My webserver is enslaved by a spammer

I have a dedicated server and access to it using WHM 11.2.0 cPanel. On this server, I have about 10 sites, all which have regular CPanel.

A hacker/spammer started launching nightly spam attacks 5 days ago, enslaving my email server to send out spam, all to Brazilian addresses and in Portuguese.

I've been fighting this around the clock with absolutely NO success. Just an hour ago, I sat there in WHM while an attack was in progress, kept clicking on MAIL QUEUE MANAGER to see 900 or so spam emails in the delivery queue, I delete them, refresh, and there's another 800 or so.. and I did this for 30 minutes.

I rebooted my server, rebooted my EXIM mail server, clicked the option in TWEAK settings to DISABLE user NOBODY from sending out email, nothing worked..

Then finally, I went to SHOW CURRENT CPU USAGE and saw a few processes that were using a lot of memory, this one in particular seemed like it was the one sending out the spam, I killed all processes by NOBODY.

Process /usr/local/apache/bin/httpd-DSSL
Owner nobody
PID 77351
CPU % 13.43%
MEM % 2
Kill Process Kill
Kill All Processes owned by nobody Kill

I returned to the mail queue and there was no more spam to be deleted. Then about 15 minutes later, it started up again, a new attack.

I killed the process above, returned to the mail queue and it stopped.

Obviously, i can't sit around and kill these attacks 24.7, I'm seeking a way to stop it for good, without my direct involvement.

I went through all of my websites and rewrote ALL of my scripts where the mail function is being used.

//---- do this to prevent spammers from enslaving my server ----
$stopspam = array("/bcc\:" => "","/Content\-Type\:/i" => "","/cc\:/i" => "","/to\:/i" => "","/\r/" => "","/\n/" => "","bcc:" => "","Content-Type:" => "","cc:" => "","to:" => "","\r" => "","\n" => "");
$as_name = strtr(strtolower($name), $stopspam);
$as_email = strtr(strtolower($email), $stopspam);
if (($as_name <> strtolower($name)) OR ($as_email <> strtolower($email)))
{
$fail = "yes";
Header("Location: ../");
exit();
}
$receive = $tome;
$mailheaders = "From: $name<$email>\r\n\r\n";
$message = "\r\n Name: $name \r\n Email: $email \r\n Message: $notes \r\n";
$syssubject = "Visitor Comments";
if (($name) AND ($email) AND (!$fail))
{
@mail($receive, stripslashes($syssubject), stripslashes($message), $mailheaders);
}

This code is suppose to prevent the attacker from adding in a BCC or CC into the email or name field and spamming using my email server. The double carraige return in the mail header should also prevent it.

I went over my 10 sites over and over and over to make sure I wasn't missing any of the MAIL commands, I even disabled some of them to make SURE each time any submission was being emailed, it went through this protocol.

However, the attacks still continue to the tune of 60,000 spam being sent out every night.

I'm looking for ANY help on this... ANY thing.. I'm beyond deseperate. And my host doesn't care a hoot to help me.

What frustrates me most... is that WHM CPanel doesn't seem to have ANY tools to enable me to fight this... For example...

1) I want to know which of the 10 websites this attack is happening on.. I have NO WAY of knowing. I've downloaded some raw access files, but they are KLUDGED hex numbers with a URL, no time or date, they don't tell me ANYTHING.

2) fabricator says "firstly rename the script. Instead of calling it formmail.cgi call it e578hcw.cgi, spammers look for scripts with common names" ... I would like to do this, but how? HOW CAN I RENAME MY FORMMAIL.CGI? I don't see any tools on either CPANEL or WHM to allow me to do this?

3) rocknbill has a SUPER good post about this topic at [webmasterworld.com...] and states... One way to fight this is to LOG everything sent to this script. I don't mean to sound dense... but um... You mean, for all of my 3 or 4 scripts, for all 10 websites, I should create a special logging file to track what is being sent out? Or is there some feature in WHM or CPanel that automatically logs the email being sent out, where it's sent out from etc..?

4) I see the WHM mail log, but it doesn't help me AT ALL.. I can look at all the bounced back spam and get the same information that the WHM mail log gives me, am I missing something here? Why isn't there a function in WHM showing me the ip address of the person who sent out the email, which website, what time, the contents, etc etc... Am I going totally crazy, or is there absolutely nothing in CPanel and WHM to help me fight this spam attack?

I'm of the opinion that the attacks happening to my web sever are NOT from a security breach in any of my php web pages, I checked them all many times and just don't see how it's possible that way.

Any idea on how to even come close to tracking down how these attacks are happening much less stopping them will be of big help.

THanks in advance for your consideration in helping me on this issue.

[edited by: engine at 8:20 am (utc) on Aug. 7, 2007]
[edit reason] See TOS [webmasterworld.com] [/edit]

My webserver is enslaved by a spammer

wmh, spam, spammers, stop spam attack, hijacked, comprimised web server

Phrasebase

Key_Master

WesleyC

Phrasebase

Key_Master

Realbrisk

Phrasebase

bateman_ap

rocknbil

Phrasebase

bateman_ap

Phrasebase

WesleyC

Phrasebase

Key_Master

Lorel

mjwalshe

Wlauzon

londrum

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week