Re: [sa] Re: Slightly OT - Spam opprortunities in SMTP-AUTH

2009-08-13 Thread Charles Gregory
On Wed, 12 Aug 2009, LuKreme wrote: Is it a custom webmail interface you wrote yourself? The front end is custom, wrapping a standard client. Any spammer who personally visited my site would be able to hack it in seconds (with a stolen password, of course). But any existing canned scripts

Re: [sa] Re: Slightly OT - Spam opprortunities in SMTP-AUTH

2009-08-13 Thread Charles Gregory
On Thu, 13 Aug 2009, Benny Pedersen wrote: you belive that email sent from webmail is harder to spam scan then submitted email from remote ? No, my statement was that I believe spammers, like the rest of us, follow the 20/80 rule, and hack the 80 percent of vulnerabilities that require only

Re: [sa] Re: Slightly OT - Spam opprortunities in SMTP-AUTH

2009-08-13 Thread Ted Mittelstaedt
Charles Gregory wrote: On Thu, 13 Aug 2009, Benny Pedersen wrote: you belive that email sent from webmail is harder to spam scan then submitted email from remote ? No, my statement was that I believe spammers, like the rest of us, follow the 20/80 rule, and hack the 80 percent of

Re: [sa] Re: Slightly OT - Spam opprortunities in SMTP-AUTH

2009-08-11 Thread Matus UHLAR - fantomas
On Mon, 10 Aug 2009, Matus UHLAR - fantomas wrote: On 10.08.09 11:07, Charles Gregory wrote: IMNSHO You shouldn't. You should only allow *your* customers with pop e-mail accounts on *your* servers to send mail. 1. If more customers send spam from the same IP address without authentiaction,

Re: [sa] Re: Slightly OT - Spam opprortunities in SMTP-AUTH

2009-08-10 Thread Charles Gregory
On Mon, 10 Aug 2009, Rick Macdougall wrote: I can't speak for others but at my main job (20K+ email accounts) it happens about once every 2 month's or so. Some how the spammer gets a hold of someone's password and either uses smtp-auth or webmail to send out spam. Somehow is not that hard to

Re: [sa] Re: Slightly OT - Spam opprortunities in SMTP-AUTH

2009-08-10 Thread Charles Gregory
On Mon, 10 Aug 2009, Matus UHLAR - fantomas wrote: On 10.08.09 11:07, Charles Gregory wrote: IMNSHO You shouldn't. You should only allow *your* customers with pop e-mail accounts on *your* servers to send mail. 1. If more customers send spam from the same IP address without authentiaction, you

Re: [sa] Re: Slightly OT - Spam opprortunities in SMTP-AUTH

2009-08-10 Thread Rick Macdougall
Charles Gregory wrote: On Mon, 10 Aug 2009, Rick Macdougall wrote: I can't speak for others but at my main job (20K+ email accounts) it happens about once every 2 month's or so. Some how the spammer gets a hold of someone's password and either uses smtp-auth or webmail to send out spam.