When I was running tcpdump and watching output on my new created VPS (OS:CentOS 7.1) via SSH, a message appears suddenly:
OPTIONS sip:100@My_VPS_IP SIP/2.0
Via: SIP/2.0/UDP 69.64.57.15:5596;branch=z9hG4bK-1736040942;rport
Content-Length: 0
From: "sipvicious"<sip:[email protected]>;tag=3264346531356562313363340132313937303630383239
Accept: application/sdp
User-Agent: friendly-scanner
To: "sipvicious"<sip:[email protected]>
Contact: sip:[email protected]:5596
CSeq: 1 OPTIONS
Call-ID: 557316745284479406993575
Max-Forwards: 70
I firstly thought I have received a fake ip email, and confused, for I have never setup an email service.
Here comes the result of ss -tunpl:
[root@localhost ~]# ss -tunpl
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
Cannot open netlink socket: Protocol not supported
udp UNCONN 0 0 *:46413 *:* users:(("ss-server",pid=25065,fd=5))
udp UNCONN 0 0 :::443 :::* users:(("kcp_server",pid=25027,fd=3))
Cannot open netlink socket: Protocol not supported
tcp LISTEN 0 0 *:22 *:* users:(("sshd",pid=128,fd=3))
tcp LISTEN 0 0 127.0.0.1:1080 *:* users:(("ss-server",pid=25065,fd=6))
tcp LISTEN 0 0 :::22 :::* users:(("sshd",pid=128,fd=4))
[root@localhost ~]#
Program ss-server and kcp_server are both something like a socks5 proxy server with authorization forced, which means nothing about email service has been install in my VPS(even mail is Command not found).
At the mean time, the ssh only allow RSA authorization, and I am sure my private key is safe enough. And, the w command shows that there is only one user online.
But, above are not important. The reason why I call this a ghost email is that both /var/mail/ and /var/spool/mail/ have only one empty file called rpc :
[root@localhost ~]# ls /var/mail
rpc
[root@localhost ~]# file /var/mail/rpc
/var/mail/rpc: empty
[root@localhost ~]# ls /var/spool/mail/
rpc
[root@localhost ~]# file /var/spool/mail/rpc
/var/spool/mail/rpc: empty
The email I have received disappeared!
I hope this is not a security BUG which can make my VPS unsafe.
But, the most important thing is: I want to know how it could be happened? What is the mechanism behind it?
