Return-Path: <abuse@ualberta.ca>
Received: from pilsener.ucs.ualberta.ca (pilsener.ucs.ualberta.ca [129.128.5.19])	
by tomcat.ns.net (8.8.5/8.8.5) with ESMTP id NAA22524	for <cpicket@ns.net>; 
Tue, 7 Jul 1998 13:10:18 -0700 (PDT)
Received: from altair.ucs.ualberta.ca (altair.ucs.ualberta.ca [129.128.5.41])	
by pilsener.ucs.ualberta.ca (8.9.0/8.9.0) with ESMTP id OAA25642;	
Tue, 7 Jul 1998 14:10:18 -0600 (MDT)
Received: from uptake (uptake.ucs.ualberta.ca [129.128.8.72])	
by altair.ucs.ualberta.ca (8.9.0.Beta5/8.9.0.Beta5) with SMTP id OAA07388;	
Tue, 7 Jul 1998 14:10:17 -0600 (MDT)
Message-Id: <199807072010.OAA07388@altair.ucs.ualberta.ca>
X-Sender: abuse@pop.srv.ualberta.ca
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.1 
Date: Tue, 07 Jul 1998 13:39:17 -0600
To: Chris Pickett <cpicket@ns.net>
From: Computer Security Administrator <abuse@ualberta.ca>
Subject: Spam Relay (was Re: Spam #6: Email 57 Million People for $99)
In-Reply-To: <199807061529.IAA00466@tomcat.ns.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-UIDL: 0c4988b36c31f02a0a82167e60ea1a8c

At 10:27 AM 7/6/98 , you wrote:
<delete>
>Received: from forest.forsci.ualberta.ca (forest.forsci.ualberta.ca
[129.128.55.65])	by pilsener.ucs.ualberta.ca (8.9.0/8.9.0) with ESMTP id
BAA01902;	Mon, 6 Jul 1998 01:28:50 -0600 (MDT)
<snip>
Mr. Pickett,
Thank you for your note.  A machine in a sub-domain at the University of
Alberta gateway was used as a "spam relay"  Your complaint has also been
forwarded to the Administrator of the victimized system or to the
Department Head.  They have promised that the computer will be fixed as
soon as possible.  While repairs are being done, the affected systems are
being filtered from the University's main mailhub.

By copy to the administrators of the system (hello Mike, hello Linda) I am
passing on your request for logs showing the origin of the spam.

Please note the spam does not appear to originate from one of our users or
from our site at this point.  Also note that our own servers at mailhub
(quartz.ucs.ualberta.ca and pilsener.ucs.ualberta.ca) do not relay spam.
You are welcome to test these units.

We discourage spam, and educate users on how to deal with spam:
http://www.ualberta.ca/HELP/spam/spam.html
(see also featured article in recent CNS Dispatch Magazine cited below)

The University of Alberta is actively involved in preventing spam:
http://spam.abuse.net/spam/participants.html
(Bob Beck - firewall security, participant)

And we punitively deal with abuse of computer accounts and e-mail:
http://www.ualberta.ca/CNS/POLICY/Conditions.html
http://www.ualberta.ca/CNS/POLICY/HeadsUp.html

Please note at this time we are actively scanning for other machines on
campus or on a sub-domain license that may have relay incorrectly filtered.
 Others are being identified and the administrators warned.  The sites you
mentioned in your note are already a part of correspondence with effected
systems.

At this point in time, the spammers appear to be mainly targeting a hole in
older versions of Mercury (pre 1.4).  Although the alert and the Mercury
patch have been out for some months, many of the smaller departments find
themselves operating with "out of the box" settings if they cannot afford
their own LAN Administrator.

If you are involved in a network or gateway, please re-remind your
administrators of the problem.  The Mercury situation is discussed at:
http://maps.vix.com/tsi/ar-fix.html

(This note may be in addition to  a response from the administrator of the
actual affected system)

Thanks again for advising us of this incident.  Please direct future
notices of this problem to this address for fastest possible response.


Barry Ladan,
Computer Security Administrator
Computing & Network Services,
University of Alberta.

abuse@ualberta.ca
Ph. (403)  492-1390   Fax (403)  492-1729

This month in CNS Dispatch:
http://iroquois.ucs.ualberta.ca/HyperDispatch18/
"Spam-be-gone ... Fighting Junk Mail"
See also:
http://www.ualberta.ca/HELP/spam/spam.html