RE: NDR quandry
google BATV ~JasonG -Original Message- From: Cameron [mailto:cameron.orl...@gmail.com] Sent: Monday, July 04, 2011 11:57 To: MS-Exchange Admin Issues Subject: NDR quandry Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt- software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: NDR quandry
Would there be anything in the email header which may make the NDR's unique? You might be able to generate a rule based on the that unique info. From: Cameron [mailto:cameron.orl...@gmail.com] Sent: July-04-11 11:57 AM To: MS-Exchange Admin Issues Subject: NDR quandry Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Re: NDR quandry
We had a user that this was happeing to. We had the user change her password. She had responded to a spam email and sent them her username and password. - Original Message - From: Scott Schneider sschnei...@inscapesolutions.com To: MS-Exchange Admin Issues exchangelist@lyris.sunbelt-software.com Sent: Monday, July 4, 2011 12:08:33 PM Subject: RE: NDR quandry Would there be anything in the email header which may make the NDR’s unique? You might be able to generate a rule based on the that unique info. From: Cameron [mailto:cameron.orl...@gmail.com] Sent: July-04-11 11:57 AM To: MS-Exchange Admin Issues Subject: NDR quandry Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Re: NDR quandry
We had a user that this was happeing to. We had the user change her password. She had responded to a spam email and sent them her username and password. - Original Message - From: Scott Schneider sschnei...@inscapesolutions.com To: MS-Exchange Admin Issues exchangelist@lyris.sunbelt-software.com Sent: Monday, July 4, 2011 12:08:33 PM Subject: RE: NDR quandry Would there be anything in the email header which may make the NDR’s unique? You might be able to generate a rule based on the that unique info. From: Cameron [mailto:cameron.orl...@gmail.com] Sent: July-04-11 11:57 AM To: MS-Exchange Admin Issues Subject: NDR quandry Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Re: NDR quandry
See this article: http://en.wikipedia.org/wiki/Joe_job There are some other articles, including this one: http://taint.org/2007/01/10/141434a.html that might give you some ideas. But, basically, you're stuck, because what's happening is pretty much outside your control. For more research material, google for joe job and backscatter. Kurt On Mon, Jul 4, 2011 at 08:56, Cameron cameron.orl...@gmail.com wrote: Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Re: NDR quandry
Thanks for the responses. Seems I'm going to have to set some sort of a filter then. From the reading (thanks for the links) it seems that it's mostly caused by mail systems that are not correctly setup. Fun fun. On Mon, Jul 4, 2011 at 2:06 PM, Kurt Buff kurt.b...@gmail.com wrote: See this article: http://en.wikipedia.org/wiki/Joe_job There are some other articles, including this one: http://taint.org/2007/01/10/141434a.html that might give you some ideas. But, basically, you're stuck, because what's happening is pretty much outside your control. For more research material, google for joe job and backscatter. Kurt On Mon, Jul 4, 2011 at 08:56, Cameron cameron.orl...@gmail.com wrote: Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Re: NDR quandry
I had the user do this just in case. Apparently this has been happening to him for a year, but of course didn't bother saying anything (I'm pretty sure the password thing wouldn't apply because he is forced to change it every 3 months...and no, he can't use the same one). Cheers! On Mon, Jul 4, 2011 at 1:20 PM, bzalew...@comcast.net wrote: We had a user that this was happeing to. We had the user change her password. She had responded to a spam email and sent them her username and password. -- *From: *Scott Schneider sschnei...@inscapesolutions.com *To: *MS-Exchange Admin Issues exchangelist@lyris.sunbelt-software.com *Sent: *Monday, July 4, 2011 12:08:33 PM *Subject: *RE: NDR quandry Would there be anything in the email header which may make the NDR’s unique? You might be able to generate a rule based on the that unique info. *From:* Cameron [mailto:cameron.orl...@gmail.com] *Sent:* July-04-11 11:57 AM *To:* MS-Exchange Admin Issues *Subject:* NDR quandry Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: NDR quandry
That's what happens when the powers that be have no technical hands on skill, they're the ones who hire in the consultants, they don't allow enough time for testing, and the consultant is half empty. From: Cameron [mailto:cameron.orl...@gmail.com] Sent: Monday, July 04, 2011 4:54 PM To: MS-Exchange Admin Issues Subject: Re: NDR quandry Thanks for the responses. Seems I'm going to have to set some sort of a filter then. From the reading (thanks for the links) it seems that it's mostly caused by mail systems that are not correctly setup. Fun fun. On Mon, Jul 4, 2011 at 2:06 PM, Kurt Buff kurt.b...@gmail.com wrote: See this article: http://en.wikipedia.org/wiki/Joe_job There are some other articles, including this one: http://taint.org/2007/01/10/141434a.html that might give you some ideas. But, basically, you're stuck, because what's happening is pretty much outside your control. For more research material, google for joe job and backscatter. Kurt On Mon, Jul 4, 2011 at 08:56, Cameron cameron.orl...@gmail.com wrote: Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: NDR quandry
Not to jack your thread, but we just had the same thing happen to us. We were getting crushed with bum NDR messages coming from yahoo.com.tw. They have stopped now, but we can no longer send email to legit Yahoo accounts. Trying to work with Yahoo to get it fixed, but its like pulling teeth. L From: Orland, Kathleen [mailto:korl...@rogers.com] Sent: Monday, July 04, 2011 5:18 PM To: MS-Exchange Admin Issues Subject: RE: NDR quandry That's what happens when the powers that be have no technical hands on skill, they're the ones who hire in the consultants, they don't allow enough time for testing, and the consultant is half empty. From: Cameron [mailto:cameron.orl...@gmail.com] Sent: Monday, July 04, 2011 4:54 PM To: MS-Exchange Admin Issues Subject: Re: NDR quandry Thanks for the responses. Seems I'm going to have to set some sort of a filter then. From the reading (thanks for the links) it seems that it's mostly caused by mail systems that are not correctly setup. Fun fun. On Mon, Jul 4, 2011 at 2:06 PM, Kurt Buff kurt.b...@gmail.com wrote: See this article: http://en.wikipedia.org/wiki/Joe_job There are some other articles, including this one: http://taint.org/2007/01/10/141434a.html that might give you some ideas. But, basically, you're stuck, because what's happening is pretty much outside your control. For more research material, google for joe job and backscatter. Kurt On Mon, Jul 4, 2011 at 08:56, Cameron cameron.orl...@gmail.com wrote: Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist This email and any attached files are confidential and intended solely for the intended recipient(s). If you are not the named recipient you should not read, distribute, copy or alter this email. Any views or opinions expressed in this email are those of the author and do not represent those of the company. Warning: Although precautions have been taken to make sure no viruses are present in this email, the company cannot accept responsibility for any loss or damage that arise from the use of this email or attachments. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Re: NDR quandry
It happened to my place of work twice in two years, about 5 years ago. It's annoying at the least, and if the spammer is truly dedicated and has lots of resources it can be overwhelming for a small environment - they can have an enormous run of spam from bots that spoof your domain as the sender. The misconfigured systems are the ones that accept email for non-existent accounts, then figure out that the recipient doesn't exist, then try to send an NDR. What should happen instead is that the recipients should be known to the receiving system, and anything addressed to non-existent recipients should immediately generate a 5xx response, and a termination of the conversation. Kurt On Mon, Jul 4, 2011 at 13:54, Cameron cameron.orl...@gmail.com wrote: Thanks for the responses. Seems I'm going to have to set some sort of a filter then. From the reading (thanks for the links) it seems that it's mostly caused by mail systems that are not correctly setup. Fun fun. On Mon, Jul 4, 2011 at 2:06 PM, Kurt Buff kurt.b...@gmail.com wrote: See this article: http://en.wikipedia.org/wiki/Joe_job There are some other articles, including this one: http://taint.org/2007/01/10/141434a.html that might give you some ideas. But, basically, you're stuck, because what's happening is pretty much outside your control. For more research material, google for joe job and backscatter. Kurt On Mon, Jul 4, 2011 at 08:56, Cameron cameron.orl...@gmail.com wrote: Happy 4th to the Americans! I have a user that is getting bombed by NDR's that are not originating from him. It seems that he's the lucky recipient of some spammer using his account as a sent from address. Is there any way to stop this or is he stuck with it? Exchange 2010, Outlook 2007 Thanks as always! Cameron --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
