full-disclosure - Block notification / bounce mails (as in DDOS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <406C3EC5.5090701@compt.com>
From: twkonefal at compt.com (Tomasz Konefal)
Subject: Block notification / bounce mails (as in DDOS)

Security wrote:
> Hi,
> 
> Recently, this question popped up during my job interview
> 
> <question>
> What would you do when a spammer uses your mail-address as the "From:" 
> and the mails that are sent by the spammer get all bounced back by 
> legitimated mail-servers to your mailhandlers? All the bounces would 
> return to you - as you are the 'from' (assume a rate of 1.000 a minute) 
> and this traffic would kill your network-connection. You wouldn't be 
> able to receive any mail because your mailserver can no longer handle 
> the load
> </question>
> 
> I had a 'Dilbert' reaction in the sense that I couldn't come up with a 
> decent answer (needless to say their impression indicated that I should 
> not expect them to hire me). I could only offer these solutions :
> 
> * contact my ISP and search for a decent solution
> * put a notice on our corporate website and indicate that we are no 
> longer available through mail on the old address but have a 'new' 
> temporarily one
> * try to investigate, through the e-mail headers (allthough they could 
> be fake), from where the original posts are coming and try to contact 
> the isp of that netblock
> 
> What do you all suggest to this 'seemingly' DDOS-attack (allthough not 
> intended as a DOS)?

   first off, the From: header would not normally be the one emails get 
bounced to.  rather, it would be the "MAIL FROM" envelope header.  in 
any case, my 'solution' would be to temporarily drop all mail destined 
to this deluged account to /dev/null and set up a new account for the 
busted user.  you could alternatively set up a "user relocated" reply on 
the server or just kill the account altogether and send responses of "no 
such local user".  you get the general idea.  not a great solution, but 
only one person's email is crapped out instead of everyone's.  when the 
DDoS looks like it's petering away you can set up an alias from the old 
to the new account to reenable legitimate mails to get to the user.

cheers,
   twkonefal

-- 
Tomasz Konefal
Systems Administrator
Command Post and Transfer Corp.
416-585-9995 x.349