user being exploited / 10+gb email bandwidth in 2 days

[sde]

I have one user who is getting hit somehow. His email bandwidth has used about 10gb in 2 days. Normal days he is under 1mb in usage.

Question1: Does mail generated by PHP scripts count against his email bandwidth usage?

Question2: If the answer to Question 1 is no, does anyone have an idea the best way to track this down?

[nobaloney]

Originally posted by sde
I have one user who is getting hit somehow. His email bandwidth has used about 10gb in 2 days. Normal days he is under 1mb in usage.

Question1: Does mail generated by PHP scripts count against his email bandwidth usage?
Of course.

It's email. It gets counted.

Jeff

[pucky]

Not necessarily. It could be a whole lot of things as well, not only email.

[nobaloney]

Read the question again. email created by PHP scripts is email.

:)

Jeff

[sde]

Thanks. I'm pretty sure I isolated the problem to a vulnerable script which processes an HTML form.

[nobaloney]

That's usually the problem.

I think you can search these forums for a patch that will put the php program name into the exim logs.

Jeff