Why would an attacker try to guess random email usernames on a small domain?

Question

My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, fenix, clamav, emily, wwwrun, etc). Every attempt follows the same exact pattern, trying the username as the password, then username1, then username123, then 123456. After that my server blacklists the IP and rejects all further requests from that IP.

This seems like the most useless attack ever. What could they possibly be hoping to accomplish? Originally there was a configuration error that resulted in my mail server rejecting mail from my spam proxy due to the attack, but I fixed that a while ago and yet they still continue the attempts.

It's not bothering my server any since the requests are fairly slow and not any particular volume. It's got zero chance of finding a working username that way, particularly since all my domain's that are handled by this mail server are very small (like 5 or 10 users total). It's burning through a bunch of botnet nodes that can get reported. It seems like an excessive amount of cost (revealing IPs containing bots) relative to the very limited chances of getting a benefit (based on how limited the scan is). Is this kind of thing just common on the Internet and somehow my server has stayed under the radar from it so far (despite being up for 10+ years and previously having a relatively high popularity site on it)?

Answer 1

These attacks have little to no cost and risk to the attacker. Imagine if the attacker has control over a botnet of a few thousand computers. That's at least a couple thousand tries for username+pass. If it picks the most common usernames and passwords it has a chance (small, but still not none) of getting access to your system.

While you may not have anything particularly valuable for them to steal, they now have 1 more computer, which they can use to compromise others, whom might actually have valuable data.

If this is being done over hundreds of thousands of domains the chances of getting access to at least a few is pretty good.

No cost + No risk = Lots of Attempts.

They're probably checking your mail server because they might have more lax password timeouts. There are a lot of people who reuse passwords too, so they may get lucky.

Answer 2

This is probably an instance of a "low and slow" distributed brute force attack, which is the latest evolution of password-guessing attacks attempting to login and compromise internet-connected computers. The most publicized and studied instance of this that I know of is the Hail Mary Cloud botnet. It sounds like a particularly badly done attack of this type, but there's nothing saying an attacker needs to be competent... and it's unlikely your small domain was the only target.

Longer explanation, below:

As I'm sure we all know, computers connected to the internet are subject to a large number of attackers making unauthorized login attempts on well-known ports, known as "rapid-fire brute force attacks," where an attacker will throw as many login attempts, as fast as they can over SSH, RDP and VNC (etc.) at basically any and everything they can find.

Since this has been going on for many years, these attacks are well known, easy to mitigate, and increasingly ineffective. I recall reading somewhere about a security study which pegged the average time between a new computer going online and its first unauthorized login attempt being less than 15 minutes. As a result, these days, it's practically a default configuration (or actually is a default configuration with many providers) for a new internet-facing machine to have some mechanism to drop traffic from an IP which has too many failed logins in a period of time.

So, the attackers have evolved.

Instead of using the "rapid-fire" brute force attack that basically has no hope of working anymore, attackers will get a large number of machines under their control (usually by renting a botnet), distribute their user/password lists, and the machines will start trying to connecting to remote computers and login. To a single attacked host, the attacks are so low intensity that they usually go unnoticed. Even when they are noticed, usually the only result is an admin scratching his head, wondering what happened, or what the point was. In aggregate, however, using relatively common user/pass combinations, from a large number of zombie machines, against a large number of targets, is successful enough to justify the cost of the attack, which is actually not all that high, considering what a botnet of compromised home PCs can be rented for.

As to why SMTP rather than SSH, also an evolution, and for the same reasons. People have caught on to the fact that people are going to try to break in over SSH. So, now these attacks come targeted against just about anything you can imagine. There's more than one way to compromise a machine, and everyone pays attention to login attempts on SSH, but monitoring Joomla for failed logins isn't that widespread.