lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: michael at bluesuperman.com (Michael Gale)
Subject: Block notification / bounce mails (as in
 DDOS)

Hello,

	Well if the mail server was a postfix box properly configured on decent
hardware you should not be able to get DDOS. I have seem postfix servers
handle 10,000 messages an hour (166.6 messages a minute, 2.7 per
second), so the TCP connections from the remote servers will most happen
for 3days on average because the remote server(s) will most likely keep
trying to send the message. 

So "REJECTING" or "BOUNCING" them will not solve the problem, to solve
the problem and the messages can in no way be handled by the Exchange
server I would add a filter to DISCARD all messages from
"MAILER-DEAMON".

Since this is a bounced back message it will most likely be small in
size, so rejecting the mail or having your ISP block port 25 at the ISP
level is not going to solve the bandwidth problem.

Michael.


On Thu, 01 Apr 2004 16:05:51 +0200
Security <koen4security@...mail.com> wrote:

> Hi,
> 
> Recently, this question popped up during my job interview
> 
> <question>
> What would you do when a spammer uses your mail-address as the "From:"
> and the mails that are sent by the spammer get all bounced back by
> legitimated mail-servers to your mailhandlers? All the bounces would
> return to you - as you are the 'from' (assume a rate of 1.000 a
> minute) and this traffic would kill your network-connection. You
> wouldn't be able to receive any mail because your mailserver can no
> longer handle the load</question>
> 
> I had a 'Dilbert' reaction in the sense that I couldn't come up with a
> decent answer (needless to say their impression indicated that I
> should not expect them to hire me). I could only offer these solutions
> :
> 
> * contact my ISP and search for a decent solution
> * put a notice on our corporate website and indicate that we are no
> longer available through mail on the old address but have a 'new'
> temporarily one* try to investigate, through the e-mail headers
> (allthough they could be fake), from where the original posts are
> coming and try to contact the isp of that netblock
> 
> What do you all suggest to this 'seemingly' DDOS-attack (allthough not
> 
> intended as a DOS)?
> 
> Greetings,
> 
> Koen
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html


-- 
Hand over the Slackware CD's and back AWAY from the computer, your geek
rights have been revoked !!!

Michael Gale
Slackware user :)
Bluesuperman.com 


-- 
Hand over the Slackware CD's and back AWAY from the computer, your geek
rights have been revoked !!!

Michael Gale
Slackware user :)
Bluesuperman.com 


Powered by blists - more mailing lists