We were just slammed by a "formmail" spammer. While the exploit is well known by now, I would like to give everyone the details of our case with the hope that it may save someone else the trouble that we went through.

On October 24, 2002 at 07:07:08 EST, a person or persons acquired an account with our company and immediately began sending what appears to be thousands of un-solicited e-mail through our system. When we noticed a sharp rise in server activity we traced it back to the account and disabled it.

We immediately backed up the account directories and files as evidence. This is what we found.

The person/persons uploaded 200 copies of a hacked "Formmail" script, (10 folders containing 20 scripts each), into the cgi-bin folder. Each script was loaded with up to 1000 e-mail addresses. Each e-mail was an advertisement for Search Engine Optimization, and each contained a link to the same "IP" address where a response form soliciting personal information was found. The filename of this form is form_s.html.

We contacted the ISP whos "IP" block contained the "IP" number found in the hacked "Formmail" scripts. The fear of being sued kept them pretty tight lipped. All we learned was that the "IP" number belonged to a dedicated server which was hosting virtual domains.

Judging by what I have discovered, this person/persons practice this using a hit-and-run tactic. It appears that any ISP is a potential target, with each execution usually involving multiple ISP's.

The one key may be in the form_s.html page which is used to gather personal data. In our case we noticed that the form may have been accessed from the root web directory of a dedicated server, and not from a virtual domain, as was suggested to us.

I would recommend that all of us, as web hosts, be extra careful when taking on new clients.

And if anyone locates a single page file called form_s.html, please save a copy of it before it gets deleted and e-mail it to me.

Thanks Everybody!

I would just like to say that we also got hit by a similar attack about 1 week ago. Actually, what rjbutler describes pretty much describes our attack exactly the way it occured, so I would not be surprised if this person is targeting hosts that post on these boards.

Anyway, not much you can do about it except keep a close eye on your servers. :)

Hello rjbutler

Same here on the 23rd of October, a client signed up with us and immediately started sending thousands of mails through our servers, although we could not catch him immediately, but in the span of 3 hours he managed to send mails in thousnads.

I could think of noting else but to immediately delete his account. hence i dont have the fies backed up or what exploit he used,

Thank god, we managed to keep our servers at the datacenter, they gave us a warning and excused us for the first time.

Hence since then i m looking forward to some kind of a solution, where by we could limit any Client/Domain from sending 'X' amount of Emails in an hour or day or what ever ...

by the way what mail server r u using, coz i m using EXIM. and still looking for a solution.. CAN ANE ONE HEAR ME ..?????


Thanks/-

We're using Sendmail/Qmail under Plesk. They have never been a problem. We set up an account for someone who's credentials seemed to check out. They launched their exploit from their cgi-bin. The easy part was finding the account and shutting it down.
The hardest part was and is the investigation. We have date/time stamps, trace-routes, IP numbers and the ISP's that the IP numbers belong to. What's missing? The cooperation!
The ISP in NJ whose server played a substantial role refused to volunteer any information that may have helped us find the culprit. I have a feeling that if we, as ISPs, cooperated a little bit more in the area of exposing spammers we might all be better off.

Sad experience, and totally true about the lack of cooperation. We had the same problem with a slightly different case, because the formmail used to send spam was that of a client unaware of it - but they had a poorly designed site that had an old formmail with a security breach in it - ie you could send spam direcly with clientdomain/cgi-bin/formmail?from=blahblah&tolist="/dir/list.txt, etc, you get the picture.
The host where the target of the ad was never helped at all, ?ù! bast!?rd ! :D
Believe it or not, we had cases of Credit card fraud with the IP address of the culprit, and their ISP replied that if that user continued to not respect their TOS they might get their account suspended !! Credit card fraud is a felony that can land you in jail here in Europe - same in the US, and all they said was that they might warn them and suspend their connection account !
I wish there was a chart or deontology between Hosting providers, assuring cooperation and mutual help - Where is it, where do we sign ?
:D

We had the same problem with matts version....we now have all formmail using the secure version from;

http://nms-cgi.sourceforge.net/

This is a very secure script and no longer have spammers highjacking domains.