Slashdot Mirror
Darkmail Attacks - The Next Network Threat?
An anonymous reader wonders: "SC Magazine are running an article on the growth of so called Dark Mail Attacks. Whitedust Security appear to have identified this as a potential problem way back in December 2004. Since that time, a marked increase in attacks of this nature, including the recent attacks on the UK Government infrastructure, have been recorded. Are these types of attack a new large scale threat or just a passing fad?"
I feel like I went to sleep and woke up in a Mad Max sequel.
Will always be a risk till humanity matures and has some global consciousness (or something of that sort) or if the vulnerability's are kept to a minimum to make the effort not worth pursuing.
Teach a man to Phish and he will pheed himself for life .
Close up the vulnerabilities and he he will starphe
The only things certain in war are Propaganda and Death. You can never be sure which is which though
FTFA: "Earlier this month SC reported some spammers are turning their back on the spam business. Self-d spam king Scott Richter has now been spam-free for over six months."
Seems incongruous to declare "spammers are turning their back on the spam business" in an article about a malicious new "brute force" spamming scheme that has grown "400 percent in the last twelve months according to a report from email filtering company Email Systems."
And and what does the writer of TFA base this notion, anyway? That one spammer (Richter) has been spam-free for six months?
Where's the beef?
Ignorance is curable, stupid is forever.
Honestly, the thing that gets me is that most firewalls block incoming, but allow all outgoing traffic. Why? Do you want the next virus to hit and email out as an attachment your word documents? They might have trade secrets, or your budget numbers, etc. Do they want an inside machine setting up a "hole" in the firewall to a IRC server? once they establish the connection from the inside, most firewalls will then ignore the stream. Force spammers to use real mail servers so that they can be appropriately blocked.
I have never had someone give me an intelligent reason on why outgoing port 25 should not be blocked. I've heard the argument about people running email on their broadband connections. (I do, and route outgoing through my ISP's SMTP relay server)
What are we going to do tonight Brain?
I wrote a series of articles in which I mentioned this problem, caused by many approaches to spam filtering. http://www.xciv.org/~meta/Technology/2005-02-14-di smal.html
Basically, spam is an economic problem. Attempts at a technological solution usually involve filtering spam. Since a filter can never be 100% accurate, as filters are deployed the volume of spam increases. So basically, filters "work" as long as most people aren't using them; once they become widespread, the spam volume goes up and up until the network collapses under the bandwidth load (or we try a different approach).
As I conclude in my article, attempting to analyze logically from first principles, the only type of solution which will work is an economic one. Unfortunately, most people dismiss economic solutions out of hand. They're too attached to the fundamentally broken economic model of today's e-mail.
Ironically, the same people often express surprise that the RIAA can't see how broken their economic model is...
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
This so-called darkmail isn't really new, it's merely a derivative of the age-old mailbomb. Certainly it can easily be defended against by using anti-mailbomb techniques like rate limiting and address limits. Too bad for you if you use Exchange but, the likels of Postfix or GroupWise make this idiot proof. The "problem" can further be mitigated by using RBLs at the SMTP level, before message transfer. That means, connect, check RBL, tell spammer 5.5.4 Piss Off, disconnect.
Even if your spam filtering has achieved 100% reliability, highly unlikely, why let them consume your bandwidth with stuff you'll throw away? Some people don't like the idea of RBL blocks at the SMTP level but, if you are going to use RBLs at all, why not at the SMTP level?
No kidding. Darkmail. It sounds like something I'd take along with my vorpal sword, and +10 boots of speed.
concrete5: a cms made for marketing, but strong enough for geeks.
Seriously, some of us don't go about it the way you do. I provide private email services to friends and family... that involves not having to constantly circumvent the crap others put in our way. Plus, this way, they don't have to worry. I won't sell them out to spammers, pharmers, phishers or ass monkeys at the M$ marketting department. In return they behave, or I can their asses if they send spam. (I also do a far better job of keeping them spam free and keeping their service running... FAST...)
The machine in question is a full smtpd/popd server... plus web. I don't approve of being blocked... how about if they BLOCK ONLY windows machines? since most inept morons run windows, and the rest run macs. This way my bsd and linux rigs are safe and sound, without someone else restricting MY access that I've paid for.
" What luck for rulers that men do not think" - Adolf Hitler
DHA's are hardly anything new, nor is shotgun spam. Slow news day for SC magazine that they had to manufacture a new threat out of existing spammer behavior? In a way, these attacks are self-defeating against reasonably intelligent filtering. A DHA attack is a highly identifiable characteristic that lends itself to being blocked by source instead of the much more expensive header and content analysis. And if a spammer's stupid enough to send them all from the same network, there's traffic shaping solutions now that will make all that spam pile up on his side, not the receiver's.
Especially hilarious are mails from admin@mydomain telling me that my account has just been suspended..
Basically, you configure spamdb to greylist unknown senders, and provide it with a huge list of "spamtrap" addresses, which are invalid email addresses not actually used in your domain.
GREYTRAPPING
Any source which tries to email to a spamtrap address is temporarily blacklisted, just like how SpamCop's SCBL reacts to a message to a spamtrap.
Recent enhancements to 'pf' provide for rate-limiting connections based on the source IP, in addition to the regular bandwidth shaping features. With minimal effort you can configure an OpenBSD mail gateway or router to ensure that you waste as much of the spammers time as possible, while expending the least amount of your own effort and bandwidth.
I do not deploy Linux. Ever.
From the article:
Darkmail is primarily used in distributed denial of service (DDoS) attacks and directory harvest attacks (DHA) in which a specific domain is hit with a flood of emails through an alphabetical list of names.
But over the last year darkmail is being used to brute-force spam through filters and is clogging up bandwidth.
Basically, it seems that darkmail is bulk mail sent to a domain with the advance knowledge that much of it will not reach a destination.
Suppose I setup a spamtrap of "george" because no one here uses that address.
But a legitimate contact makes a mistake typing the address and does send it to "george".
I would rather that it count the number of bad address attempts and blacklist the sender after X failures (5 for example).
But the failures would have to be counted as unique and across multiple connections. So resending to "george" 5 times won't lock them out. But making 5 connections with a single attempt to Al, then Bill, then Curtis, then Daniel, then Frank would blacklist them (within a set time period such as 5 or 10 minutes).
Actually, on that last attempt, I'd like it to receive the email and dump it into a special account so it can be forwarded to SpamCop and THEN blacklist it on my local server.
Why allow port 25 outgoing? My clients. They come in to my business and want to send their email. Guess what? Their corporate, locked-down laptop is set up to point to only their smtp server. VPNs are around 20-30% of the time, and so they end up needing to connect to their mail servers to send out.
Having port 25 open on an outgoing connection isn't that big of a deal if you monitor and control it. Virus scan both ways, rate limit max connections, etc.
-Barkeep, a draft of your most hazardous brew, for the world is slowly stepping into focus, and I don't like what I see.
It can't be a fad. Geeks don't get fads.
twitter.com/gravitronic
Teach a man to Phish and he will pheed himself for life.
Close up the vulnerabilities and he he will starphe.
He is a fucking commusnit, but this is hilarious.
This has been going on for YEARS. I have one domain name with 5 real users on it and I am getting blasted constantly with unknowns. Not 10 million but more like 25k a day.
There are ways around it.
1. If you're using SpamAssassin monitor what email addresses are getting hit as unknowns. If one gets say more than 20 hits add it to the blacklist to. That way if a real address gets the message and has one of those cc'd it will get tagged. I figured if they send to a common unknown it's probably safe to blacklist it.
2. If your MX's can do it send them a list of valid accounts. That way you don't have to reject unknowns from your secondary and they don't have to try to send you the email.
3. Another is to create a perl script that tails the maillog. Then once a rejected message is seen ban that IP address to port 25. It won't ban it until after that message is complete but you won't get repeat connections. I've set up a rolling filter of sorts that will remove the bans after a while. It sounds bad but it works. I went from 25k of rejected a day to 14k or less. It also doesn't hurt normal email as they will either queue or hit your secondary. Sure greylisting works like this but I hate filling up my logs and wasting traffic.
Just some thoughts. Pick em apart but they work for me.
Tell the fscking idiots to stop buying from spam! if the economics of the industry fail, then we'll stop seeing spam. Spam only around because people BUY FROM IT.
So true...and this axiom can be applied to other entities as well...RIAA/MPAA for example. It's all economics.
From TFA, end of the fourth paragraph:
This clearly identifies the problem with most spam filters: they ain't got no soul.