lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
From: koen4security at hotmail.com (Security)
Subject: Block notification / bounce mails (as in DDOS)

Hi,

Recently, this question popped up during my job interview

<question>
What would you do when a spammer uses your mail-address as the "From:" and the 
mails that are sent by the spammer get all bounced back by legitimated 
mail-servers to your mailhandlers? All the bounces would return to you - as 
you are the 'from' (assume a rate of 1.000 a minute) and this traffic would 
kill your network-connection. You wouldn't be able to receive any mail because 
your mailserver can no longer handle the load
</question>

I had a 'Dilbert' reaction in the sense that I couldn't come up with a decent 
answer (needless to say their impression indicated that I should not expect 
them to hire me). I could only offer these solutions :

* contact my ISP and search for a decent solution
* put a notice on our corporate website and indicate that we are no longer 
available through mail on the old address but have a 'new' temporarily one
* try to investigate, through the e-mail headers (allthough they could be 
fake), from where the original posts are coming and try to contact the isp of 
that netblock

What do you all suggest to this 'seemingly' DDOS-attack (allthough not 
intended as a DOS)?

Greetings,

Koen


Powered by blists - more mailing lists