same thing, over again
end
-------------------------------------------------
Greg Albrecht Safari Internet
System Administrator Fort Lauderdale, FL
[EMAIL PROTECTED] www.safari.net
+1[888|954]537-9550
-------------------------------------------------
---------- Forwarded message ----------
Date: Mon, 8 Mar 1999 12:13:22 -0700
From: Brett Glass <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: SMTP server account probing
Several ISPs throughout the Net are reporting an attack described at
http://www.l8r.com/nwa/nwa1.htm
In this attack, an SMTP server is probed for common names, presumably
so that spam can the be targeted at them. The attacking machine
connects and issues hundreds of RCPT TO: commands, searching a long
list of common user names (e.g. susan) for ones that don't cause
errors. It then compiles a list of target addresses to spam.
Unfortunately, the attack -- besides allowing the perpetrator to spam
users -- also brings SMTP servers to their knees. This happens most
often if the server maintains lists of user names in a database where
looking up a name requires substantial disk activity or computational
overhead.
Some people whose domain names have been hard-coded into a commercial
program designed to implement this attack have responded with outrage,
e.g.
http://www.junk.org/earthonline/
I'm surprised that I haven't seen this one on the Bugtraq list yet.
--Brett Glass
