This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SMTP Attack?

So for the past couple of months I have noticed our business DSL get completely saturated and basically stop working.  This behavior lasted for a couple of hours and then stopped.

Now it's back with a vengeance.  For the past 3 days our internet has been fully saturated.  I did a wireshark on the external interface and with my little knowledge of wireshark it looks like several yahoo mail servers are sending significant amounts of data our way.  To give you an example we are a 10 person company and our SMTP log for TODAY ONLY is 100MB.

I looked through the log and it looks like a directory harvest attack since all the emails are coming to unkownuser@ourdomain.com.

Another interesting item is that on the dashboard, if I look at the throughput graph, it shows that my External Interface "Out" is what is spiking up to 648Kb (our upload is only 384Kb).  I initially thought that this might be a virus on one of the machines on the LAN but the internal interface traffic is negligible (21Kb).  However with the info I gathered today I started thinking that maybe Astaro is sending undeliverable messages back to the spammers?  If have tried looking for a way to verify this but couldn't find it.

Lots of thoughts and I am really hoping that someone out there may have encountered this in the past.

We are running ASG 7.502.

Thanks in advance!

This thread was automatically locked due to age.

Parents

0 BAlfson over 15 years ago

With that volume, it could be an attack by a bot-net using forged "From:" addresses. If you aren't sure how to read the headers, please post two here - taking care to disguise your own IP and domain. We can go through them and leave a "How-to" for future Astaro users with the same problem.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 15 years ago

With that volume, it could be an attack by a bot-net using forged "From:" addresses. If you aren't sure how to read the headers, please post two here - taking care to disguise your own IP and domain. We can go through them and leave a "How-to" for future Astaro users with the same problem.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 risaac over 15 years ago in reply to BAlfson

Thank you Bob! I just saw this so I apologize for the delay in response. We are continuing to be attacked. I have included an screen capture of the summary report showing the offending servers...You will notice (and this is the scariest part) that the Astaro is actually sending out A LOT of packets on its own...Almost like it is responding to the attack. We have enough download speed to handle the attack but the upload is killing us. If there is a way to make the Astaro silent that would be ideal!

Thanks Whity! I tried to write to yahoo! and they basically told me that its not their problem and that I should try to figure out what the offending ISP is of the spammer and talk to them. Definitely not very helpful.

Here is a bit of the log...

This is just one of the many pieces of SPAM:

2010:02:13-04:03:55 Astaro_ASG exim[20706]: 2010-02-13 04:03:55 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="93.157.167.64" from="svflq%40yahoo.com" to="svfluid%40mydomain.com" size="-1" reason="rdns_helo" extra="RDNS missing"

2010:02:13-04:03:55 Astaro_ASG exim[20706]: 2010-02-13 04:03:55 H=(microsof-062e73) [93.157.167.64]:2501 F= rejected RCPT : No RDNS entry for 93.157.167.64

2010:02:13-04:03:55 Astaro_ASG exim[20706]: 2010-02-13 04:03:55 SMTP connection from (microsof-062e73) [93.157.167.64]:2501 closed by DROP in ACL

2010:02:13-04:03:55 Astaro_ASG exim[12254]: 2010-02-13 04:03:55 Connection from [95.170.219.61]:26325 refused: too many connections from that IP address

2010:02:13-04:03:55 Astaro_ASG exim[12254]: 2010-02-13 04:03:55 Connection from [117.18.229.27]:40720 refused: too many connections from that IP address

Lots of these as well...

2010:02:13-04:00:42 Astaro_ASG exim[15291]: 2010-02-13 04:00:42 11ofhX-0003FT-24 d.mx.mail.yahoo.com [209.191.88.254]: Broken pipe

here is a bit from wireshark...
Get a piece of SPAM from yahoo!

301	2.481991	67.195.168.230	my.mail.server	TCP	smtp > 54946 [ACK] Seq=1 Ack=15929 Win=60816 Len=0 TSV=3392162710 TSER=909752583

Astaro replies with...

302	2.482978	my.mail.server	67.195.168.230	SMTP	C: 8X54uRe9FOLT51OV+o | nBHaTeippBcdIyq90VeW+PCfs3zLn+PZDFV5TvTKvYqq5x2s4cOf8kEc51RfnG1opvRHkBGHY1+C | inANwtxATVIrlQKKDipWCqxP//aefr/UTtt2AQbFTFuHJmdTA5HxTbmKMSzuANhDzPxZ4DnEgBoG | T9eGOgZO148b8dky95O+tDyd5FlaUDnm7S2Ye+NaRWz9ZKsctUH5gd3LY8fjqN42m3BgrisP3n1f | kDL+cVeUxXOHHv91ecjcHLt7IP8jSAwXytuVEvHiSqrIwPXt1aKywdIsrSI+2RPxAbtfgVHw/Hkq | Idl1AlWrUwBCP5+zmbOEh1X1te1FILe2PXZ/8m7zojnSn/zJvTarT6v1wMEv60MO03l8HTG8XJ1X | dBxRa9WivqbCEFFaGG1VKFXwPQCxR4WL9LjFVflXTC0H5f9Vl46qHNAhhycYuI5sv0fBmqnpAdqT | yDwGV8XWtPve3opfCLVELxolwM+QfxVrSMlp6NS8e7zRpOq4p2MHs+KiPlsdn4c8KyWzw8nhbutu | PDvP1Hxjq4iXPHxmGD0OvQ7G4F4OdQ7+qxHUWHKr0vsU2a9/H2hbC69uPZfOvfwaMix9JjvPvWKA | fvKr2HtRihv6mn5mOL5Xw9W4je/hisajgMCAAqkAAAAADHIEAAD6NwEAAQEhAFMDpkYAAFkkX40i | pKkJFTFE6AeA4AWAAAKAGAEAJf//pFBICRTCoDFwVoXo5DOjjQ3OOSemIBNHaOYpxUCQ7DwKZA0j | Zh7+GZPMLSfgbMNxUsVKZLBuFQ5t2E65g8as71UOCQ7DthCjC5pgDYVTDI0hS1eqUl1QNIDtYnWZ | nY7S2kJch3vrXgQ78dh+s7DOosiWFuQKGebvVlIwh+JMRdJCnbRz/FqiZLybJJRiwqkJPUEBCZBw | OTRQHDTY7TU1MMYTAGsTeVFWqVj4PMRcJx7UuF8JieSw1Qk2sokIrCBeVEGoCJqLuK29My6lYFLU | UAU3v4gmACqUPpKAtLK2HSWRKJtMDTE+00C+9CeEdHQ02TbwoCMPTM93glln8lWlgGhcLg/6Z1cW | mLtNMGYqDPO46+mhRUuESw+v6lnKabci8002aqRcDUtaqoCjq7Iq47TAAgOxmx+he2CAFmJJJdC2 | cx/lMwy6Kcy2KCLJGRqIjd+ssIyX8TFdJOIoBLJNJNMJqZGF8NpiBXufVcBcSSgZsM4cGZ+FaFza | DSsTM7fv10MoKVFMLATMBymAQm+ec5ZUGCoZdYpjyUCCIhGoS1G9VHRFxFG1hPPWSeylMuljneiP | h9abchrzThn6UuvWbxYWEcLoKx23TKATiNWymwB4G+3OYuJDpItZJwBoFmSLeE3/TAWEXKhJZYTI | DebzeyjCwj2wrDg/GLUNUuut

The wireshark capture is filled with these...Any thoughts would greatly help!