email received from plusnet cyber security.

[#1]

hi, i did a search and steve had the same email. 

can someone let me know what could be the problem?

copied.......

Hi All.

I received the below email yesterday warning my an abuse management case has been opened and my account may be suspended if I did not respond - I don't know if this is spam or genuine.

Could someone advise?

Many thanks,

Steve

=====================================================================================

This is a notification from Plusnet Cyber Security.

It has come to our attention that a source of unsolicited email has been linked to your account with us. This could have one of several possible causes, including those in the following list:
 - You are running an insecure SMTP relay or proxy software
 - Your PC is infected by an email virus, worm or trojan
 - You have a web server with an insecure Formmail script
 - You are yourself sending unsolicited email

The sending of unsolicited email (Spam) is strictly prohibited under the Terms and Conditions of service under which your account is provided. While we accept that most such occurrences are inadvertent, it is your responsibility to ensure that computers you connect to the Internet through us are configured securely and kept free of viruses.

An abuse management case is currently open against your account regarding this matter. Please read the following and take any remedial measures that are required:
 - If you run your own mail server software, ensure that it is configured only to relay mail for your computer or computers' specific IP addresses.
 - If you operate a web proxy, IP proxy, or connection sharing software of any other sort, ensure that it is configured to proxy only for your computer or computers' specific IP addresses.
 - Make sure that any server software you run, including the above, is securely configured and has all recommended fixes and security updates applied.
 - Make sure that any computer or computers that run Microsoft Windows have an appropriate and up-to-date Anti-Virus solution installed. We also strongly recommend that you employ a personal Firewall.

Any other queries you may have about the content of this mail, please contact us and we will be happy to help.

Please note that if you do not respond to this warning, your account may be suspended.

Further information on our Acceptable Usage Policy can be found here: 

<Redacted>

Email reference: EBTM

[#2]

@Lepp It is genuine. I strongly suggest you read it carefully and follow the instructions therein.

[#3]

Thanks John, I have changed my passwords and done a virus scan that was clean.
It's all the other stuff I don't understand.
Thanks again, I will phone them tomorrow 👍

[#4]

I have it too. There's no useful information to help me to investigate - I realise they aren't going to give too much away about the detailed source of the complaint, but even a date range or some such pointers might help. What does "a source of unsolicited email has been linked to your account" mean? Could someone just have clicked on something to mark one of my messages as spam? Or do I seem to be the source of mail that gets rejected, and on what criteria? What sort of volume or frequency are we talking about to register an issue? No, I don't send unsolicited mail.

If I asked Plusnet technical support for help while giving such vague information as "there might be a problem with my broadband", they'd pretty soon shut down my ticket. So I've got nowhere obvious to look beyond some generalisations that I'm pretty confident aren't the source.

And it says to contact them, but doesn't offer any suggestions of how, and they don't exactly make that easy do they? I think the old ticketing system, which worked well, went ages ago.

[#5]

@dplusr My advice to @Lepp  applies to you too - read the email - carefully, do as it suggests, especially the running of a deep AV scan, and then contact Plusnet for further advice and guidance.

I suggest that when you ring PN, request to speak to the cyber security team, as first-line support will be unable to help. This applies to you, too, @Lepp . 

[#6]

thanks for the replies  

[#7]

Obviously I'll do that, but my point remains that giving more information would be expected if the boot were on the other foot. And I've been at work today so not had time, so a ticketing system would help too.

[#8]

@dplusr What 'more information' do you want?

[#9]

Anything that would narrow it down, so that I can look in the right places, i.e. the same as they'd ask for if I were raising an issue with them:

• Some kind of clue as to what it means that a source has been linked - someone marked messages as spam, unusual activity has been spotted and if so what (volumes, content), mail is consistently failing checks of some kind
• Whether it's a one-off or repeated issue and an indication of dates or date ranges (helps a lot with looking in logs)
• Since Plusnet makes it easy to have multiple addresses within my "subdomain", does this appear to be an issue with one address or at account level?

[#10]

If you do as they have asked in the email, and then call the security team, I think you will find out more, @dplusr . That email is an auto-generated one to alert you to the issue, so cannot be specific.

[#11]

@dplusr 

Have you DONE the things requested in the email?

• Changed passwords
• Ensured all updates have been installed
• Done an AV and malware scan
• … and then if you need more advice contacted the cyber security team (via the open ticket on your account)

[#12]

Firstly, this has to fit round Real Life. I hope to call them tonight. But no point really till the scan finishes, and that's heading for well over a day.

My point is that some of those things will prove, if I can get more information, to have been a waste of my time in terms of resolving this. More information would mean better-directed efforts. And yes, perhaps they aren't going to say more over email, but they could over a ticketing system.

[#13]

OK I've called. The lady from support who answered didn't want to put me through to security, and just relayed the same advice as in the email. Therefore I got no more information. Obviously I'm completing all those steps. However, it seems to me improbable that it will help, as I can't find any evidence of a problem and I don't know (sorry, cracked record) what to look for.

She said that changing mail passwords has always resolved it in the past. However, if in fact what we have is triggered by an occasional response from third-party reputation systems or similar, then it's not (statistically) going to happen again for a few months anyway, so how do they know that the change makes a difference? Unless they do of course know what's happening and they won't tell me...

[#14]

However, if in fact what we have is triggered by an occasional response from third-party reputation systems or similar, then it's not (statistically) going to happen again for a few months anyway, so how do they know that the change makes a difference? Unless they do of course know what's happening and they won't tell me...

@dplusr The issue is triggered within the Plusnet system - nothing at all to do with third-party reputation systems. Unfortunately, first-line support are unlikely to even know what you are talking about. Have you got an open question/ticket on your account with regards to this issue?

[#15]

No. They seem to have opened it, updated it to tell me to change my passwords, and closed it again. I thought the idea was to get through to people who did know what they were talking about?

It gets worse. Changing mail passwords as instructed was a struggle, because the update form would only accept 8 characters, even though it claims 8-16 and must have accepted longer passwords before. So now we've got weaker mail passwords. And we don't even use them because I collect mail centrally and distribute it locally, using the default mailbox. Which is the password she told me not to change.