Archive for June, 2009

Strange e-mail originating from exchange server

Monday, June 8th, 2009

Today a friend asked me to look at something strange he found in his logs.
To better understand the situation, I’ll describe his network setup:

He runs a linux server with postfix, spamassassin and clamav antivirus which removes all spam and virusses received from the internet. All legitimate e-mail is then routed to his exchange server. E-mail that is sent by users on his network is relayed back to the linux server and then sent to the destination.

Last week he was checking his mail logs on his linux machine and he noticed his box was receiving e-mail from strange e-mail addresses. He figured: Well, no surprise there: Probably spam messages. Until he looked at the ip address from which it originated: It was the ip address of his own exchange server. First thing he did was doing a full virusscan of his exchange server. Nothing. He tried some spyware scanners, but again: Nothing. So he called me.

(more…)

Why is bad WIFI encryption still being used?

Thursday, June 4th, 2009

Yesterday I was goofing around with kismet, a wireless network sniffer, and found sixteen acccesspoints within my range. I wondered which had bad encryption, so I sorted them on WEP key encryption. It turned out two where un-encrypted and eight where encrypted with WEP! I still do not get it. Why is WEP still being used by so many people? I can relate to the fact that people don’t encrypt at all: Some manufacturers just enable wireless out of the box and people just connect the device and notice it’s working. So they will not bother configuring the device if it is already working. But the ones with WEP had to have configured their device, so why not configure it to WPA?

Or perhaps I should reconsider my question? Why do manufactures not pro-actively promote the use of WPA in the web-gui for non-experienced users? The WPA2 standard has been optional in devices since 2004, and required since 2006. And WPA ( non -2 ) has been out for even longer. So why not enable WPA by default, or atleast point out WPA is more secure?

Any insights?