When I was running
tcpdump and watching output on my new created VPS (OS:CentOS 7.1) via SSH, a message appears suddenly:
OPTIONS sip:100@My_VPS_IP SIP/2.0 Via: SIP/2.0/UDP 22.214.171.124:5596;branch=z9hG4bK-1736040942;rport Content-Length: 0 From: "sipvicious"<sip:firstname.lastname@example.org>;tag=3264346531356562313363340132313937303630383239 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:email@example.com> Contact: sip:firstname.lastname@example.org:5596 CSeq: 1 OPTIONS Call-ID: 557316745284479406993575 Max-Forwards: 70
I firstly thought I have received a fake ip email, and confused, for I have never setup an email service.
Here comes the result of
[root@localhost ~]# ss -tunpl Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Cannot open netlink socket: Protocol not supported udp UNCONN 0 0 *:46413 *:* users:(("ss-server",pid=25065,fd=5)) udp UNCONN 0 0 :::443 :::* users:(("kcp_server",pid=25027,fd=3)) Cannot open netlink socket: Protocol not supported tcp LISTEN 0 0 *:22 *:* users:(("sshd",pid=128,fd=3)) tcp LISTEN 0 0 127.0.0.1:1080 *:* users:(("ss-server",pid=25065,fd=6)) tcp LISTEN 0 0 :::22 :::* users:(("sshd",pid=128,fd=4)) [root@localhost ~]#
Program ss-server and kcp_server are both something like a socks5 proxy server with authorization forced, which means nothing about email service has been install in my VPS(even
Command not found).
At the mean time, the ssh only allow RSA authorization, and I am sure my private key is safe enough. And, the
w command shows that there is only one user online.
But, above are not important. The reason why I call this a ghost email is that both
/var/spool/mail/ have only one empty file called rpc :
[root@localhost ~]# ls /var/mail rpc [root@localhost ~]# file /var/mail/rpc /var/mail/rpc: empty [root@localhost ~]# ls /var/spool/mail/ rpc [root@localhost ~]# file /var/spool/mail/rpc /var/spool/mail/rpc: empty
The email I have received disappeared!
I hope this is not a security BUG which can make my VPS unsafe.
But, the most important thing is: I want to know how it could be happened? What is the mechanism behind it?