Is it even possible?

Why wouldn't it be? Ubuntu is a really flexible system that shares many problems with most other operating systems:

• Software in Ubuntu can be exploited


• You don't need root to run a spam daemon.


• People can crack weak authentication


• Ubuntu users can be convinced into installing/running just about anything


• Once in, hackers can upload/remote-download more software to send spam

Let's just be realistic about security here. A cross-platform Flash exploit could easily translate into a dropper loading and installing a spam daemon that runs itself on login. It doesn't need root.

Double-check the ISP's story

"But my ISP wouldn't lie to me!" said nobody ever. Many home ISPs do habitually block port 25 and others force you to use their SMTP servers (that's the only outgoing p25 connection they'll allow).

Being a moderator allows me to see your IP and I've checked your home ISP. If you google their name and "port 25" or "smtp", you'll see a lot of other people in similar situations. And they do have a central SMTP server.

I know you said this is a new issue but just double check it's not your ISP (or needing the right settings while on your ISP). The workaround at the end should still work for you.

Finding the problem

Though possible, I'm still not sure it's the most likely target. If you're anything like me, you're surrounded by internet connected devices and you need to look at them all.

I would start by asking the ISP for some evidence. Timestamps at the bare minimum but it would be great to see what they're using to make sure it's not an auto-flag gone wrong.

• It could be that somebody has flagged a work email with the ISP's abuse department.

  
  



• You need to know what OS you were using at the time. Both Ubuntu and Windows keep auth logs so compare them against any evidence they can send you.

  
  



• Log outgoing port 25 activity with something like:

  
  

   iptables -I OUTPUT -p tcp --dport 25 -j LOG --log-prefix "mail connection"
  
  

  
  

  I'm honestly not sure if that will work if you're being blocked already but it's worth a shot. Various Windows firewalls will offer you various logging alternatives.

  
  



• Note that any device on your connection could be sending emails, not just your computer. Phones, wifi-enabled toasters, naughty neighbours, etc. Finding whatever is sending this mail could require a network level packet interception and logging. This is all possible but it's a pain in the rear.

  
  



• Once you've exhausted more likely avenues, take your pick of Linux antivirus software. I can't personally speak for any of them or their detection rates.

  
  

Working around a block immediately

If you need to carry on, the easiest way to carry on sending email is through some sort of obfuscated or encrypted connection. If you have access to a SSH server (eg at work) that can often be the best method.

ssh -D9100 user@host

Then just alter your email client to use a SOCKS proxy address localhost, port 9100. Your ISP won't be able to interfere with this and I'd be very surprised if whatever's sending the spam could guess the SOCKS configuration.

What's most likely in this case...?

Check to see if you can send email through your ISP's SMTP server. I've checked, yours has one. They might be forcing all their users to use it as that's very common. The tech support person might just be confused.

Ask another user (with another account, on another telephone line) to try connecting to your company's SMTP. This can be done quickly with telnet example.com 25.

• If they can't connect, assume this is ISP-wide —not just your account— so it's probably not a security issue... It's just something you'll have top work with or work around.

  
  



• If they can connect, you're back at square one. There has been something sending email from your network that has triggered your ISP to block you. Virus sweeps, traffic monitoring and paranoia are your best friends here.