Exchange 2k3 Malicious Messages Being Sent From User's Acct

[mcfly1204]

I have been receiving email notifications from our ISP stating that malicious email messages are being sent from the IP address of our Exchange server. Since that time, I have regularly been checking the queue on our Exchange server for anything suspicious. Today I noticed four messages in the queue, each 1Kb in size, sent from the same user to obscure domains at random times throughout the day.

-The Exchange server is enabled to relay for two internal IP addresses.
-the check box for "Allow all computers that successfully authenticate..." is not checked.
-Anonymous access, basic authentication, and Integrated Windows authentication are all selected.

I cannot seem to figure this out. Where should I start looking to resolve this issue?

[sicarie]

1) unplug the internet connection from the exchange server so that you don't spam anyone, and your ISP doesn't disconnect you
2) determine if you want to spend the money for forensic analysis, or just reinstall
3) when you finally decide to reinstall (with or without the forensic analysis) ensure you 'harden' your server, specifically for Exchange.
4) take the time to configure, and then take more time to tune, a log management system so that you'll be informed of suspicious activity

[mcfly1204]

So you are saying the only manner in which to resolve this issue properly is to completely reinstall everything on the Exchange server? I appreciate the response, but I would also appreciate someone confirming that this is common practice. This feels like the equivalent of reformatting a desktop every time you have an issue.

[sicarie]

If this were a normal issue and not an intrusion, that would be a good analogy of reinstalling at every issue.

However, when a server is compromised - as yours sounds like it has been (sending email not authorized by your company) - you can spend a LOT of time and money into forensic analysis and remediation to figure out what was compromised on what level (it's on the box, so they have access to your exchange server, you know it's gotten into your DMZ at least), and then use tools that are not guaranteed to remove them, some that can be extremely destructive. This takes time, it can take money, and can be done very poorly very easily.

Or, you can reinstall and wipe out whatever malicious programs were installed; and use a server hardening guide to remove the 'most common' attack vectors. It all depends on how big your business is and how much you want to know what the IP address is of the person who did it.

I'd recommend pulling the plug while you decide, but then also exporting 1) a backup of the mail files to hard media (a CD or something - I'm considered paranoid, but I don't like moving something that may be corrupt onto another PC to get infected), and also exporting the Windows Log Files so that you can take a look at them and try to get an idea of where/when/how the intrusion happened.

[sicarie]

Hmmm, there might be one thing to check before you do all that - did you look at the ID sending these emails, and who created those users? Make sure it wasn't someone in your company?

That would be the initial forensic analysis - figure out what account got compromised, then you can figure out roughly when that happened and then by looking at the system events how it happened (hopefully, depending on your logging levels).