You Might Be An Anti-Spam Kook If…

Bob — Sat, 06 Dec 2003 22:46:52 +0000

From Vernon Schryver:

“Each item in the following list was suggested by the words or actions of people who presented themselves to the IETF or elsewhere as having discovered the FUSSP. Some of the items may seem obscure to those who have not dealt with the IETF.”

http://www.rhyolite.com/anti-spam/you-might-be.html

This list should be required reading for anyone who think they have the “final solution” to spam.

db.org mail server used as spam relay

Bob — Mon, 24 Nov 2003 22:26:14 +0000

Introduction

The db.org mail server at 195.159.29.203 and 195.159.29.204 has been used as a spam relay from approximately 2003/11/25 19:00 UTC until approximately 2003/11/26 03:45 UTC (a total of a little under 9 hours). The problem has now been corrected, and no further spam should originate from this server. This page will be continuously updated as more information about the attack is uncovered. I (Bob Johannessen, postmaster@db.org) would like to apologise for any inconvenience this has caused.

The problem

The problem seems to have been with the password checker used for SMTP AUTH. The password checker used a different protocol from the SMTP daemon, and the brain dead password checker defaulted to “allow” when it didn’t understand its input data. This resulted in anyone trying to authenticate with AUTH LOGIN, using any combination of username and password, was allowed to relay mail.

The volume

Based on the queue sequence number of the first undeliverable message and that of the the last message, the total volume is estimated at about 14.000 messages. Of these 11.000 was already delivered when the problem was identified. The remaining 3.000 messages was removed from the queue. Total damage is therefore approximately 11.000 messages.

The attacker

The approximately 3.000 messages in the queue when the attack was identified originated from the following addresses.