Shutting down an SMTP AUTH Relay attack

We recently had a client whose Exchange Server (configured by another I.T. company, mind you) was continously being blacklisted with no immediately identifiable cause. Our first responders checked the normal stuff and verified that the server was not an open relay in any obvious way. At the time I jumped in on the support ticket, the server did not have the proper logging enabled, so we couldn't see exactly what was occuring.

Attack of the Local Failures

You read that correctly. It is a 82 GB mailbox filled with Local Failure messages. Jon Jeffels spotted this when we couldn't figure out why his Outlook client kept crashing and hanging. Read his full post here:

http://blog.jeffels.net/2010/10/outlook-issues/#more-61

Trend Micro WFBS UPX Packed Updates

I had a client with a myriad of issues related to some infected machines on the network. While digging through the firewall logs (SonicWALL TZ-170 or 190 I believe), I found this entry:

Case-sensitive DNS? Believe it.

DNS is not case-sensitive, that's what you thought, right? Me too, but apparently somebody disagrees.

End Users are Funny Pt II

Here's another conversation during a remote support session today:

Client: "So Paul, have you seen the internet today?"

Me: "Well, I've been on the internet today, does that count?"

Client: "Take a look at the front page of the internet when you can. There is this crazy looking guy on the front page."

5 Things I Learned from Air Force Networks

After completing what may very well be my last tour as a Cyber Systems Operator with the Air Force Reserves, I'd like to offer this (unclassified and possibly incorrect) insight into the wonderful system that is the Air Force Global Information Grid (AF-GIG):

Secunia Half-Year Report 2010

I usually try to avoid reposting information from others, but Secunia has a great security report that has some down to earth information relevant to every computer user:
https://docs.google.com/viewer?url=http://secunia.com/gfx/pdf/Secunia_Half_Year_Report_2010.pdf

Among the interesting statistics?

• A group of ten vendors, including Microsoft, Apple, Oracle, IBM, Adobe, and Cisco, account on average for 38 percent of all vulnerabilities disclosed per year.
• In the two years from 2007 to 2009, the number of vulnerabilities affecting a typical end-user PC almost doubled from 220 to 420, and based on the data of the first six months of 2010, the number is expected to almost double again in 2010 to 760.
• During the first six months of 2010, 380 vulnerabilities or 89% of the figures for all of 2009 has already been reached.
• A typical end-user PC with 50 programs installed had 3.5 times more vulnerabilities in the 24 3rd party programs installed than in the 26 Microsoft programs installed. It is expected that this ratio will increase to 4.4 in 2010.
• An Windows end-user can patch 35% of vulnerabilities with one tool from Microsoft, but requires another 13 to patch most of the rest.

Also, in terms of the raw number of vulnerabilities, Apple has shot past Microsoft and Oracle to claim the #1 spot. However, this doesn't take into account how severe the vulnerabilities are or how quickly a patch is released.