North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical


  • From: Michael Holstein
  • Date: Tue May 27 14:46:07 2008

We never figured out how the accounts were compromised. I suspect

another .edu here ..

how we've seen it happen is we get blasted by one of those "verify your email account" messages.
despite our countless efforts at user education about responding to this stuff, a dozen or so people always do (we try to configure outbound filters to catch it, but don't always do so in time).

These accounts are then used by automated scripts to hammer on our webmail (and ours is https, forced).

Most of the spammers' messages appear as though someone
is manually using their cut & paste to generate the spam,
not anything automated (based on the rate messages go out.

When we've had it happen, the messages are being relayed at a rate of ~10,000/hr.

Note that the messages sent *after* the compromise are NOT more of the "verify your account" type .. they're run-of-the-mill pill and watch adverts. The original "verify your account" stuff comes in from various botnet PCs.


Michael Holstein
Cleveland State University