Re: Subscription bomb tracing - feature request.

[bmueller () CREOTECH COM (Brian Mueller)]

Most systems have some option to log the IP address and/or hostname of the
attacker.  However it has been my exprience that when someone really wants
to "attack" someone they will use one of the _very_ few email systems which
still do not verify the user (i.e. no HELO and they accept anything you send
them).  It wouldn't be too hard for an attacker to use one of these such
systems to make it seem that the request came from satan.hell.hot
(666.666.666.666) or some-such.

Also, I have a mailing list which I wrote in PHP3.  It logs the applicants
IP address and Hostname to the database when it receives a request, along
with a randomly generated, unique 8 digit ID number.  When someone signs-up
for the list a confirmation mail is sent to them.  At the bottom of this
confirmation message is a short disclaimer/legal notice along with
information on how to report abuse using the 8 digit number.  I personally
want to centralize all abuse cases with myself.  The user reports abuse
based on the 8 digit number and I look that up in the database to find out
where the user was added from.  In this way I can do much more than just
stop a single user, I can see if a set of IP's is attacking often - and ban
them, etc.  I think this is the best setup because the burden shouldn't be
placed on the user to find out who the abuser is.

B

----- Original Message -----
From: "Alan Brown" <alan () MANAWATU GEN NZ>
To: <BUGTRAQ () SECURITYFOCUS COM>
Sent: Monday, January 03, 2000 9:15 PM
Subject: Subscription bomb tracing - feature request.

> There have been quite a few subscribe bombs tossed around recently.
>
> While it's nice to see that most mailing list admins use confirm
> requests now, it would be a great help if the confirm requests contained
> at least the headers of the original request, to aid victims in tracing
> their attacker(s).
>
> One attack recently notified to ORBS attempted to sign the victim up to
> 26,000 different lists via insecure email relays.
>
> The confirmation requests alone constituted a fairly substantial denial
> of service attack, as did the huge number of bounces the victim got.
>
> I've only ever seen one mailing list which actually showed where the
> signup request came from. Times are still changing and adding an audit
> trail would make life easier all round.
>
> AB