific ones. If it is the latter, we would need to know (in general) what made the target accounts "special"

Hell, this stuff isn't rocket science, but it is a bit difficult given our means of communication and the time differences between us all?

Keep chipping away at the boulder folks ;)

Well if that's the case then I guess it wouldn't hurt to glaze over a couple things.

Since you touched on the Trojan Horse subject, that is probably the easiest, most cut and dry way a person is going to get inside a place to take a look around without going through the sleepless weeks and efforts of a real hack. Plus it's insanely easy so even Fred who sweeps up out back behind the warehouse could do it. Be warned however, this is not advice, instructions or anything of that nature. Merely a discussion, and should you flip this around and use any of this to try anything to anyone and get caught, the law's heavy hammer will come crashing down on you.

So now, back to the trojan horse. It's very possible your client could be infected with one and not know it. Are his antivirus definitions up to date? Understand that antivirus programs only catch the bad stuff based on their signature. If you take a well known virus that every AV in the world looks for, and run it through some new packer, you change the signature of the file and voila, the AV doesn't know it's a trojan anymore. I used to play with Sub7 back in the day (didn't we all? :D) and while all the AV's looked for it, I had packed it with a no-name hole-in-the-wall packer and was able to send it to friends and family undetected, just for SnG's of course :) It worked for a whole week before McAffe was able to detect it. Norton took another couple weeks after that. And getting someone to download something is sooOoOo easy. Gotta love horney guys. I remember a story in the news about a guy who was duped by a hacker in a chat room claiming to be a young teen. "She" sent him "revealing pictures" that let the hacker rape the retards computer and he ended up scoring passwords that led to another raping of a huge company.

Anywho, the point is, a recent survey showed that most people think they have AV or firewall protection but really don't have any protection at all. Your client could swear on a stack of bibles that he has AV, but then you could look and see that his Norton 30-day free trial that came bundled with his computer expired 2 and a half years ago and couldn't detect sober if it stabbed him in the ass.

But trojans aren't the only thing that could come into play here. A rootkit could be present that gives the other person a 24/7 pass into your computer. Try downloading Rootkit Revealer and see what happens.

Also, is there a firewall installed? What kind? If not give ZoneAlarm a try. It's free and user friendly, and should tell you when and where your packets try to sneek off to, and ask you if you want to let it happen or not.

There's tons of ways to get a trojan or rootkit into another network. Someone could have paid a disgruntled or just plain easily swayed employee to do the job for them. And if you're a fan of the Stealing the Network series, you should remember one of the guys talking about another easy way to get inside. Just burn the trojan/rootkit to a disc and have it autorun. Then toss some other worthless but seemingly interesting stuff on the disc (porn, games, sensitive-looking documents) and label it accordingly, "The Best of Heather Brooks", "Duke Nukem Forever (LEAKED!!)" or "Sales Data". Then "drop" it somewhere near the building and wait for it to phone home and deliver you a set of keys.

Quote:

---

Originally Posted by xiphias360

Well if that's the case then I guess it wouldn't hurt to glaze over a couple things.

Since you touched on the Trojan Horse subject, that is probably the easiest, most cut and dry way a person is going to get inside a place to take a look around without going through the sleepless weeks and efforts of a real hack. Plus it's insanely easy so even Fred who sweeps up out back behind the warehouse could do it. Be warned however, this is not advice, instructions or anything of that nature. Merely a discussion, and should you flip this around and use any of this to try anything to anyone and get caught, the law's heavy hammer will come crashing down on you.

So now, back to the trojan horse. It's very possible your client could be infected with one and not know it. Are his antivirus definitions up to date? Understand that antivirus programs only catch the bad stuff based on their signature. If you take a well known virus that every AV in the world looks for, and run it through some new packer, you change the signature of the file and voila, the AV doesn't know it's a trojan anymore. I used to play with Sub7 back in the day (didn't we all? :D) and while all the AV's looked for it, I had packed it with a no-name hole-in-the-wall packer and was able to send it to friends and family undetected, just for SnG's of course :) It worked for a whole week before McAffe was able to detect it. Norton took another couple weeks after that. And getting someone to download something is sooOoOo easy. Gotta love horney guys. I remember a story in the news about a guy who was duped by a hacker in a chat room claiming to be a young teen. "She" sent him "revealing pictures" that let the hacker rape the retards computer and he ended up scoring passwords that led to another raping of a huge company.

Anywho, the point is, a recent survey showed that most people think they have AV or firewall protection but really don't have any protection at all. Your client could swear on a stack of bibles that he has AV, but then you could look and see that his Norton 30-day free trial that came bundled with his computer expired 2 and a half years ago and couldn't detect sober if it stabbed him in the ass.

But trojans aren't the only thing that could come into play here. A rootkit could be present that gives the other person a 24/7 pass into your computer. Try downloading Rootkit Revealer and see what happens.

Also, is there a firewall installed? What kind? If not give ZoneAlarm a try. It's free and user friendly, and should tell you when and where your packets try to sneek off to, and ask you if you want to let it happen or not.

There's tons of ways to get a trojan or rootkit into another network. Someone could have paid a disgruntled or just plain easily swayed employee to do the job for them. And if you're a fan of the Stealing the Network series, you should remember one of the guys talking about another easy way to get inside. Just burn the trojan/rootkit to a disc and have it autorun. Then toss some other worthless but seemingly interesting stuff on the disc (porn, games, sensitive-looking documents) and label it accordingly, "The Best of Heather Brooks", "Duke Nukem Forever (LEAKED!!)" or "Sales Data". Then "drop" it somewhere near the building and wait for it to phone home and deliver you a set of keys.

---

Guys,

The trojan/rootkit posibility has been explored, nothing has been found... we took the computers almost completly apart, sector by sector

At this moment we're looking into human aspect of this so called 'hack' and it looks like the client is just paranoid. Am just getting my facts straight, i know that attacking an emailserver needs some skill and a lot of free time...

It would mean that the attacker has an clear image of his target, is it possible to discover with a trace route wich server the sender is using?

or is it a bit complicater then that?

Kind regards,

MrEsco

Quote:

---

Originally Posted by nihil

Whilst I appreciate and applaud your concern, we do actually discuss these matters within reason. Like I am not going to post links to skiddie tools or whatever, but I have reviewed commercial stuff of this nature in the past, as have many other members.

---

Thx for the concern but am not intrested in de scribbiedidlydoo tools. Am more intrested in 'global' views so we can protect ourselfs against it.

Quote:

---

Originally Posted by nihil

What our friend seems to have here is not the usual account hijacking scenario as I read things. This is a bit more along the lines of industrial/commercial espionage. Nasty, but unfortunately it happens.

---

It looks like (if its true) an ilaberate and well organised effort but i doubt it... to many holes in the story of the client. We just need to cover all angles.

Quote:

---

Originally Posted by nihil

I am still waiting to see if we have a general e-mail or client specific ones. If it is the latter, we would need to know (in general) what made the target accounts "special".

---

General email

Quote:

---

Originally Posted by nihil

Hell, this stuff isn't rocket science, but it is a bit difficult given our means of communication and the time differences between us all?

Keep chipping away at the boulder folks ;)

---

:)

Hah!

Quote:

---

General email

---

That, I feel, is the answer.

Your client has a customer who is a spy, and he is sending his e-mails to that account as well as all his legitimate ones.

Search for Occam's Razor or KISS ;)

MrEsco, your client does not come across as the sharpest tool in the shed, now does he? :lildevil:

To put it very bluntly, how you tell him that he has **** for brains is down to you old chap :D

One possible idea would be to have your inbound/outbound mail routes through a secure hosted machine elsewhere (outside the ISP).

Ensure that mail in and out only goes via that host, and is encrypted in both directions. That machine can then act as an "MX" record for the customer's domains.

Some hosted email security services already provide such a system; I work for a company which does just this.

If you're using this, even if the ISP's routers were compromised, your email is still safe.

Slarty