Blocking SMTP Worm

Blocking SMTP Worm

[Juan Carlos Peláez Mendoza]

Hi list,

My IP Address have been listed in the RBL's too many times, I
installed into my linux box MailScanner + Spamassassin + Clamavmodule
+ FProt, I set up the iptables rules allowing only smtp, pop and ssh
traffic, but when I see the traffic with tcpdump I see this strange
behavior:

17:14:42.255867 IP 192.168.0.92.2802 >
Static-IP-cr2001181.cable.net.co.smtp: S 396792405:396792405(0) win
16384 <mss 1460,nop,nop,sackOK>
17:14:43.457612 IP 192.168.0.92.2803 >
Static-IP-cr2001181.cable.net.co.smtp  : S 760094736:760094736(0) win
16384 <mss 1460,nop,nop,sackOK>
17:14:46.512975 IP 192.168.0.92.2804 >
Static-IP-cr2001181.cable.net.co.smtp: S 804817506:804817506(0) win
16384 <mss 1460,nop,nop,sackOK>
17:14:49.466442 IP 192.168.0.92.2804 >
Static-IP-cr2001181.cable.net.co.smtp: S 804817506:804817506(0) win
16384 <mss 1460,nop,nop,sackOK>
17:14:50.118528 IP 192.168.0.92.2805 > mailgw2.diveo.net.co.smtp  : S
2079962326:2079962326(0) win 16384 <mss 1460,nop,nop,sackOK>
17:14:53.071734 IP 192.168.0.92.2805 > mailgw2.diveo.net.co.smtp: S
2079962326:2079962326(0) win 16384 <mss 1460,nop,nop,sackOK>

I see the traffic today and still getting that result after blocking
the traffic for the  192.168.0.92 address:

08:40:10.664379 IP 192.168.0.92.2728 >
emt200-31-197-53.emtelco.com.smtp: S 3599806789:3599806789(0) win
16384 <mss 1460,nop,nop,sackOK>
08:40:16.683771  IP 192.168.0.92.2728 >
emt200-31-197-53.emtelco.com.smtp: S 3599806789:3599806789(0) win
16384 <mss 1460,nop,nop,sackOK>
08:40:20.731636 IP 192.168.0.92.2731 >
bbvaganadero.telefonica.net.co.smtp: S 4026584844:4026584844(0) win
16384 <mss 1460,nop,nop,sackOK>
08:40:23.706369 IP 192.168.0.92.2731 >
bbvaganadero.telefonica.net.co.smtp: S 4026584844:4026584844(0) win
16384 <mss 1460,nop,nop,sackOK>


What can I do to stop and block this worm???

Here are my basic rules for IPtables.


echo 1 > /proc/sys/net/ipv4/ip_forward
iptables --flush
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ip_conntrack_irc

iptables --table nat --flush

  iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

#Blocking  192.168.0.92 SMTP Traffic
 iptables -A FORWARD -p tcp --dport 25 -s 192.168.0.92 -j DROP

iptables -A FORWARD -i eth1 -j ACCEPT

echo "Enrutamiento Activado..."

# Bloqueando ip  218.55.23.50
iptables -A INPUT -s 218.55.23.50 -j DROP

# Bloqueando ip  201.160.33.60
iptables -A INPUT -s  201.160.33.60 -j DROP

iptables -A INPUT -s 192.168.0.92 -j DROP
iptables -A FORWARD -p tcp --dport 25 -j DROP

#Permitir trafico de entrada a puertos SMTP, POP, SSH
 iptables -A INPUT -p tcp --dport 25 -s 192.168.0.0/24 -d PRIVATE_IP -j ACCEPT
iptables -t filter -A INPUT -p tcp -s 0/0 -d  PUBLIC_IP --dport 25 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 25 -s  192.168.0.0/24 -d 0/0 -j DROP
iptables -A INPUT -p tcp -s 0/0 -d   192.168.0.0/24 --sport 25 -i eth0 -j DROP

iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 110 -j ACCEPT
iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 3306 -j REJECT


# Botar paquetes que vayan de la Lan por el puerto 25
iptables -A FORWARD -p tcp --dport 25 -j DROP



Can anybody help me with this???


Thanks,



Juan Carlos Peláez Mendoza

Re: Blocking SMTP Worm

[Gáspár Lajos]

Juan Carlos Peláez Mendoza írta:
> Hi list,
>
> My IP Address have been listed in the RBL's too many times, I
> installed into my linux box MailScanner + Spamassassin + Clamavmodule
> + FProt, I set up the iptables rules allowing only smtp, pop and ssh
> traffic, but when I see the traffic with tcpdump I see this strange
> behavior:
>
> 17:14:42.255867 IP 192.168.0.92.2802 >
> Static-IP-cr2001181.cable.net.co.smtp: S 396792405:396792405(0) win
> 16384 <mss 1460,nop,nop,sackOK>
> 17:14:43.457612 IP 192.168.0.92.2803 >
> Static-IP-cr2001181.cable.net.co.smtp  : S 760094736:760094736(0) win
> 16384 <mss 1460,nop,nop,sackOK>
> 17:14:46.512975 IP 192.168.0.92.2804 >
> Static-IP-cr2001181.cable.net.co.smtp: S 804817506:804817506(0) win
> 16384 <mss 1460,nop,nop,sackOK>
> 17:14:49.466442 IP 192.168.0.92.2804 >
> Static-IP-cr2001181.cable.net.co.smtp: S 804817506:804817506(0) win
> 16384 <mss 1460,nop,nop,sackOK>
> 17:14:50.118528 IP 192.168.0.92.2805 > mailgw2.diveo.net.co.smtp  : S
> 2079962326:2079962326(0) win 16384 <mss 1460,nop,nop,sackOK>
> 17:14:53.071734 IP 192.168.0.92.2805 > mailgw2.diveo.net.co.smtp: S
> 2079962326:2079962326(0) win 16384 <mss 1460,nop,nop,sackOK>
>
> I see the traffic today and still getting that result after blocking
> the traffic for the  192.168.0.92 address:
>
> 08:40:10.664379 IP 192.168.0.92.2728 >
> emt200-31-197-53.emtelco.com.smtp: S 3599806789:3599806789(0) win
> 16384 <mss 1460,nop,nop,sackOK>
> 08:40:16.683771  IP 192.168.0.92.2728 >
> emt200-31-197-53.emtelco.com.smtp: S 3599806789:3599806789(0) win
> 16384 <mss 1460,nop,nop,sackOK>
> 08:40:20.731636 IP 192.168.0.92.2731 >
> bbvaganadero.telefonica.net.co.smtp: S 4026584844:4026584844(0) win
> 16384 <mss 1460,nop,nop,sackOK>
> 08:40:23.706369 IP 192.168.0.92.2731 >
> bbvaganadero.telefonica.net.co.smtp: S 4026584844:4026584844(0) win
> 16384 <mss 1460,nop,nop,sackOK>
>
>
> What can I do to stop and block this worm???
>
> Here are my basic rules for IPtables.
>
>
> echo 1 > /proc/sys/net/ipv4/ip_forward
> iptables --flush
> modprobe ip_conntrack
> modprobe ip_conntrack_ftp
> modprobe ip_nat_ftp
> modprobe ip_conntrack_irc
>
> iptables --table nat --flush
>
>  iptables --table nat --append POSTROUTING --out-interface eth0 -j 
> MASQUERADE
> iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
>
> #Blocking  192.168.0.92 SMTP Traffic
> iptables -A FORWARD -p tcp --dport 25 -s 192.168.0.92 -j DROP
>
> iptables -A FORWARD -i eth1 -j ACCEPT
>
> echo "Enrutamiento Activado..."
>
> # Bloqueando ip  218.55.23.50
> iptables -A INPUT -s 218.55.23.50 -j DROP
>
> # Bloqueando ip  201.160.33.60
> iptables -A INPUT -s  201.160.33.60 -j DROP
>
> iptables -A INPUT -s 192.168.0.92 -j DROP
> iptables -A FORWARD -p tcp --dport 25 -j DROP
>
> #Permitir trafico de entrada a puertos SMTP, POP, SSH
> iptables -A INPUT -p tcp --dport 25 -s 192.168.0.0/24 -d PRIVATE_IP -j 
> ACCEPT
> iptables -t filter -A INPUT -p tcp -s 0/0 -d  PUBLIC_IP --dport 25 -j 
> ACCEPT
> iptables -t filter -A INPUT -p tcp --dport 25 -s  192.168.0.0/24 -d 
> 0/0 -j DROP
> iptables -A INPUT -p tcp -s 0/0 -d   192.168.0.0/24 --sport 25 -i eth0 
> -j DROP
>
> iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 110 -j ACCEPT
> iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 22 -j ACCEPT
> iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 3306 -j REJECT
>
>
> # Botar paquetes que vayan de la Lan por el puerto 25
> iptables -A FORWARD -p tcp --dport 25 -j DROP
>
>
>
> Can anybody help me with this???
>
Have you tried this command???

iptables -vnL
>
> Thanks,
>
>
>
> Juan Carlos Peláez Mendoza
>
>
>

Re: Blocking SMTP Worm

[Juan Carlos Peláez Mendoza]

I got this

Chain FORWARD (policy ACCEPT 59M packets, 20G bytes)
 pkts bytes target     prot opt in     out     source               destination
18236  876K DROP       tcp  --  *      *       192.168.0.92
0.0.0.0/0           tcp dpt:25
3317K 2826M ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0

Chain INPUT (policy ACCEPT 6671K packets, 733M bytes)
 pkts bytes target     prot opt in     out     source               destination
 3084  207K DROP       all  --  *      *       192.168.0.92         0.0.0.0/0

Does this mean that my rule is working?? because the traffic still
passing through the both NIC's.


Thanks,


Juan Carlos Pelaez Mendoza



On 10/24/06, Gáspár Lajos <swifty@freemail.hu> wrote:
> Juan Carlos Peláez Mendoza írta:
> > Hi list,
> >
> > My IP Address have been listed in the RBL's too many times, I
> > installed into my linux box MailScanner + Spamassassin + Clamavmodule
> > + FProt, I set up the iptables rules allowing only smtp, pop and ssh
> > traffic, but when I see the traffic with tcpdump I see this strange
> > behavior:
> >
> > 17:14:42.255867 IP 192.168.0.92.2802 >
> > Static-IP-cr2001181.cable.net.co.smtp: S 396792405:396792405(0) win
> > 16384 <mss 1460,nop,nop,sackOK>
> > 17:14:43.457612 IP 192.168.0.92.2803 >
> > Static-IP-cr2001181.cable.net.co.smtp  : S 760094736:760094736(0) win
> > 16384 <mss 1460,nop,nop,sackOK>
> > 17:14:46.512975 IP 192.168.0.92.2804 >
> > Static-IP-cr2001181.cable.net.co.smtp: S 804817506:804817506(0) win
> > 16384 <mss 1460,nop,nop,sackOK>
> > 17:14:49.466442 IP 192.168.0.92.2804 >
> > Static-IP-cr2001181.cable.net.co.smtp: S 804817506:804817506(0) win
> > 16384 <mss 1460,nop,nop,sackOK>
> > 17:14:50.118528 IP 192.168.0.92.2805 > mailgw2.diveo.net.co.smtp  : S
> > 2079962326:2079962326(0) win 16384 <mss 1460,nop,nop,sackOK>
> > 17:14:53.071734 IP 192.168.0.92.2805 > mailgw2.diveo.net.co.smtp: S
> > 2079962326:2079962326(0) win 16384 <mss 1460,nop,nop,sackOK>
> >
> > I see the traffic today and still getting that result after blocking
> > the traffic for the  192.168.0.92 address:
> >
> > 08:40:10.664379 IP 192.168.0.92.2728 >
> > emt200-31-197-53.emtelco.com.smtp: S 3599806789:3599806789(0) win
> > 16384 <mss 1460,nop,nop,sackOK>
> > 08:40:16.683771  IP 192.168.0.92.2728 >
> > emt200-31-197-53.emtelco.com.smtp: S 3599806789:3599806789(0) win
> > 16384 <mss 1460,nop,nop,sackOK>
> > 08:40:20.731636 IP 192.168.0.92.2731 >
> > bbvaganadero.telefonica.net.co.smtp: S 4026584844:4026584844(0) win
> > 16384 <mss 1460,nop,nop,sackOK>
> > 08:40:23.706369 IP 192.168.0.92.2731 >
> > bbvaganadero.telefonica.net.co.smtp: S 4026584844:4026584844(0) win
> > 16384 <mss 1460,nop,nop,sackOK>
> >
> >
> > What can I do to stop and block this worm???
> >
> > Here are my basic rules for IPtables.
> >
> >
> > echo 1 > /proc/sys/net/ipv4/ip_forward
> > iptables --flush
> > modprobe ip_conntrack
> > modprobe ip_conntrack_ftp
> > modprobe ip_nat_ftp
> > modprobe ip_conntrack_irc
> >
> > iptables --table nat --flush
> >
> >  iptables --table nat --append POSTROUTING --out-interface eth0 -j
> > MASQUERADE
> > iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
> >
> > #Blocking  192.168.0.92 SMTP Traffic
> > iptables -A FORWARD -p tcp --dport 25 -s 192.168.0.92 -j DROP
> >
> > iptables -A FORWARD -i eth1 -j ACCEPT
> >
> > echo "Enrutamiento Activado..."
> >
> > # Bloqueando ip  218.55.23.50
> > iptables -A INPUT -s 218.55.23.50 -j DROP
> >
> > # Bloqueando ip  201.160.33.60
> > iptables -A INPUT -s  201.160.33.60 -j DROP
> >
> > iptables -A INPUT -s 192.168.0.92 -j DROP
> > iptables -A FORWARD -p tcp --dport 25 -j DROP
> >
> > #Permitir trafico de entrada a puertos SMTP, POP, SSH
> > iptables -A INPUT -p tcp --dport 25 -s 192.168.0.0/24 -d PRIVATE_IP -j
> > ACCEPT
> > iptables -t filter -A INPUT -p tcp -s 0/0 -d  PUBLIC_IP --dport 25 -j
> > ACCEPT
> > iptables -t filter -A INPUT -p tcp --dport 25 -s  192.168.0.0/24 -d
> > 0/0 -j DROP
> > iptables -A INPUT -p tcp -s 0/0 -d   192.168.0.0/24 --sport 25 -i eth0
> > -j DROP
> >
> > iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 110 -j ACCEPT
> > iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 22 -j ACCEPT
> > iptables -t filter -A INPUT -p tcp -s 0/0 -d 0/0 --dport 3306 -j REJECT
> >
> >
> > # Botar paquetes que vayan de la Lan por el puerto 25
> > iptables -A FORWARD -p tcp --dport 25 -j DROP
> >
> >
> >
> > Can anybody help me with this???
> >
> Have you tried this command???
>
> iptables -vnL
> >
> > Thanks,
> >
> >
> >
> > Juan Carlos Peláez Mendoza
> >
> >
> >
>
>
>


-- 
________________________________________________
"Hope has died in me."

Re: Blocking SMTP Worm

[Juan Carlos Peláez Mendoza]

Baltasar,

I think what you say is right, the traffic that the tcpdump shows is
before applying the filters and rules, The IP that I mentioned it's
now blocked, but another IP's are beggining to send traffic through
the interface,

how can I do to stop the traffic to my LAN but not to my linux box,
because this is my Mail Server and is the only one that I want to send
traffic at this port???

14:51:55.442934 IP 61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp >
192.168.0.163.4115: P 168:192(24) ack 168 win 17353
14:51:55.443055 IP 192.168.0.163.4115 >
61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp: . ack 192 win 65344
14:51:55.659325 IP 192.168.0.163.4115 >
61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp: P 168:190(22) ack
192 win 65344
14:51:56.554482 IP 61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp >
192.168.0.163.4115: P 192:210(18) ack 190 win 17331
14:51:56.665159 IP 192.168.0.163.4115 >
61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp: . ack 210 win 65326


Thanks,


Juan Carlos  Peláez Mendoza

On 10/24/06, former03 | Baltasar Cevc <baltasar.cevc@former03.de> wrote:
> Hi Juan,
>
> On 24.10.2006, at 16:19, Juan Carlos Peláez Mendoza wrote:
> > Chain FORWARD (policy ACCEPT 59M packets, 20G bytes)
> > pkts bytes target     prot opt in     out     source
> > destination
> > 18236  876K DROP       tcp  --  *      *       192.168.0.92
> > 0.0.0.0/0           tcp dpt:25
> > 3317K 2826M ACCEPT     all  --  eth1   *       0.0.0.0/0
> > 0.0.0.0/0
> >
> > Chain INPUT (policy ACCEPT 6671K packets, 733M bytes)
> > pkts bytes target     prot opt in     out     source
> > destination
> > 3084  207K DROP       all  --  *      *       192.168.0.92
> > 0.0.0.0/0
> >
> > Does this mean that my rule is working?? because the traffic still
> > passing through the both NIC's.
> Well, it does mean that these rules are acive and x pakets/bytes (the
> two first figures on ach) lines have mached, thus have been
> dropped/accepted. I think tcpdump shows the traffic before filtering is
> done, but I'm not sure.
>
> Baltasar
>
> Baltasar Cevc
>
> _____ former 03 gmbh
> _____ infanteriestraße 19 haus 6 eg
> _____ D-80797 muenchen
>
> _____ http://www.former03.de
>
>


-- 
________________________________________________
"Hope has died in me."

Re: Blocking SMTP Worm

[Gáspár Lajos]

Juan Carlos Peláez Mendoza írta:
> Baltasar,
>
> I think what you say is right, the traffic that the tcpdump shows is
> before applying the filters and rules, The IP that I mentioned it's
> now blocked, but another IP's are beggining to send traffic through
> the interface,
>
> how can I do to stop the traffic to my LAN but not to my linux box,
> because this is my Mail Server and is the only one that I want to send
> traffic at this port???
>

iptables -A FORWARD -j DROP -p tcp --dport 25

This will drop every smtp traffic that goes through your box!
Remember: This is the FORWARD chain!

It is not the nicest solution... :)

Take a look on my script ! :)

https://lists.netfilter.org/pipermail/netfilter/2006-August/066404.html

Swifty
> 14:51:55.442934 IP 61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp >
> 192.168.0.163.4115: P 168:192(24) ack 168 win 17353
> 14:51:55.443055 IP 192.168.0.163.4115 >
> 61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp: . ack 192 win 65344
> 14:51:55.659325 IP 192.168.0.163.4115 >
> 61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp: P 168:190(22) ack
> 192 win 65344
> 14:51:56.554482 IP 61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp >
> 192.168.0.163.4115: P 192:210(18) ack 190 win 17331
> 14:51:56.665159 IP 192.168.0.163.4115 >
> 61-64-104-223-adsl-tai.STATIC.so-net.net.tw.smtp: . ack 210 win 65326
>
>
> Thanks,
>
>
> Juan Carlos  Peláez Mendoza
>

Re: Blocking SMTP Worm

[R. DuFresne]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1241 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 24 Oct 2006, Juan Carlos Peláez Mendoza wrote:

> Hi list,
>
> My IP Address have been listed in the RBL's too many times, I
> installed into my linux box MailScanner + Spamassassin + Clamavmodule
> + FProt, I set up the iptables rules allowing only smtp, pop and ssh
> traffic, but when I see the traffic with tcpdump I see this strange
> behavior:
>
 		[SNIP]
>
> What can I do to stop and block this worm???
>

Wipe out the OS on 192.168.0.92, reinstall from scratch and apply all 
patches and updates prior to exposing to the internet.  that should clear 
up the sapm worm.

Thanks,


Ron DuFresne
- -- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         admin & senior security consultant:  sysinfo.com
                         http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

                 -Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFR6nnst+vzJSwZikRAnNPAJ9F4HQkzAQjkKSaNVr6+uNg4FE44ACfSsDf
CrGJLJ9MZPZbV1wJu76Faos=
=4IZ+
-----END PGP SIGNATURE-----