Denial-of-Service Spam Attacks

Spammers sometimes send a flood of traffic that overwhelms an email server.  The result is sluggish email delivery, delaying legitimate messages from reaching their intended recipients on your network.

This sluggish effect is compounded if your mail server queries a free DNS blacklist server such as Spamhaus and Spamcop.  These servers are usually distant and response times to each query may add several hundred milliseconds.  Also, these servers may slow down their response time if too many queries originate from your mail server in a short period. 

Having these IP sessions active during a denial-of-service attack will quickly exhaust a machine's network resources and your mail server may become unable to receive inbound connection attempts from legitimate sources.  In extreme cases, a mail server can crash when system resources are depleted.

CMS technicians have detected among customers at least three situations that give rise to a DoS spam attack:

	Botnets A large number of PCs are unknowingly infected and participate in what is know as "botnets".  Under spammer control, the PCs can send millions of spam messages. One CMS customer used XE-Filter to block 1.3 million botnet generated email messages in a single 24 hour period.
	NDR Blowback (Backscatter Spam) When their domain name was hijacked by a spammer, a CMS customer blocked 1.1 million NDR messages in a single day.
	Directory Harvesting While not technically a spam attack, spammers connect to a mail server and use a dictionary of common names and their variations to determine if the auto-generated email addresses are valid. Directory Harvesting Examples Mike.Smith@YourDomain.com MSmith@YourDomain.com Smith.Mike@YourDomain.com SmithM@YourDomain.com Multiplying this by millions of test addresses and with connected sessions lasting hours will produce the same effect as a DoS attack.

For Exchange 2003 sites, recipient filtering and the "Tar Pit Technique" are Microsoft's solutions to Reverse NDR and Directory Harvest attacks.

CMS Technicians do not recommend following this tactic since it slows SMTP operations, stretching the connection time of the mail session.  In the event of a DoS attack, the Tar Pit will quickly consume a mail server's resources.

Microsoft themselves are aware of the limitations of the Tar Pit Technique and issued this warning...

Any mail server can be the target of a DoS spam attack and often the early stages of the attack are unnoticed until real damage is done to your email communications.  Symptoms include...

XE-Filter protects your email server from a DoS spammer attack before any damage is done.  It will filter incoming messages at the SMTP protocol level and "prevent" reception of unwanted email.