[9844] in bugtraq
SMTP server account probing
daemon@ATHENA.MIT.EDU (Brett Glass)
Tue Mar 9 11:49:21 1999
Date: Mon, 8 Mar 1999 12:13:22 -0700
Reply-To: Brett Glass <brett@LARIAT.ORG>
From: Brett Glass <brett@LARIAT.ORG>
To: BUGTRAQ@NETSPACE.ORG
Several ISPs throughout the Net are reporting an attack described at
http://www.l8r.com/nwa/nwa1.htm
In this attack, an SMTP server is probed for common names, presumably
so that spam can the be targeted at them. The attacking machine
connects and issues hundreds of RCPT TO: commands, searching a long
list of common user names (e.g. susan) for ones that don't cause
errors. It then compiles a list of target addresses to spam.
Unfortunately, the attack -- besides allowing the perpetrator to spam
users -- also brings SMTP servers to their knees. This happens most
often if the server maintains lists of user names in a database where
looking up a name requires substantial disk activity or computational
overhead.
Some people whose domain names have been hard-coded into a commercial
program designed to implement this attack have responded with outrage,
e.g.
http://www.junk.org/earthonline/
I'm surprised that I haven't seen this one on the Bugtraq list yet.
--Brett Glass
