Our reader (and podcast listener) Pete wrote in with a little SMTP log snippet:
2012-11-04 22:37:36 courier_login authenticator failed for 153.red-2-139-216.staticip.rima-tde.net ([192.168.2.33]) [2.139.216.153]:4232: 535 Incorrect authentication data (set_id=anna) In this case, the attacker is '2.139.216.153'. According to our DShield data, the host has a history of port 25 scanning, and evidently, participates in these brute force attacks once it finds port 25 open. (see https://isc.sans.edu/ipdetails.html?ip=2.139.216.153 ). But this is just one of many IPs that Pete sees coming into his network. They all use "192.168.2.33" as hostname, which appears to be hard coded into the bot used to produce these scans. Typically, these scans try to brute force SMTP credentials (not POP/IMAP credentials) to send spam via your users e-mail accounts. A few tips to help mitigate these attacks:
Any other ideas? FWIW: I do not recommend strict "lock out" policies for mail servers. They can make it impossible to change your SMTP password. Many users will use multiple devices these days, and if you for example lock an account after 3 bad logins, a user changing a password will be locked out as the users cell phone / tablet will continue to use the old password until it is changed. If you do implement lock out, then please communicate this to your users and ask them to first turn off all devices (that can be challenging as they may not even remember which devices they have) and then change their password.
------ |
Johannes 4072 Posts ISC Handler Nov 5th 2012 |
Thread locked Subscribe |
Nov 5th 2012 8 years ago |
Fail2Ban does the trick for me. Using a policy of 10 failures == 60-minute IP block tends to make these bots drop away over time, and doesn't cause legitimate users too many issues.
|
Peter Bance 9 Posts |
Quote |
Nov 5th 2012 8 years ago |
Location
IP reputation (both the attacker and yours) 192.168.2.33 might not be the only thing hard coded in the bot (can't tell from just those logs) A computer trying to login with many different usernames probably significantly adds to the idea it is malicious. NIDS could detect the password guessing attack, and probably be created to detect outgoing spam messages |
Peter Bance 15 Posts |
Quote |
Nov 6th 2012 8 years ago |
"submission" (tcp/587) is also used for distributing SPAM.
We had some bots in our network that used this already. |
Jens 42 Posts |
Quote |
Nov 6th 2012 8 years ago |
Sign Up for Free or Log In to start participating in the conversation!