Educause Security Discussion mailing list archives
Re: Combating directory harvests
From: Roger A Safian <r-safian () NORTHWESTERN EDU>
Date: Thu, 19 Jul 2012 20:11:22 +0000
It's getting more difficult to contain this data as more means become available for accessing it, but generally, we limit the returns to a search to 20 (or is it 25?) unique responses. Off campus searches have the email address obscured in a capcha like fashion. We used to manage our logs better in the past and would black list IP's that were obviously scraping our directory. We don't have the time to do this anymore. We have been replying on our anti-spam and proactive education solutions to prevent phishing. The number of victims remains low, so on some level I'd like to think our efforts are working, but, we may just be lucky.
-----Original Message----- From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Tyler T. Schoenke Sent: Thursday, July 19, 2012 2:44 PM To: SECURITY () LISTSERV EDUCAUSE EDU Subject: [SECURITY] Combating directory harvests I am wondering what other schools are doing to combat LDAP directory harvests. We are constantly hit with phishing campaigns. While some email addresses are grabbed via web searches, malware reading address books, or other means, I suspect email directory harvests account for a large percentage of the addresses used in phishing campaigns. Some ideas we have tossed around for limiting the harvests are: - Only allow email look-ups to campus address space and campus VPN. - Rate limit using a firewall or IDP to block an IP address for specific period of time if connection attempts are made too rapidly. - Rate limit at the web server that interfaces into the LDAP server. Only allow a specific number of queries per source IP address per time period. - Use a Captcha to reduce the number of automated queries. - Reduce the number of results returned. Instead of 100 rows, return 5 closest matches. - Require a valid email address to run the query. Block email accounts from anonymous email providers. Has anyone implemented these or other measures to reduce LDAP harvests? Are there any commercial solutions? Thanks, Tyler -- -- Tyler Schoenke Network Security Manager IT Security Office University of Colorado at Boulder
Current thread:
- Combating directory harvests Tyler T. Schoenke (Jul 19)
- Re: Combating directory harvests Roger A Safian (Jul 19)
- Re: Combating directory harvests Joel Rosenblatt (Jul 19)
- <Possible follow-ups>
- Re: Combating directory harvests Harry Hoffman (Jul 19)
- Re: Combating directory harvests Roger A Safian (Jul 19)