WARNING: A new attack to watch for

[Bill Cole]

One attack that has become common against Exchange servers is an AUTH 
password crack. This is currently hitting Exchange mostly because for 
some reason Windows admins seem to almost universally leave default 
accounts with default passwords in place, but it is a simple brute 
force attack that could be used on ANY mail server supporting AUTH 
for relay permission. The lines to look for in the logs are:

20:52:27 1 SMTP {username} AUTH failed: password(badpassword) is 
wrong. Connection from [10.1.1.1:50482]
20:52:27 4 SMTP-094([10.1.1.1]) Sending 535 authentication failed\r\n

If Stalker is still willing to enhance SIMS, a good response would be 
to approach AUTH failures in a similar way as bad/spamtrap RCPT 
failures are now handle: after a few from the same IP in a short 
time, start playing games with it. The server could even fake success 
on the 4th bad try then 5xx every command.

For now, it is probably a good idea to start looking for those 
telltale signs in your logs.

--
Bill Cole
[EMAIL PROTECTED]
#############################################################
This message is sent to you because you are subscribed to
 the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to  <[EMAIL PROTECTED]>