5

My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, fenix, clamav, emily, wwwrun, etc). Every attempt follows the same exact pattern, trying the username as the password, then username1, then username123, then 123456. After that my server blacklists the IP and rejects all further requests from that IP.

This seems like the most useless attack ever. What could they possibly be hoping to accomplish? Originally there was a configuration error that resulted in my mail server rejecting mail from my spam proxy due to the attack, but I fixed that a while ago and yet they still continue the attempts.

It's not bothering my server any since the requests are fairly slow and not any particular volume. It's got zero chance of finding a working username that way, particularly since all my domain's that are handled by this mail server are very small (like 5 or 10 users total). It's burning through a bunch of botnet nodes that can get reported. It seems like an excessive amount of cost (revealing IPs containing bots) relative to the very limited chances of getting a benefit (based on how limited the scan is). Is this kind of thing just common on the Internet and somehow my server has stayed under the radar from it so far (despite being up for 10+ years and previously having a relatively high popularity site on it)?

4
  • Is the attack happening on SMTP, POP or IMAP? Or some combination of those?
    – Ladadadada
    Feb 14, 2014 at 19:07
  • SMTP, updated question with that detail as well. Feb 14, 2014 at 19:14
  • the chance is NOT zero unless you have ZERO users. very very small maybe but not zero.
    – Skaperen
    Feb 14, 2015 at 12:17
  • @skaperen Actually there is zero chance because they try the same series of passwords and are blocked before they ever get to a valid password since the initial guesses don't meet complexity requirements. Feb 14, 2015 at 15:32

2 Answers 2

3

These attacks have little to no cost and risk to the attacker. Imagine if the attacker has control over a botnet of a few thousand computers. That's at least a couple thousand tries for username+pass. If it picks the most common usernames and passwords it has a chance (small, but still not none) of getting access to your system.

While you may not have anything particularly valuable for them to steal, they now have 1 more computer, which they can use to compromise others, whom might actually have valuable data.

If this is being done over hundreds of thousands of domains the chances of getting access to at least a few is pretty good.

No cost + No risk = Lots of Attempts.

They're probably checking your mail server because they might have more lax password timeouts. There are a lot of people who reuse passwords too, so they may get lucky.

4
  • 1
    Wouldn't there be risk in that the behavior is easy to notice and report though, thus potentially costing them bots? Feb 14, 2014 at 19:39
  • They also are not trying different passwords or even trying the same user with more than those 4 passwords. I could understand if they were trying the same username again with different passwords but there is no repeat of the username after the IP block. I suppose it could just be a really dumb attacker though that took a very boneheaded approach that is least likely to succeed of any possible brute force attack. Feb 14, 2014 at 19:41
  • It's low cost because most victims won't detect it. Even with those who do, fewer will report it (to ISP). Then the ISP has to get that info to the customer, who may not care or understand what's wrong. This requires a lot of people, and if one person blows it off, then it doesn't get fixed. If it does get fixed, it can take weeks or months. By that point the system could have compromised multiple other systems.
    – Daisetsu
    Feb 14, 2014 at 19:45
  • 2
    I guess maybe they just have more nodes than they care about or don't think as tactically as me, but if I was running a bot network, I'd want to focus on servers that have weak security and are unlikely to report or block my nodes so I can get more bang for my buck before my node gets blacklisted. If someone is blocking after 3 attempts, chances are good their security policy is decent enough to prevent the username from being used as the password. I guess I may just be giving too much credit to their intelligence though. Feb 14, 2014 at 20:07
1

This is probably an instance of a "low and slow" distributed brute force attack, which is the latest evolution of password-guessing attacks attempting to login and compromise internet-connected computers. The most publicized and studied instance of this that I know of is the Hail Mary Cloud botnet. It sounds like a particularly badly done attack of this type, but there's nothing saying an attacker needs to be competent... and it's unlikely your small domain was the only target.

Longer explanation, below:

As I'm sure we all know, computers connected to the internet are subject to a large number of attackers making unauthorized login attempts on well-known ports, known as "rapid-fire brute force attacks," where an attacker will throw as many login attempts, as fast as they can over SSH, RDP and VNC (etc.) at basically any and everything they can find.

Since this has been going on for many years, these attacks are well known, easy to mitigate, and increasingly ineffective. I recall reading somewhere about a security study which pegged the average time between a new computer going online and its first unauthorized login attempt being less than 15 minutes. As a result, these days, it's practically a default configuration (or actually is a default configuration with many providers) for a new internet-facing machine to have some mechanism to drop traffic from an IP which has too many failed logins in a period of time.

So, the attackers have evolved.

Instead of using the "rapid-fire" brute force attack that basically has no hope of working anymore, attackers will get a large number of machines under their control (usually by renting a botnet), distribute their user/password lists, and the machines will start trying to connecting to remote computers and login. To a single attacked host, the attacks are so low intensity that they usually go unnoticed. Even when they are noticed, usually the only result is an admin scratching his head, wondering what happened, or what the point was. In aggregate, however, using relatively common user/pass combinations, from a large number of zombie machines, against a large number of targets, is successful enough to justify the cost of the attack, which is actually not all that high, considering what a botnet of compromised home PCs can be rented for.

As to why SMTP rather than SSH, also an evolution, and for the same reasons. People have caught on to the fact that people are going to try to break in over SSH. So, now these attacks come targeted against just about anything you can imagine. There's more than one way to compromise a machine, and everyone pays attention to login attempts on SSH, but monitoring Joomla for failed logins isn't that widespread.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .