Fighting SPAM: Identifying compromised email accounts

A compromised email account is one where spammers have determined someone's email password, and they're using the email account to send out spam email.

Various email servers have better and worse logging.  Depending on the server (qmail, postfix, sendmail) the logs may or may not let you directly correlate an outgoing spam email with the actual account that sent the email.

So, the following can be pretty useful.  It collects up all the IP addresses ($13 - the thirteenth field in the logfile, in this particular case) that each user has connected from, and prints out the accounts that are connecting from more than one IP.

awk '/LOGIN,/ {if (index(i[$12], $13) == 0) i[$12]=i[$12] " " $13} END {for(p in i) {print split(i[p], a, " ") " " p " " i[p]}}' maillog|sort -n|grep -v '^1 '

If you see an account for an individual, which is getting connections from dozens or hundreds of IP addresses, that's very possibly a compromised email account.

Note that an end-user with a smartphone will end up with a big bank of IPs connecting to check email.  They'll all have similar IP addresses in most cases.

What us the coolest data structure?

I'll go with associative arrays.  Especially as implemented within awk.  

Although associative arrays are nowhere near as intricate or graphically stunning as some other data models, they're over-the-top-cool, because of how immensely useful they are for basic text transformation.

You can code whatever sort of transformation you want to do to "stdout" of any unix/linux command using awks associative arrays.

For example... here's a command that'll work with ALL of the maillog files - rotated or not, compressed or not, and tell you which users send/receive the largest volumes of email:

[code bash]
zgrep -h "sent=" maillog*| \
sed 's/^.*user=//'| \
sed -e 's/rcvd=//' -e  's/sent=//'| \
awk -F, '{t[$1]=t[$1]+$5+$6; r[$1]=r[$1]+$5; s[$1]=s[$1]+$6}  END {for (i in t) { print t[i]" "s[i]" "r[i]" "i}}' \
|sort -n
[/code]

Output format is:  

combined-total sent-total received-total email-address.  

Sample output:

11635906 11530222 105684 boss@somecompany.com
33077188 32995397 81791 biggerboss@somecompany.com
41524794 41225163 299631 ceo@somecompany.com
82771501 81433867 1337634 guywhodoesrealwork@somecompany.com

You could have it give you the totals in K or M by simply appending  /1024  or /1048576 to the arguments to the "print" function.

Tell me that isn't just the coolest data structure you've ever seen.  Dare ya. :-)

How many email connections are coming from where?

Sometimes people want to find out why email's slow, or why they're not able to connect to their email server consistently.  

Often that'll be someone, somewhere on the internet, trying to break into their server via SMTP.  So... to find out how many connections are active right now to port 25 on your server, the following one-liner is really handy.

netstat -ntp|awk '$4 ~ /.*:25/ {sub(":.*", "", $5); print $5}'|sort|uniq -c|sort -n

Bonus points if anyone can come up with a sub() that'll work right for ipv6 addresses. :-)

The following will show pop3 brute-force attempts.

First, find the "maillog" log for your server.  Change to the directory holding that log and run:

egrep "pop3d: Connection" maillog | awk '{print $7}' | awk -F"[" '{print $2}' | sed -e 's/\]//g' | sort  |uniq -c | sort -nr | head -3

Here's another routine that shows email accounts with what IP addresses connected and how many times:

grep "Login:" maillog|for i in `awk '{print $7}'|sort|uniq`; do echo $i; grep " $i" maillog|grep -Po '\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b'|sort|uniq -c |sort -n; done

Are any email accounts compromised?

The "maillog" file on your server tracks a lot of info about what happens with your mail server.  

In most cases, login information will be tracked.  If it's following the standards, the following will give you a list of email account logins, sorted by how many different IP addresses have accessed that account, and including the list of those IP addresses. 

:-) ...how 'bout THEM beans?

awk '/LOGIN,/ {if (index(i[$12], $13) == 0) i[$12]=i[$12] " " $13} END {for(p in i) {print split(i[p], a, " ") " " p " " i[p]}}' maillog|sort -n

Now... please realize, some people check their email from their mobile phones.  Those phones use proxy server banks.  The IP address of the proxy server will change.  So you may get 'false positives' in the output, for users that check their email from their phones.

They're pretty obvious when you see them - all of the ip addresses will be in the same range.

BUT... just because a range of IPs hits the mailbox doesn't necessarily mean it's a mobile phone proxy array.

Use "whois" to find out if that's a cellphone or a botnet.