Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We run a mail system for some thousands users and from time to time we get a spam flood from one of our users' account.

When that happens we see connections from multiple IP addresses of foreign countries and they authenticate to our SMTP server using valid credentials, we then reset the user's password and the spam stops. It is getting annoying: we get on average such a case every month.

I am wondering how valid users credentials gets stolen so frequently. I guess they are not bruteforced since most of them are sane, robust password.

Due to a policy we do have to provide service (smtp, pop, imap) also over plaintext connection (no TLS) and I'm trying to fix that but it'll be a long process, but in more than one case further investigation lead to the discovery of some viruses on the user's pc.

Are email credentials stolen mostly by desktop pc viruses? Or do I have to suspect more network sniffing when the user goes around with his/her laptop/tablet/smartphone ? Or there are other causes I should consider?

Other than forcing only secure auth methods for our POP/IMAP/SMTP/webmail connections, is there anything else we could do to prevent stolen passwords?

share|improve this question
up vote 0 down vote accepted

I too get the same situations, always a virus problem.

Nowadays, it's way too easy to steal passwords once you get access to a computer. There are numerous programs that give you a list of all the user configs (including password, POP/IMAP and SMTP servers) that even I use when in need to configure the account but forget my client's password.

My best bet to the cause of the problem would be either a keylogger or an exploit using such programs and with these options being so "easy" to use on a regular Internet user, packet sniffing isn't common.

I don't know if you can encrypt or make it more difficult to get that data, but what I would do is encourage you to force the need to run an antivirus (like Malwarebytes) on the users computers regularly, but I too know asking your clients to do it is generally going to fail because they either forget or are too lazy to do it. You could rather force a scan during lunch break hours though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.