Slashdot Mirror
Mail Server Flaw Opens MS Exchange to Spam
bl8n8r writes: "
Exchange 5.5 and 2000 can be used by spammers to send anonymous e-mail. He says even though software Microsoft provides on its site certifies that the server is secure, it's not.
There are dozens of messages--with subject lines such as 'Open relay problem' and 'We are sending spam?'--on Microsoft's Exchange Administration newsgroup, sent by information system managers who haven't been able to staunch the flow of spam from their servers. 'It is really inexcusable for a company that claims security is its top priority,' he said." If you are using vulnerable versions of Exchange, and have been hit by a Code Red variant, you may want to insure your 'guest' accounts are still disabled.
I did read the article and am fully aware of it's implications. However... SHUT UP... I'm trying to get them to upgrade! :)
SHHHH
Now if only we could EMP spambots.
Well, with Microsoft, there seems to be no way to ensure that you won't get screwed, so you had better start insuring yourself against getting screwed.
Insure is also a verb! I insure, you insure, we all insure to ensure financial security.
actually, given the track record of sendmail on the security front i think i'm just going to keep quiet about this one....
2 1337 4 u!
It's not just Microsoft who forces you to upgrade, everyone does. The difference is Microsoft charges you for it.
Wow.
Is that the Engrish version of AOHELL you're using?
Not only did you get the quote wrong four times, but it's not even a quote from Microsoft software!
But the name is listed in /etc/passwd, which is world-readable. How does this help you?
What, you've never heard of security through hubris? Its identical to security through obscurity in all respects, apart from the fact that implementer has to regard himself/herself as a 1337 h4x0r.
Tubal-Cain smokes the white owl.
/. people should know better than most that you can't retroactively flip a security bit and make past mistakes better...
;-)
Au contraire...
RFC 3514 -- Security Flag in the IPv4 Header
You may not be able to flip a bit, but you can always just detect one.
> Is microsoft indemnifying its customers against problems like this? I know that indemnity has been a big keyword of theirs lately and I'd just like to be certain that I can get indemnified if something like this happens. I mean, that's the advantage of going with a big, closed source company right? It's the indemnity.
Yes, they agree to only charge you one license for the unauthorized use of 'guest', no matter how many spammers are actually using it.
They also agree to send someone to show your PHB some overdecorated ppt slides about how secure their software is, if incidents like this have him thinking about switching to another software supplier.
Sheesh, evil *and* a jerk. -- Jade
No, it's turned off by default
OK, I eventually got that for most people, it was probably turned on by a Code Red infection.
I'm still curious about what potential purpose such an account would serve though? Is it necessary for internal housekeeping or something?
which you would know if you had bothered to read more than the one comment you were replying to
What, you mean that as well as R'ing the F'ing A, I'm also obliged to R *all* the F'ing C's as well?
You are joking, right?
What would an ensurance company do? Ensure things presumably...
"And what if a fire breaks out at our warehouse?"
"Don't worry, sir, we can make that happen next week."
"Exchange admins" ?
ugh? There are actually people who have this title and like get paid for it?
What's the job description?
"
Must have somewhat memorized a bunch of (exchange) gui screens and know how to click mouse. Token certificate of some type or online degrees from "accredited" universities are nice and make the HR people we employ titter. Good with microsoft wizards and skill with pleasing buzzwords preferred. Must not laugh when manager says things "Tiger Team meeting", "Warm fuzzy around the problem", "Have a dialog" or the like.
"
But wait that's pretty much the job description for 95% of all Microsoft jobs
What would the GNU equiv be?
"
Must know how to administer all services on typical *nix box from command line, know C, vi, have GNU beard, and actually be prepared to do some work.
"
dunno
"No, it's turned off by default"
OK, I eventually got that for most people, it was probably turned on by a Code Red infection.
I'm still curious about what potential purpose such an account would serve though? Is it necessary for internal housekeeping or something?
"which you would know if you had bothered to read more than the one comment you were replying to"
What, you mean that as well as R'ing the F'ing A, I'm also obliged to R *all* the F'ing C's as well?
You are joking, right?
Nope, to earn the right to post on Slashdot, you must read every comment, the whole article and all the links. Then you should read the man pages for every *NIX, the whole of Microsoft Technet, and all of the RFC's. That done, you may return to post. What you say?! Discussion archived? Oh well, reading all that will be much better than Slashdot, and you'll probably outgrow posting here by then, too. :)
No, but I've typed 'Administraitor' before... :)