[LI] IIT-Madras mailserver running Linux hijacked by spammers [(Fwd) Spam: It's Thanksgiving - ]

["Suresh Ramasubramanian" <Suresh@xxxxxxxxxxx>]

Folks

This is a security alert.  IIT-Madras has a server called 
cello.cs.iitm.ernet.in running red hat 5.0 and an old version of 
sendmail.  This is an open relay which has been abused by a 
spammer.

Could someone in Madras contact IIT-M and help them?  Tell them 
to update to rh 6.1 and REBUILD sendmail.cf (or update won't be of 
any use) - just a favor.

Also, those of you still running old versions of sendmail, please 
update to 8.9.3 ASAP.

Meanwhile - as there are people from TIFR reading this, will 
someone please pass my congratulations to the TIFR sysadmin for 
upgrading his sendmail (after a bad spam attack which caused their 
servers to go down for some time)?  

ncra.tifr.res.in is now a secured relay and hence I got it removed 
from the MAPS RSS blacklist (of open relays which have transmitted 
spam).  See http://maps.vix.com/rss for more details.

Suresh Ramasubramanian, CAUCE India
Suresh@xxxxxxxxxxxxxxx | Suresh@xxxxxxxxxxx
Stop Spam | Join CAUCE | http://www.cauce.org
Phone: +(91-40)3736553/3745398 | eFax: +(1-603)590-5437

------- Forwarded message follows -------

Exodus: The web server, 216.34.29.23 is in the mail-abuse.org Real
Time Blackhole.

http://%33%32%32%32%33%35%35%32%33@3626114327/%74%
61%70%69%6F%63%61/

is:

http://216.34.29.23/tapioca/

Yahoo: I don't know if this "formmail" is really "formmail" but it
looks like it MIGHT be sending this page to:
"eatratshit_2000@xxxxxxxxx". I suspect that's a scam.

Suresh: If you have contacts, could you help get this relay closed?

>Return-Path: <bobren99_1999@xxxxxxxxx>
>Received: from cello.cs.iitm.ernet.in ([202.141.24.3])
>	by mail06.dfw.mindspring.net (Mindspring/Netcom Mail Service) with
>SMTP id s3u0f8.edf.33qs88a 	Fri, 26 Nov 1999 16:55:33 -0500 (EST)
>Received: from b41JXY6Mf (1Cust183.tnt35.sfo3.da.uu.net
>[63.16.127.183]) by cello.cs.iitm.ernet.in (8.8.7/8.6.9) with SMTP id
>DAA10802; Sat, 27 Nov 1999 03:00:04 +0530 From:
>bobren99_1999@xxxxxxxxx Message-Id:
><199911262130.DAA10802@xxxxxxxxxxxxxxxxxxxxxx> DATE: 26 Nov 99
>1:52:34 PM Reply-to: bobren99_1999@xxxxxxxxx TO:
>bobren99_1999@xxxxxxxxx SUBJECT: It's Thanksgiving - You STILL can't
>pay Your Bills??
>
>
>Debt Consolidation and Total Payment Reduction!
>
>Our Non-Profit Organization Provides
>FREE Professional Help and Relief From Too Much Debt.
>
>We provide FREE Professional Help To Instantly Reduce
>Your Interest Rates and Minimum Payments.
>
>We Can :
>Lower your monthly payments by 40-60%.  
>Consolidate your bills into One Low monthly payment. 
>And we can Cut your bills in half. 
>
>CLICK BELOW FOR FREE INFORMATION - NO OBLIGATION NO FEE!
>
>http://%33%32%32%32%33%35%35%32%33@3626114327/%74%61%70%69%6F%63%61/



------- End of forwarded message -------


--------------------------------------------------------------------
The Linux India Mailing List Archives are now available.  Please search
the archive at http://lists.linux-india.org/ before posting your question
to avoid repetition and save bandwidth.