Subject: [ietf-smtp] Help identifying unknown verb: FCCKV2

From: "Carl S. Gutekunst" <[email-masked]>
Date: Fri, 28 Sep 2012 14:26:48 -0700

Does anyone here know of a legitimate MTA, proxy/filter, IDS, or similar 
critter that sends this verb before sending EHLO?

    FCCKV2 zQUdwkgzYhu/noMgcNtA0wvhrV0T9SThL3koEfk=

I'm suspicious that it's a malware infection on the sender's host, but 
before I start making accusations I wanted to check around. Various web 
forums have also reported seeing this as an X-bar header line in HTTP 
requests, without identifying what it was.

<csg>

---

From: John C Klensin <[email-masked]>
Date: Fri, 28 Sep 2012 18:07:03 -0400

--On Friday, September 28, 2012 14:26 -0700 "Carl S. Gutekunst"
<[email-masked]> wrote:

> Does anyone here know of a legitimate MTA, proxy/filter, IDS,
> or similar critter that sends this verb before sending EHLO?
> 
> I'm suspicious that it's a malware infection on the sender's
> host, but before I start making accusations I wanted to check
> around. Various web forums have also reported seeing this as
> an X-bar header line in HTTP requests, without identifying
> what it was.

Carl, 
I don't know what your definition of "legitimate" is, but I
think 5321 and all of its predecessors are pretty clear that any
verb sent before EHLO or HELO other than VRFY or EXPN is not
"legitimate".   So any MTA, etc., that uses such a verb isn't
either.

That said, it looks like it I would expect some flavor of magic
cookie (possibly even a message/transaction hash or signature)
that might be used in an "offer the right handshake and get the
right response to it or I won't allow a connection" transaction.
There are obviously better (or at least more standard) ways to
do that in today's Internet, starting with SASL or SMTP
AUTH-based sending host authentication, but that might not stop
someone from trying.  In particular, if the enemy is a spammer,
protection (if not security) by sufficient obscurity can
actually be a good medium-term tool.

    john

---

From: Steve Atkins <[email-masked]>
Date: Fri, 28 Sep 2012 15:26:43 -0700

On Sep 28, 2012, at 2:26 PM, "Carl S. Gutekunst" <[email-masked]> wrote:

> Does anyone here know of a legitimate MTA, proxy/filter, IDS, or similar critter that sends this verb before sending EHLO?
> 
> I'm suspicious that it's a malware infection on the sender's host, but before I start making accusations I wanted to check around. Various web forums have also reported seeing this as an X-bar header line in HTTP requests, without identifying what it was.

In an http context it'd be something to do with Fortinet, I think. It's possible that it'd
show up on SMTP too, I guess.

Cheers,
  Steve

---

From: "Carl S. Gutekunst" <[email-masked]>
Date: Fri, 28 Sep 2012 15:34:00 -0700

> show up on SMTP too, I guess.

Thanks Steve (and John), I've gotten several suggestions now that it's a 
Fortinet security device. I was just a little suspicious because of the 
keyword (really?), the protocol violation, and the existence of a 
trojan/dropper with the same name. And I haven't been able to coerce my 
own Fortinet box to do the same. Perhaps an Email to their support group 
would be in order.

<csg>