Hi James. To answer your questions...

 

All

 

First off, thanks, Linda for replying. I wanted to follow up on this as James actually submitted a ticket about this back when he started the thread. This isn't a necessarily unique situation -- we see situations like this every once in awhile -- so I wanted to post a reply and let the Community know what we found out, plus answer James' questions, in case someone else sees something similar.

 

Indications are that someone with knowledge of mail servers in general, and possibly SmarterMail specifically, accessed the account in question. The content filters being created is one indication of this. Unfortunately, the admin logs had been deleted from the server -- not maliciously, but by a rule set. The admin logs are what would need to be looked at to determine who created the content filters and where that user came from as the admin log details include the IP address of the user. So those being deleted prevented us from being able to determine who created the content filters.

 

As to how the user got in, chances are that one of the following occurred:

 

1. The person was able to leverage a known set of compromised credentials to access the domain settings, or

2. The person used a device that had domain admin credentials logged in, or saved to a browser, to access the account.

 

It's also possible that this was done by someone inside the company. However, that's difficult to determine, much less admit. That said, it may NOT be internal since the type of emails being  forwarded on the checkout process, and the lack of actionable info in those emails, points to someone unfamiliar with the business. (Or someone with a rudimentary understanding of the checkout process.)

 

As for "advanced services" or other safeguards, here are some suggestions:

 

1. If you're not using services such as XMPP, LDAP, etc., these can be disabled outright inside SmarterMail. 

2. Keep logs for at least 30 days, if at all possible. Especially admin logs, delivery logs, etc.

3. Ensure password complexity falls in line with NIST's standards.

4. Configure abuse detection rules on the protocols being used (POP/SMTP) for DoS and Session Harvesting. Configure events to notify the administrative team when one of these rules is triggered.

5. Internal Spammer notifications are recommended in the event of a compromised account being used to send spam. These can be configured to either notify and/or automatically disable the user to prevent the spool from filling up.

 

We have a blog post about much of this. It was written awhile ago, but it's still relevant: 5 Ways to Avoid Being Blacklisted. That may offer some insight as well. 

 

EDIT: I just thought of this blog post as well: How to Find a Compromised Account. It may be useful as well. 

 

 

The Content Filtering rules were created at the domain level. The delete rule affected all, but the latter "forward" rule in reality only affected one account.

 

I did speak with Derek about this for a time. We were unable to confirm HOW the content filtering rule was added. Our admin logs were set to delete after 2 weeks. At the time, this date butted right up against our timeframe. Derek believes the logs for admin access would have been deleted by this time, but I believe the logs were just in time to show a login. Either way, the message logs were turned on for much longer which supported the timeframe for when the rules were added.

 

Also checked IIS logs to look for any any access to Content Filtering through the admin panel. I could not find any evidence that the Smartermail Online Administration panel was used to add these rules (I saw the activity from the day it was discovered, but nothing within the past 2 years). Smartertools holds that the admin panel is the only means to add Content Filtering rules, and is unaware of any alternate means. IIS logs also did not show any unauthorized IP logging into the system, debunking the compromised credentials theory.

 

I reject the idea that a device with admin privileges was used (as a way to bypass our IP restrictions. My home office computer is the only one with such privileges. Someone would have to break into my home, during non-office and non-sleep hours, to do this. It's not reasonable. Leveraging other known credentials is not likely either given that IIS would show the access to Content Filtering rules, of which there was none.

 

Even after working with SmarterTools on this, we are both still at a loss to explain how these rules were even added in the first place.

 

Without solid information, we simply took some basic measures:

 

* Rechecked Hardware and Software Firewalls

* Explicitly Disabled several ports (161 - SNMP, 162 - SNMP Alt, 143 - IMAP, 993 - IMAP SSL, 389 - LDAP, 5222 - XMLL)

*Turned Admin Logging (and many others in Smartermail) to never delete, nor compress.

* Scanned server for all virus and malware threats (clean)

* Reviewed remote access logs, all clean

 

I have looked at OS level file monitoring for changes to the domain_Config.xml, but that is not viable due to frequent minor changes to this file almost every day.