Mailing List Archive: off-topic, somthing strage?

Sorry as I know this is off topic but thought this would be a good forum to ask
this question. I am getting a bounce email such as the following:

The original message was received at Wed, 1 Aug 2001 10:19:48 +1000
from brett@localhost

----- The following addresses had permanent fatal errors -----
l4m0r@freebox.com

----- Transcript of session follows -----
l4m0r@freebox.com... Deferred: mail.freebox.com.: No route to host
Message could not be delivered for 5 days
Message will be deleted from queue

And the actual message is:

brett
brett
eth0 Link encap:Ethernet HWaddr 00:01:03:82:9B:AF
inet addr:192.168.11.54 Bcast:192.168.41.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:69111 errors:0 dropped:0 overruns:0 frame:0
TX packets:33600 errors:0 dropped:0 overruns:0 carrier:4
collisions:0 txqueuelen:100
Interrupt:11 Base address:0xd400

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2145 errors:0 dropped:0 overruns:0 frame:0
TX packets:2145 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0

The reason It is bouncing is because I have iptable rules on my firewall that
disallow smtp(25) out from this box. But what I want to know is what is sending
these emails. I don't think I've been hacked as this info is not to sensitive
and it has happened 2 - 3 times. I assume it is some program that is sending
this info?

any suggestions?

- Brett

Brett Mason wrote:
> this question. I am getting a bounce email such as the following:
<snip>
> ----- Transcript of session follows -----
> l4m0r@freebox.com... Deferred: mail.freebox.com.: No route to host
> Message could not be delivered for 5 days
> Message will be deleted from queue
> And the actual message is:
>
> brett
> brett
> eth0 Link encap:Ethernet HWaddr 00:01:03:82:9B:AF
> inet addr:192.168.11.54 Bcast:192.168.41.255
<snip>
> The reason It is bouncing is because I have iptable rules on my firewall that
> disallow smtp(25) out from this box. But what I want to know is what is sending
> these emails. I don't think I've been hacked as this info is not to sensitive

If I have to guess, I would say that the user 'brett' on host
192.168.11.54 has the password 'brett'. That plus the interface info is
being sent to l4m0r@freebox.com (lamer).

It sure sounds like a compromised box to me.

Shane