With all due respect to Her Foofy Majesty, any of you who aren't mailing in plain text are Providers of Foof to us text/text digest subscribers. Including the person who complained about it (monster disclaimer, non-edited post, and all - oy). It all shows up as markup code after the message.
I have mailbox limits so have to forward the digest to myself and edit the foof out. Sample (minus some headers so you see what it looks like) at the end of the message. (apologies to text subscribers) So please, spare a thought for the eyeballs of the text subscribers too ;-). thanks, Charlotte ---------------------------------------------------- Subject: RE: Exchange 5.5 server HACKED! From: "Abercrombie, Sherry" <[EMAIL PROTECTED]> Date: Wed, 17 Jul 2002 09:04:08 -0500 X-Message-Number: 14 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C22D9A.D1B1D020 Content-Type: text/plain Okay, I'll have to accept the label of "Foof Queen". Well at least I have some "official" letters to put behind my name now....... Sherry Abercrombie - FQ Data Center Administration Team Information Technology "With sufficient thrust, pigs fly just fine." -----Original Message----- From: Jeremiah Watson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 16, 2002 10:54 AM To: MS-Exchange Admin Issues Subject: RE: Exchange 5.5 server HACKED! That is Insolence. We have all come to respect each other and abuse is part of that. Ask the Foof Queen from yesterday. ;-) -----Original Message----- (rest of text message snipped) <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 5.5.2653.12"> <P><FONT SIZE=3D2>Okay, I'll have to accept the label of "Foof = Queen". Well at least I have some "official" = letters to put behind my name now....... </FONT></P> <P><FONT SIZE=3D2>Sherry Abercrombie - FQ</FONT> <BR><FONT SIZE=3D2>Data Center Administration Team</FONT> <BR><FONT SIZE=3D2>Information Technology</FONT> <BR><FONT SIZE=3D2>"With sufficient thrust, pigs fly just = fine."</FONT> </P> <P><FONT SIZE=3D2>-----Original Message-----</FONT> <BR><FONT SIZE=3D2>From: Jeremiah Watson [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]</A>= ] </FONT> <BR><FONT SIZE=3D2>Sent: Tuesday, July 16, 2002 10:54 AM</FONT> <BR><FONT SIZE=3D2>To: MS-Exchange Admin Issues</FONT> <BR><FONT SIZE=3D2>Subject: RE: Exchange 5.5 server HACKED!</FONT> </P> <BR> <P><FONT SIZE=3D2>That is Insolence. We have all come to respect each = other and abuse is part of that. Ask the Foof Queen from = yesterday. ;-)</FONT></P> <P><FONT SIZE=3D2>-----Original Message-----</FONT> <BR><FONT SIZE=3D2>From: Tom Meunier [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:Tom.Meunier@courts= .state.tx.us</A>]</FONT> <BR><FONT SIZE=3D2>Sent: Tuesday, July 16, 2002 11:51 AM</FONT> <BR><FONT SIZE=3D2>To: MS-Exchange Admin Issues</FONT> <BR><FONT SIZE=3D2>Subject: RE: Exchange 5.5 server HACKED!</FONT> </P> <BR> <P><FONT SIZE=3D2>Why would I do that? I'd like you to use your = knowledge to assist new users, rather than call them trolls or put in a = cryptic message about "it's been two weeks". I don't = care whether you're happy or sad about it. I'm new here, and I = didn't know that part of the list charter was to denigrate = less-experienced admins rather than answer their question.</FONT></P> <BR> <BR> <P><FONT SIZE=3D2>> -----Original Message-----</FONT> <BR><FONT SIZE=3D2>> From: Matthew Carpenter [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]</A>]</F= ONT> <BR><FONT SIZE=3D2>> Sent: Tuesday, July 16, 2002 10:46 AM</FONT> <BR><FONT SIZE=3D2>> To: MS-Exchange Admin Issues</FONT> <BR><FONT SIZE=3D2>> Subject: Re: Exchange 5.5 server HACKED!</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> That is not nice Don.</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> If he is trying to make me feel bad....he = failed.</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> ----- Original Message -----</FONT> <BR><FONT SIZE=3D2>> From: "Ely, Don" = <[EMAIL PROTECTED]></FONT> <BR><FONT SIZE=3D2>> To: "MS-Exchange Admin Issues" = </FONT> <BR><FONT SIZE=3D2>> = <[EMAIL PROTECTED]></FONT> <BR><FONT SIZE=3D2>> Sent: Tuesday, July 16, 2002 10:21 AM</FONT> <BR><FONT SIZE=3D2>> Subject: RE: Exchange 5.5 server HACKED!</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> Figures!</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> -----Original Message-----</FONT> <BR><FONT SIZE=3D2>> From: Matthew Carpenter [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]</A>]</F= ONT> <BR><FONT SIZE=3D2>> Sent: Tuesday, July 16, 2002 11:22 AM</FONT> <BR><FONT SIZE=3D2>> To: MS-Exchange Admin Issues</FONT> <BR><FONT SIZE=3D2>> Subject: Re: Exchange 5.5 server HACKED!</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> Sorry, I don't get it</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> ----- Original Message -----</FONT> <BR><FONT SIZE=3D2>> From: "Tom Meunier" = <[EMAIL PROTECTED]></FONT> <BR><FONT SIZE=3D2>> To: "MS-Exchange Admin Issues" = </FONT> <BR><FONT SIZE=3D2>> = <[EMAIL PROTECTED]></FONT> <BR><FONT SIZE=3D2>> Sent: Tuesday, July 16, 2002 10:11 AM</FONT> <BR><FONT SIZE=3D2>> Subject: RE: Exchange 5.5 server HACKED!</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> This is a FAQ, and I'm afraid to post the link = for fear that</FONT> <BR><FONT SIZE=3D2>> Matthew will flame me, and then say "How = about [repost of the </FONT> <BR><FONT SIZE=3D2>> FAQ link that I had just posted]?".</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> I'll look at your logs, since that's NOT a = FAQ.</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> > -----Original Message-----</FONT> <BR><FONT SIZE=3D2>> > From: Dan Schwartz [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]</A>]</FONT> <BR><FONT SIZE=3D2>> > Sent: Tuesday, July 16, 2002 09:55 = AM</FONT> <BR><FONT SIZE=3D2>> > To: MS-Exchange Admin Issues</FONT> <BR><FONT SIZE=3D2>> > Subject: RE: Exchange 5.5 server = HACKED!</FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > OK, does anyone have a list of the ports = Exchange 5.5</FONT> <BR><FONT SIZE=3D2>> > uses, besides 25 & 110?</FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > Also, if anyone wants to look at the Event = Logs, simply click on:</FONT> <BR><FONT SIZE=3D2>> > <<A = HREF=3D"http://www.rogue-admins.com/dansworld/Exchange_Attack_App_Eve"; = TARGET=3D"_blank">http://www.rogue-admins.com/dansworld/Exchange_Attack_= App_Eve</A></FONT> <BR><FONT SIZE=3D2>> > ntlog.zip></FONT> <BR><FONT SIZE=3D2>> > [This is a new link & new file from = the one previously </FONT> <BR><FONT SIZE=3D2>> posted by me.]</FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > Cheers!</FONT> <BR><FONT SIZE=3D2>> > Dan</FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > "There are two major products that = come out of Berkeley:</FONT> <BR><FONT SIZE=3D2>> LSD and UNIX.</FONT> <BR><FONT SIZE=3D2>> > We don't believe this to be a = coincidence." (Jeremy S. Anderson)</FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > >-----Original Message-----</FONT> <BR><FONT SIZE=3D2>> > >From: Ely, Don [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]</= A>]</FONT> <BR><FONT SIZE=3D2>> > >Sent: Tuesday, July 16, 2002 9:36 = AM</FONT> <BR><FONT SIZE=3D2>> > >Subject: RE: Exchange 5.5 server = HACKED!</FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > >Uhhhh... Telneting to the server = alone does NOT mean the</FONT> <BR><FONT SIZE=3D2>> > server is an</FONT> <BR><FONT SIZE=3D2>> > >open relay... I can telnet port = 25 to any server in the</FONT> <BR><FONT SIZE=3D2>> world, that</FONT> <BR><FONT SIZE=3D2>> > >doesn't mean I can relay = mail...</FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > >-----Original Message-----</FONT> <BR><FONT SIZE=3D2>> > >From: Joe Irvine [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]</A>= ]</FONT> <BR><FONT SIZE=3D2>> > >Sent: Tuesday, July 16, 2002 9:38 = AM</FONT> <BR><FONT SIZE=3D2>> > >Subject: RE: Exchange 5.5 server = HACKED!</FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > >Actually, no.. if you can telnet to = the mail server you can</FONT> <BR><FONT SIZE=3D2>> > relay. No</FONT> <BR><FONT SIZE=3D2>> > >hacking needed. This is by the very = nature of exchange. I would</FONT> <BR><FONT SIZE=3D2>> > >recommend looking at not allowing = characters like %$! Through your </FONT> <BR><FONT SIZE=3D2>> > >firewall. Here's a link to check to = see if you have an open relay..</FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > ><A = HREF=3D"http://www.abuse.net/relay.html"; = TARGET=3D"_blank">http://www.abuse.net/relay.html</A></FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > >Thanks,</FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > >Joe Irvine</FONT> <BR><FONT SIZE=3D2>> > > -----Original Message-----</FONT> <BR><FONT SIZE=3D2>> > >From: Dan Schwartz [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]</A>]</FONT> <BR><FONT SIZE=3D2>> > >Sent: Tuesday, July 16, 2002 9:30 = AM</FONT> <BR><FONT SIZE=3D2>> > >To: MS-Exchange Admin Issues</FONT> <BR><FONT SIZE=3D2>> > >Subject: RE: Exchange 5.5 server = HACKED!</FONT> <BR><FONT SIZE=3D2>> > >Importance: Low</FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > > Look at the 4031 error messages, = which indicate SOMEONE</FONT> <BR><FONT SIZE=3D2>> > is trying to</FONT> <BR><FONT SIZE=3D2>> > >relay through the server, and since = unauthorized relaying is</FONT> <BR><FONT SIZE=3D2>> > prohibited</FONT> <BR><FONT SIZE=3D2>> > >that tells me someone has hacked = in.</FONT> <BR><FONT SIZE=3D2>> > ></FONT> <BR><FONT SIZE=3D2>> > >>-----Original Message-----</FONT> <BR><FONT SIZE=3D2>> > >>From: William Lefkovics [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]= rg</A>]</FONT> <BR><FONT SIZE=3D2>> > >>Sent: Tuesday, July 16, 2002 1:03 = AM</FONT> <BR><FONT SIZE=3D2>> > >>To: MS-Exchange Admin = Issues</FONT> <BR><FONT SIZE=3D2>> > >>Subject: RE: Exchange 5.5 server = HACKED!</FONT> <BR><FONT SIZE=3D2>> > >></FONT> <BR><FONT SIZE=3D2>> > >></FONT> <BR><FONT SIZE=3D2>> > >>Then it's sorta in production = then, yes?</FONT> <BR><FONT SIZE=3D2>> > >></FONT> <BR><FONT SIZE=3D2>> > >>Was there a concern other than the = 4318's?</FONT> <BR><FONT SIZE=3D2>> > >></FONT> <BR><FONT SIZE=3D2>> > >>-----Original Message-----</FONT> <BR><FONT SIZE=3D2>> > >>From: Dan Schwartz [<A = HREF=3D"mailto:[EMAIL PROTECTED]";>mailto:[EMAIL PROTECTED]</A>]</FONT> <BR><FONT SIZE=3D2>> > >>Sent: Monday, July 15, 2002 9:55 = PM</FONT> <BR><FONT SIZE=3D2>> > >>Subject: RE: Exchange 5.5 server = HACKED!</FONT> <BR><FONT SIZE=3D2>> > >></FONT> <BR><FONT SIZE=3D2>> > >></FONT> <BR><FONT SIZE=3D2>> > >></FONT> <BR><FONT SIZE=3D2>> > >> Yes, it's connected, and the DNS = servers have been</FONT> <BR><FONT SIZE=3D2>> > pointed at it for</FONT> <BR><FONT SIZE=3D2>> > >about a week...</FONT> <BR><FONT SIZE=3D2>> > >></FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > ---</FONT> <BR><FONT SIZE=3D2>> > This attachment has been scanned for = hostile code:</FONT> <BR><FONT SIZE=3D2>> > Checked by AVG anti-virus system (<A = HREF=3D"http://www.grisoft.com"; = TARGET=3D"_blank">http://www.grisoft.com</A>).</FONT> <BR><FONT SIZE=3D2>> > Version: 6.0.377 / Virus Database: 211 - = Release Date: 7/15/2002</FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > List Charter and FAQ at:</FONT> <BR><FONT SIZE=3D2>> > <A HREF=3D"http://www.sunbelt-"; = TARGET=3D"_blank">http://www.sunbelt-</A>> = software.com/exchange_list_charter.htm</FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> > </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> List Charter and FAQ at:</FONT> <BR><FONT SIZE=3D2>> <A HREF=3D"http://www.sunbelt-"; = TARGET=3D"_blank">http://www.sunbelt-</A>> software.com/exchange_list= _charter.htm</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> List Charter and</FONT> <BR><FONT SIZE=3D2>> FAQ at: <A = HREF=3D"http://www.sunbelt-software.com/exchange_list_charter.htm"; = TARGET=3D"_blank">http://www.sunbelt-software.com/exchange_list_charter.= htm</A></FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> List Charter and FAQ at:</FONT> <BR><FONT SIZE=3D2>> <A HREF=3D"http://www.sunbelt-"; = TARGET=3D"_blank">http://www.sunbelt-</A>> = software.com/exchange_list_charter.htm</FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> List Charter and</FONT> <BR><FONT SIZE=3D2>> FAQ at: <A = HREF=3D"http://www.sunbelt-software.com/exchange_list_charter.htm"; = TARGET=3D"_blank">http://www.sunbelt-software.com/exchange_list_charter.= htm</A></FONT> <BR><FONT SIZE=3D2>> </FONT> <BR><FONT SIZE=3D2>> </FONT> </P> <P><FONT SIZE=3D2>List Charter and FAQ at: <A = HREF=3D"http://www.sunbelt-software.com/exchange_list_charter.htm"; = TARGET=3D"_blank">http://www.sunbelt-software.com/exchange_list_charter.= htm</A></FONT> </P> <BR> <P><FONT SIZE=3D2>List Charter and FAQ at: <A = HREF=3D"http://www.sunbelt-software.com/exchange_list_charter.htm"; = TARGET=3D"_blank">http://www.sunbelt-software.com/exchange_list_charter.= List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
