IBM AH0QXML User Guide - Page 74

62

Lotus Domino 6 spam Survival Guide for IBM eServer

4.5

Protecting your Domino server from active address

harvesting attacks

In this section we introduce some of the active address harvesting attack types

that spammers use to obtain email addresses, and we give recommendations

and instructions on how you can protect your Domino 6 server from these

attacks.

4.5.1

SMTP harvesting attacks

The most insidious types of attacks can occur when spammers attempt to use

your SMTP mail server's directory against you. Spammers may use a

“

name

”

dictionary to send random name combinations as recipients of SMTP mail to

your mail server. They then harvest responses to these

“

dictionary

”

mailings to

build a list of valid e-mail addresses that can be sold or targeted for more spam in

the future.

For example, in its default setting, the Domino SMTP task attempts to return mail

that is undeliverable to the sender with a delivery failure message. When Domino

operates in this mode, the spammer can use returned information to

“

cleanse

”

their dictionary of bad addresses by tracking subject, sender, and recipient

information. Addresses for which the spammer receives non-delivery reports can

be removed from their spamming list; other addresses are maintained as valid

spam targets. This is called an SMTP Harvesting attack.

4.5.2

Spam mail bombing

In many cases the spammer is merely hoping that their e-mail address dictionary

will happen to have some valid addresses. In this case the spammer does not

usually provide valid return delivery information. This type of attack is known as

spam mail bombing. It represents a Denial of Service (DoS) attack because it

keeps your Domino SMTP server busy handling invalid e-mail addresses.

Indeed, this type of DoS attack consumes CPU and disk space as well, since

invalid e-mail that cannot be returned by Domino is marked as DEAD mail and

accumulates in the mail.box file.

4.5.3

Direct SMTP RCPT TO harvesting

Another variation of a harvesting attack occurs when a connecting e-mail sender

tests the response of the SMTP server to the

“

RCPT TO

”

command. Spammers

can use this automated technique to very quickly test thousands of addresses

without sending any e-mail. Spammers test the SMTP server response to the

RCPT TO command and when the response is

“

positive

”

for a good address, the

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 74

Protecting your Domino server from active address harvesting attacks

Page 74 highlights