Fortune 1000 Companies Sending Spam, Phishing 117
An anonymous reader writes "The Register takes a look at spam touting everything from Viagra to phishing sites being sent from Fortune 1000 networks. Oracle was found to have a machine pushing out a PayPal phishing scam, and BestBuy had a system sending thousands of spams a month. The Washington Post's Security Fix blog also is tracking this story, finding stock spam being pumped from ExxonMobile and from American Electric Power, among others. Another machine at IndyMac Bank was the source of spam touting generic prescription drugs. From the story: '...an IT engineer with American Electric Power, said the stock spam came from a bot-infected computer belonging to a contractor at one of its power generator plants.'"
Ratio of broadband vs dial-up (Score:5, Insightful)
Companies can restrict outbound port 25 connects. (Score:4, Insightful)
But why aren't these companies correctly firewalled? Why do they allow machines other than their email servers to make outbound port 25 connections?
Why aren't their logs monitored? Wouldn't this be easy to spot?
Even with the resources of the biggest companies, their people cannot keep their machines clean or even stop them from sending spam. Who knows what else. A spam zombie can just as easily log network traffic, passwords and anything else on their wires.
Re:Companies can restrict outbound port 25 connect (Score:3, Interesting)
They have usernames/passwords, right? (Score:5, Insightful)
If you're an end user, you should have a username/password and be using port 465 or 587 (or whatever your email admin setup).
That is why companies should block outgoing port 25 connections from everything except there own mail servers.
Re: (Score:1, Interesting)
your use case (Score:2)
Re: (Score:2)
If the above restrictions are in place (no end-point delivery on 587, then the virii won't use it.
Re: (Score:1)
Re: (Score:1)
Now, this might not be the case with CE 5.0 and onwards, but the versions I've worked with have just baffled me with that one.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Insightful)
Scan every e-mail at the SMTP server. Scan every
That's inbound. I'm talking outbound. (Score:5, Informative)
But I wasn't originally talking about inbound connections. Blocking the outbound connections would cut off the spam coming from your network.
How those machines got infected in the first place is a whole other series of discussions. And one that we really should have sometime. Preferably involving Linux and Free software at the critical points (allowing for Windows workstations).
Re: (Score:2, Interesting)
In addition to the normal security setup each computer had an additional program on it. The function of the program was to reset the contents of the computer to that of a default image every single
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Those store your user settings on the server and make them available on any client where you log in. So you don't have to setup your email account or wallpaper every time you use another computer, or re-install it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
If your employer is allowing you to check your home e-mail through a client (outlook, thunderbird) then that is asking for trouble.
Re:Companies can restrict outbound port 25 connect (Score:5, Insightful)
You can argue morale issues until you are blue in the face, network security should trump that in 99% of those cases. The enterprise network exists for the sole benefit of the enterprise. Personal email, instant messages, myspace, what the hell ever, has a risk that FAR outweighs any potential benefit. If your employees can't leave their email/myspace/im friends for 8hrs a day you should probably find employees who can. There is plenty of websurfing around that doesn't involve grotesque breeches of security to keep people entertained while they are being productive. If the company is paying you so little that you can't afford your own internet access you should probably find a new job.
Re:Companies can restrict outbound port 25 connect (Score:5, Insightful)
That's a classic example of IT narrowmindedness. If the employees no longer care, no technical measures will secure your data. Security is everybody's business, not just yours. People will naturally protect that which they care about. No morale = no security.
As you seem to be from the school of "a good firing will fix anything". Hopefully for your own sake your boss wises up and uses a 'good firing' to adjust your attitude, because I doubt anything else will penetrate that skull.
You have to be cruel to be kind (Score:2)
Yes, but one of them came first. A company that has LAN problems does not get much done and if it happens regularly you will find your users wandering off on "LAN breaks", managers will attempt to charge the IT dept for down time, ect, frustration levels rise, experienced sysadmins are like rats on a sinking ship, and morale suffers.
Like it or not the GP is correct, IT policy is a matter of coporate "self preservation". LAN policy must be enforced from the top down with the s
Re: (Score:3, Insightful)
Network security is primarily a people business. (Score:2)
I mostly am the IT department at a 30 employee company, so I have some experience with these issues from a somewhat different (non-Fortune 1000) perspective.
First, you are confounding personal use of the network (e.g. personal email) with major security risks like people installing their own software. If people are even able to install their own software on the computers under your management, I have no idea why you still have a job -- restricted-rights user accounts exist for a reason. From a security per
Re:Network security is primarily a people business (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Don't check "personal" email, don't surf Slashdot, do nothing except work and do what you're told. Easiest way to have people to come in with a slave mentality. Do just enough to avoid getting beaten down but certainly not enough to actually make a difference.
I wonder how he reconciles his use of company resources to post to Slashdot with his attitude toward lusers. Oh, right, he's probably posting from home... and some lusers are mo
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
I can understand why you would say that. However, what about external visitors to your site ?
A large part of my job involves visiting other university departments and conferences, email (and Jabber IM) contact with my home department is vital for being able to respond to questions and problems raised by the people that I meet. Which is why I'm there in the first place.
Re: (Score:2)
VPN maybe if the host network is setup to allow it, but I think probably the best solution (in terms of reliability at least) is to get bluetooth in on the action. Get a cellphone, pay the extra $10/month or whatever it is for unlimited net usage, a
Re: (Score:1)
Yep, that protects your internal systems from attack by nasty things on visit
Re: (Score:2)
Easier said than done. When you consider that even the formidable Los Angeles CTU security defenses were breached by a simple remote-execution browser exploit planted on a web-page, what chances do normal businesses have?
Re: (Score:2)
Exactly, for instance, browsing slashdot from your employer. =P
Brought to you by WorldWide Pants ... (Score:1)
breeches == trousers worn by Ben Franklin, or the back ends of a number of modern cannon
I must admit, however, there IS a strange and awesome majesty to your original phrase ...
Re: (Score:2)
Say what you want about MS(personally, I don't much like em' and Vista is the most horrid thing to happen to the OS world since ME), but Exchange works and works well. And yes, most companies use it. Maybe a couple of holdouts or diehards use Lotus. But Exchange is definitely the dominant platform and is the great majority of MS's piggy bank.
Your statement would be like saying, "Most computer users I know run BeOS".
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Both companies I work for get their internet service from a provider that blocks port 25 at the head end. If you want to send mail, you must send using their SMTP server, it is the only IP address exempt from port 25 traffic. If a spambot is dim enough to try to
Re: (Score:2)
Maybe you missed the part where I said this:
"When they send replies, their SPF/DomainKeys/Whatever-using ISP requires them to use the proper SMTP server."
Now this is minorly annoying as if I read an email on my home account when at work, and I hit reply, I have to ch
Re: (Score:2)
So you have a better, simple idea, that has a prayer of being implemented by anyone? Their policy of not allowing outside SMTPs completely solves the problem of open relays, and that's a powerful feature. It forces all outgoing mail to go t
Re: (Score:2)
Re:Companies can restrict outbound port 25 connect (Score:2)
Re:Companies can restrict outbound port 25 connect (Score:2)
Re: (Score:2)
Re: (Score:1, Insightful)
Re:Never attribute to malice... (Score:5, Insightful)
You're probably right; spammers are among the most aggressive attackers and most of the F1000 have large distributed networks where a (hopefully) small number of systems are going to be vulnerable at any moment. On the other hand, these companies can and do pay for high quality and high capacity pipes. They are also far less suspect as a source of spam, and the ISPs will certainly be reluctant ($$) to take unilateral action to deal with suspect traffic (as some do with their residential customers.)
For all of these reasons F1000 hosts are many times more effective as spam zombies than your average asymmetric DSL host, so I have no problem with people exposing carelessness or neglect among these companies. They have the resources and talent to prevent this sort of abuse. If they're not, a little bad press might help. Earlier today we all learned that some 40+ million credit/debit card accounts got downloaded from commercial IT systems. I wouldn't be surprised to learn that those same companies have a long history of unwittingly contributing bandwidth to spammers.
Re: (Score:2)
Having botnets composed by home users with their hobby pcs is bad enough, now when that botnet have a good numbers o
Re: (Score:3, Insightful)
Not suprising to me (Score:1)
Defense in depth. (Score:3, Insightful)
You know what? With a couple of old boxes and Linux you could setup a smaller company so that this would never happen.
Use Linux as your firewall and restrict any outbound SMTP connections to your email server.
Use Linux and Snort to monitor crap on your network.
Use Linux as your DHCP/DNS server and lock down the IP addresses by the MAC addresses. Yes, this is labour intensive. But it will allow you to keep all your regul
Re: (Score:2)
Re:Not suprising to me (Score:5, Informative)
For example, I've worked fairly frequently with a poor lady who was a salesman for a remote market. She lived there rather than near my office. Her email account got suspended at least once a week due to the fact that her laptop had syphilis, gonorrhea, warts, crabs, and just about every virus and worm known to man.
Phone walk-throughs just didn't help with this lady and the local ISP (mandated by accounting) blocked any ports that could be used to remotely administer her machine. Finally we had her fed-ex it to us for cleanup, wipe, and reinstall of a fairly-well locked down windows system with our (accountant selected) workstation antivirus app.
This cycle continued four or five times. Her Antivirus app somehow got disabled and her machine became Typhoid Mary. She shipped the Laptop back and we tried to lock it down as securely as possible.
Ultimately, we discovered that an internet cafe she frequented was infected with a particularly nasty spam-bot worm that our particular antivirus app didn't catch (An AnnaK variant, IIRC). We used this as evidence to override the accountant's selected cheapo antivirus with something that worked a little better.
Re: (Score:2)
Re: (Score:1)
independent contractors who come and go and utilize our network. The problem
is frequently the children of these users who use the parents work machines to
do homework, surf game sites or even the adults who use it to surf gambling
and adult entertainment sites. It is their equipment but we allow it on our
network. We lock some things down, but it is still the persons personal
property. An unusual situation I admit.
maybe (Score:2, Insightful)
ExxonMobile (Score:5, Funny)
This is no spam, this is an actual stock push you insensitive clod!
Re: (Score:1, Offtopic)
Big surprise (Score:2, Flamebait)
Perhaps computers meant to be used as email appliances should really be email appliances rather than general purpose programmable (and repurposeable) computers.
The alternative to this is to figure out a way to make sure that it is impossible for users to ever install anything on their computer that will compromise it. Soun
Re: (Score:2)
Re: (Score:1)
Ha ha ha, where are the mods on this one?
It sounds just like the engineers' attitude towards the 'musicians' in the music biz; Musicians were these psychos who kept screwing around with the 'source' signal. :=)
Re:Big surprise (Score:5, Interesting)
Food for thought.
Re: (Score:2)
Actually, here's the complementary thought (Score:5, Interesting)
Actually, here's another thought for you: how many got pwned by other means, but are affraid that some "lusers are idiots" type will blame it on porn? I've only skimmed through the thread and I already see two blanket generalizations to the effect that, respectively, (A) infections come from porn surfing, and (B) the user is lying through his teeth if he's saying otherwise.
The fact is, there are so many ways to get pwned today, it's not even funny. Email attachments, trojan programs packed as some cutesy screen server or utility you can download, phishing-like schemes where you're sent to a page chock-full of IE exploits, warez sites (tend to be worse than porn as infection risk goes), spyware serving ads with exploits in them, or rarely a genuine site or ad provider getting pwned and helping spread exploits (don't assume that _only_ spam zombies can possibly ever get installed when security is breached), etc.
Yes, you can say that they should have known better, but it's still not porn. And it sometimes comes with the endorsement, real or faked by a trojan who took over a friend's address book, of someone they know. E.g., every company has a wiseguy or two setting up some jokes mailing list and forwarding there anything he receives, indiscriminately, including links to other sites. And by indiscriminately, I mean here one even managed to forward a couple of business emails to that list.
Then there are malicious insider jobs. There are cases of sheer idiocy on the part of some techie or programmer or PHB. (You can occasionally read advice even on
Re:Actually, here's the complementary thought (Score:5, Insightful)
It's very hard to maintain an open attitude when working in IT. Especially when you're doing Internal IT only (i mostly work for our customers, and do our internal IT as a side job).
People fuck up, and are afraid of the consequences when they fucked up - thus they will try to find something else to blame.
IT People fuck up too, and are afraid of the consequences when they fucked up - thus they try to find someone else to blame.
The consequences are that Users and IT People don't trust each other. And this is bad, very bad.
IT is something to make your users more productive, and help them to get their work done faster. A restrictive policy usually won't help you with that. My company has a very open IT policy - and i think it helps with both morale and problem resolution.
We even allow our employees to plug their own laptops into the company network. Yes, it's risky. But the problems incurred and benefits reaped are a better than properly securing this (e.G. buying 802.1x switches and segmenting clients into VLANs according to their identification).
Remember - IT is an internal service to make the company work better. IT is not an end, it's a means to achieve an end faster. You as an IT guy should think about "how do we get our employees to be more productive" and not "how do we restrict them as much as possible so that i can sit around and read dilbert all day long".
No objections (Score:2)
Re: (Score:1)
I never had issues with file sharing programs.
I did have a bandwidth hogging issue though, with Zattoo [zattoo.com] (a legal P2P TV application). During major sport events, our internet broke down. I sent an email that zattoo shouldn't be used by multiple people at once, a
Re: (Score:2)
Make them pay! (Score:2, Interesting)
Re: (Score:1)
Re: (Score:1, Flamebait)
Re: (Score:2)
http://www.microsoft.com/downloads/details.aspx?Fa milyID=d39d0028-7093-495c-80da-2b5b29a54bd8&Displa yLang=en [microsoft.com]
If you do it right once, then ghost it, you can make as many secure PCs as you need.
Admins who don't secure corporate PCs are just lazy, stupid or both...
Little problem.. (Score:2)
You're assuming two things here which aren't always true in corporate life:
1. Admins have control over all the machines on their network. That's a good theory, but even in the story above you'll find the problem to be unauthorised connections. In well managed setups that won't happen often, but it only takes one idiot to make a mess. Worse, sometimes you have an embedded system that is overlooked. Photocopiers, phone
I guess (Score:2, Funny)
These same guys INVENTED spam.. (Score:2, Insightful)
Reminds me of when I first started my current job, (Score:5, Interesting)
My 2nd day was interesting, when I first turned on the computer. EVERYONE who had the Norton running detected all sorts of network worms and virusiis's (:P) the second I'd booted into Win XP. I thought,
"Oh crap, here we go. Time to clean up this mess..."
and began a search for *.jpg. Kapow, tonnes of hairy pr0n, selected all and shift deleted.
Next, it was time to install the company antivirus software, which was Norton. The next couple of days were spent trying to free my infected system of all sorts of goodies. I started by enabling the Norton Mail Monitor, and oh my, how funny!
"Scanning out going mail, Scanning out go-Scanning out going mai-Scaning out g-Scan"
The WHOLE screen filled up with Norton "scanning out going mail" boxes, like, 100's of them. This was my first job outside of the IT industry, and a big WELCOME TO THE REAL WORLD for me. So yes, what's the point of my story? Well, Russian brides are hairy. OH, and not all companies have IT departments, let alone competent IT staff who can source and cease zombie machines from operating.
Re:Reminds me of when I first started my current j (Score:2)
Re: (Score:2)
I bet most companies under 30 employees don't have a dedicated IT person, just someone who's job got made to include IT (if even that).
9 times out of 10, they either get consultants to cover the stuff they can't
Re:Reminds me of when I first started my current j (Score:2)
At least that way there's no niggling question lurking in the back of your mind "Have we got everything? Or is there still some random trojan on there?"
Re: (Score:1)
There are still thousands of companies out there in manufacturing and mining industries that have been doing what they've been doing for the past 50-100 years. For such workplaces, a lot of them wing it when it comes to I
(contractor at one of its power generator plants) (Score:2, Funny)
Good bye erection dysfunction (Score:4, Funny)
Corrupt [corrupt.org]
Re: (Score:1)
Maybe it's time (Score:2, Interesting)
Re: (Score:2)
Maybe it's time for individuals and corporations to be held libel for what their computers spew. Got a botnet sending phishing emails from your business? Boom, big fine. Got an infected home machine sending out spam? Boom, a somewhat smaller fine.
That would be awful. When somebody gets shot with a stolen gun, you don't go after the person the gun was stolen from; you go after the person who actually did the shooting. Same thing - you need to go after the people causing the infections.
The infection rate in my company's machines is about 1/3rd the national average, but it's still as many as 50 infections a year. How much was that fine? Because I don't know that we could afford it. And of the infections I handle, most of them are by kiddiez r
Re: (Score:2)
Sure, because look at how well putative penalties for other crimes have worked at reducing the crime rate.
For example North Dakota has one of the lowest homicide rates in the U.S., and no death penalty, ever. Texas has amongst the highest homicide rates, and the death penalty not only exists, it is fairly routinely applied.
Anyone who was se
Re: (Score:2)
North Dakota:
Population Ranked 48th
- Total (2000) 642,200
- Density 9.30/sq mi
3.592/km (47th)
Texas:
Population Ranked 2nd
- Total (2000) 20,851,820
- Density 79.6/sq mi
30.75/km (28th)
You've got 32x the population and almost 9x the population density. Now math is not my strong point but I'm guessing Texas has more stupid assholes per square mile that North Dakota every wi
Re: (Score:1)
Is the corporation centralized? (Score:3, Insightful)
1 - Is the entire corporation's IT department centralized? HP is a F1000 company - is HP and Compaq's computer networks fully merged? Or for Citigroup, is the old Citicorp network fully merged with the Travelers network? Or were Travelers Salomon Brothers and Smith Barney networks merged before that? And so forth. Wal-Mart's corporate network is probably standardized, but a lot of companies are the resut of many mergers over the years. Or some companies are just of a type where different divisions are very different so there is no or not much centralized corporate IT.
2 - Does the corporation have a global network? Global multi-national corporations have computers all over the world, and it can be hard to have a standard network in New York, Tokyo and London (etc.) New York and Tokyo may be solid, but London may be open to problems etc.
Re: (Score:1)
Which brings up the point, pure speculation but it would seem that valid lists are becoming more valuable. The public's general awareness to not leave their address lying around has probably hurt the scrapers to some degree. Along with the rise of sneak
When I grow up (Score:1)
Interesting.... (Score:1)
in many different locations (I'm literally in a different office every day of the
work week) and people being allowed to have their own equipment on the network
with only Symantec corporate edition between them and the network it's a strange
experiment. The vast majority of infections I see coming onto our network is
from people surfing....unsavory sites....from home in their off hours.
But I wonder if this particular revelation wil
Mod title -1 Troll (Score:1)