full-disclosure - Block notification / bounce mails (as in DDOS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <005f01c41804$c48b8430$1214dd80@corp.emc.com>
From: exibar at thelair.com (Exibar)
Subject: Block notification / bounce mails (as in DDOS)

Pretty much a no win situation.  Mail performance WILL be impacted, period.
Nothing you can do about that.... BUT:

  A possibility that I'd try first, remove my e-mail address from the
internet mail connectors and allow any mail coming to me (the person in the
FROM on all messages) to bounce back.  That should be certainly easier to
handle on your mail server as the messages are never scanned for content
(such as a subject line) they are simply bounced and done with.  Internet
performance will be slowed though.... nothing you can do about that except
for the next solution.....

  Last ditch effort :   The traffic is coming from ANYWHERE on the i-net.
The only thing you can do is shut off mail traffic going to your company at
your ISP, zero port 25 traffic is allowed from your ISP to your site.  At
least that will keep all other systems functioning and allow you to ship
product and take web orders if needed.  The traffic will subside, then you
can turn on outside mail traffic again.

Exibar

----- Original Message ----- 
From: "Security" <koen4security@...mail.com>
To: <full-disclosure@...ts.netsys.com>
Sent: Thursday, April 01, 2004 9:05 AM
Subject: [Full-Disclosure] Block notification / bounce mails (as in DDOS)

> Hi,
>
> Recently, this question popped up during my job interview
>
> <question>
> What would you do when a spammer uses your mail-address as the "From:" and
the
> mails that are sent by the spammer get all bounced back by legitimated
> mail-servers to your mailhandlers? All the bounces would return to you -
as
> you are the 'from' (assume a rate of 1.000 a minute) and this traffic
would
> kill your network-connection. You wouldn't be able to receive any mail
because
> your mailserver can no longer handle the load
> </question>
>
> I had a 'Dilbert' reaction in the sense that I couldn't come up with a
decent
> answer (needless to say their impression indicated that I should not
expect
> them to hire me). I could only offer these solutions :
>
> * contact my ISP and search for a decent solution
> * put a notice on our corporate website and indicate that we are no longer
> available through mail on the old address but have a 'new' temporarily one
> * try to investigate, through the e-mail headers (allthough they could be
> fake), from where the original posts are coming and try to contact the isp
of
> that netblock
>
> What do you all suggest to this 'seemingly' DDOS-attack (allthough not
> intended as a DOS)?
>
> Greetings,
>
> Koen
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>