Customers with more than one HIS T1 are still up since we feed multi-T1 customers on physically diverse circuits to avoid outages when a single T1 goes down.   Single T1 customers fed via the down DS3 are currently down.

We’ll post status updates here as we receive them.

Update:  the down DS3 was fixed at 10:51 PM EST and all affected T1s are back up.

(This is just a screengrab image – the links above aren’t live).

The message looks real enough (which is the idea) but it did not come from Facebook.  The link actually goes to servers in 15 locations in Korea, Japan, Brazil, Hungary, Poland and the Ukraine, where you’ll be asked to enter your Facebook login info and while you’re at it you’ll be exposed to a variety of malware designed to harvest passwords and make you part of this botnet.

Postini should be catching these so you may not see one  unless you’ve added ‘facebookmail.com’ to your approved senders list, in which case the messages will come through unfiltered.

• By clicking on the link, you confirm that your email address is good, guaranteeing more spam in the future
• The site that’s linked to (usually disguised so as to look legitimate) is full of malware designed to infect your PC with viruses that log keystrokes,  capture passwords, send spam, and make your PC part of the botnet that’s sending these things.
• Some of the messages include a file attachment that supposedly has your ‘new settings’.  This is actually an executable file designed to infect your PC.
• If you go to the web site you’ll be asked to enter your username and password; if you do that, your username and password will be circulated in the spam world and your account will be compromised.

.

Why so many are getting through:

• These are coming from one or more gigantic botnets and are originating from PCs around the world that have been infected.
  • The volume is extremely high, so that even if a small percentage gets through, many people will get the messages.
• The messages are originating from many (probably hundreds of thousands) of different IP numbers
• The From: address and subject vary
• Most of the examples we’ve seen are customized so that the URL that the link in the message points to is unique.
  • This lets the bad guys know who got the messages even if all the user does is click on the link.
  • This makes each message different so it’s harder for antispam software to pick up the pattern.
• It’s taking at least a few hours for either Postini’s filters or ours to adapt and recognize new variations, and during that ‘zero hour’ phase thousands get through.

.

Whoever’s behind this is technically clever, and it would appear that there’s considerable money behind this as well.

If you get any of these, delete them immediately.

What’s happening:  as an anti-spam measure, Verizon has started to block the SMTP port (port 25) for residential customers.  There’s a Verizon writeup on this here.  This is a good thing for the net because it blocks outgoing mail from virus-infected PCs (Wikipedia article here).

The workaround is simple:  go into your email software setup and change the outgoing server setting from port 25 to port 587.  Port 587 works with all of our servers and will let you send mail even if Verizon (or Comcast, Cox, Roadrunner etc.) blocks port 25.

For more information, see: http://lorelle.wordpress.com/2009/09/04/old-wordpress-versions-under-attack/ You can use http://ismyblogworking.com to test your Wordpress blog and get the version number.

If you’re reasonably up to date, there’s a link on your admin control panel that lets you upgrade automatically using your FTP login info – it’s pretty painless.

Wordpress is an excellent package and we encourage its use, but as with any piece of software, you can’t just install it and forget about it – you must keep it up to date.  The best way to find out about updates is to watch  http://www.wordpress.org.

We’ve contacted all affected customers by phone and will post updates here.  AT&T sees the problem and is working to resolve it.

10:45 AM update:  AT&T reports that this is part of a much larger outage.  No estimate on resolution time yet.

10:55 AM Update:  the problem was resolved at 10:51 AM and all customer T1s are back up.

Dear user of his.com,

Your email account has been used to send a huge amount of unsolicited email during the recent week.
Probably, your computer had been compromised and now contains a hidden proxy server.

We recommend that you follow the instruction in the attached file in order to keep your computer safe.

Virtually yours,
The his.com team.

These messages are not from us – they’re trojans designed to trick you into opening the attached file, which, if you do, will infect your PC with whatever virus they’re trying to propagate, which will then turn your PC into a spam-sending ‘bot’ …

Messages like this should be blocked by our anti-spam/virus servers, but some do get through every now and then and you might see one.  If you do, delete it.

If you’re accessing https://webmail.his.com or https://mail.his.com you may find that your logins take an unusually long time  if you have a large mailbox.