joe job mitigation

["lsi" <stuart () cyberdelix net>]

the surface: a POP3 "catch-all" mailbox

the problem: fallout from a (small) joe job attack - 6000 bounces in 
the mail queue, mixed with normal mail, from all over the internet

aggrevating circumstances: a spam filter which takes 5-10 seconds to 
process each bounce

potential consequences: day-long denial of email service on all mail 
accounts due to POP3 client waiting on the spam filter on this one 
mailbox

the solution: 

1. in my spam filter, whitelisted postmaster@ and mailer-daemon@ - 
this caused all the bounces to be processed immediately instead of 
being checked for spam - the spam filter was catching some bounces 
for me which was nice, but it was too slow.  So I let them all 
through.

2. ran my inbox cleaner, it's already programmed to delete bounces:

- mailx 0.07 Aug 29, 2006 00:25:26 [kill_bounces]: 5312 messages 
killed (5994 messages total) [hitrate: 88.62196%]

3. (optional - I tried it, can be fun) go drink beer with mates.

notes:

- while Non-Delivery Receipts (NDRs) pose a threat, in terms of 
denial of service after a joe job, their predictability makes them 
easy to filter.  This substantially reduces the potential for a joe 
job to cause sustained damage.

- Challenge/Response systems are more problematic than NDRs.  These 
systems have no standard format and thus are more difficult to 
filter.  In particular, CR makers could mitigate the risk of their 
systems being used as a weapon by utilising the standard "mailer-
daemon" string in their From: fields.

- most of the remaining 12% of mail seems to have vanished in the 
nightly cleanup event, presumably due to matches with other rules.  
Ah well.  Will have to wait for the next one to collect some more NDR 
strings.

- I wonder if I can analyse the bounces, extract IPs and map the 
botnet?  That might be fun too.

---
Stuart Udall
stuart at () cyberdelix dot net - http://www.cyberdelix.net/

--- 
 * Origin: lsi: revolution through evolution (192:168/0.2)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/