Friday, January 28, 2005

Tarpitting harvesters with Exchange 2003 on Windows 2003

New KB article (KB.842851) covers a Windows 2003 hotfix to tarpit anyone harvesting addresses from Exchange. You want this one if you’re doing Recipient Filtering based on directory lookups!

By default, Exchange 2003 will allow inbound SMTP mail to be addressed (“RCPT TO”) any alias within the defined relay domains. This means that even if you don’t have a user called “joe@domain.com”, if you do accept email for “@domain.com”, anyone sending to “joe” will just get a 2.1.5 SMTP code and presume the user does exist. Only after mail is processed at Exchange does an NDR get generated.

Those who send unsolicited commercial email send out lots of email addressed to mailbox aliases that don’t exist. Since Exchange will accept this email and then NDR it later, it puts additional load on your gateway servers to receive and process this mail.

One of the new features in Exchange 2003 was recipient filtering (see KB.823866). When you configure recipient filtering, there’s a checkbox you can check that says “Filter recipients who are not in the directory”. That’s great! That’ll solve the problem. Now instead of just blindly accepting the email with a 2.1.5 and later NDRing it, we can just look up in the directory right away and decline to accept the email (with “5.1.1 User Unknown”). Right?

Introducing a new problem: Directory Harvest Attacks. If all a spammer has to do to find out if an email address is valid or not is submit an “RCPT TO: <address to test>” command to your server, this becomes a great way to do email address harvesting. Exchange doesn’t honor VRFY, if you turn on this particular recipient filtering feature you get the same net effect! See this and this for more on DHAs.

The Windows 2003 hotfix in KB.842851 is an update for the SMTP stack used by Exchange. If you apply the hotfix and set a registry key, it will then start to “tarpit” any attempts to look up non-existent addresses. What this means is that if I send an email to UserThatExists@domain.com, the SMTP stream will proceed with no delay. But as soon as I try to “RCPT TO” UserThatDOESNOTExist@domain.com, the SMTP stack on the Exchange server will wait the specified (in the registry) number of seconds — say five — before responding. This obviously doesn’t mean that it’s no longer possible to harvest email addresses in this way, but it certainly makes it more “expensive” and therefore less attractive.

There’s a bit more detail in the hotfix KB, so if this interests you, have a look at it! Happy tarpitting!

 

18 comments:

Anonymous said...

Good day !.
You re, I guess , perhaps curious to know how one can manage to receive high yields .
There is no need to invest much at first. You may start to get income with as small sum of money as 20-100 dollars.

AimTrust is what you need
AimTrust represents an offshore structure with advanced asset management technologies in production and delivery of pipes for oil and gas.

It is based in Panama with structures everywhere: In USA, Canada, Cyprus.
Do you want to become really rich in short time?
That`s your chance That`s what you wish in the long run!

I feel good, I started to take up income with the help of this company,
and I invite you to do the same. It`s all about how to choose a correct companion utilizes your funds in a right way - that`s the AimTrust!.
I earn US$2,000 per day, and my first investment was 500 dollars only!
It`s easy to start , just click this link http://opuqahat.virtue.nu/latosa.html
and go! Let`s take this option together to become rich

Anonymous said...

Good day !.
might , perhaps very interested to know how one can make real money .
There is no need to invest much at first. You may begin earning with as small sum of money as 20-100 dollars.

AimTrust is what you need
The firm incorporates an offshore structure with advanced asset management technologies in production and delivery of pipes for oil and gas.

It is based in Panama with structures around the world.
Do you want to become really rich in short time?
That`s your choice That`s what you really need!

I`m happy and lucky, I began to get real money with the help of this company,
and I invite you to do the same. If it gets down to choose a proper partner who uses your funds in a right way - that`s it!.
I take now up to 2G every day, and my first deposit was 1 grand only!
It`s easy to get involved , just click this link http://opuqahat.virtue.nu/latosa.html
and go! Let`s take this option together to become rich

Anonymous said...

Hello !.
You re, I guess , perhaps very interested to know how one can reach 2000 per day of income .
There is no need to invest much at first. You may start earning with as small sum of money as 20-100 dollars.

AimTrust is what you thought of all the time
The company incorporates an offshore structure with advanced asset management technologies in production and delivery of pipes for oil and gas.

It is based in Panama with affiliates around the world.
Do you want to become a happy investor?
That`s your chance That`s what you wish in the long run!

I`m happy and lucky, I began to get real money with the help of this company,
and I invite you to do the same. If it gets down to select a correct companion utilizes your savings in a right way - that`s it!.
I take now up to 2G every day, and my first deposit was 1 grand only!
It`s easy to get involved , just click this link http://gokazytos.freehostyou.com/ukyfake.html
and lucky you`re! Let`s take our chance together to get rid of nastiness of the life

Anonymous said...

Can anyone recommend the robust Remote Management & Monitoring software for a small IT service company like mine? Does anyone use Kaseya.com or GFI.com? How do they compare to these guys I found recently: N-able N-central remote pc access
? What is your best take in cost vs performance among those three? I need a good advice please... Thanks in advance!

Anonymous said...

ventolin online pharmacybuy aciphex online rx drugs

[url=http://www.bebo.com/buylevitraonline1]buy generic levitra online[/url]

Anonymous said...

[url=http://loveepicentre.com/advice.php][img]http://loveepicentre.com/uploades/photos/7.jpg[/img][/url]
totally free online dating smooch [url=http://loveepicentre.com/map.php]dating frankoma marks glaze colors[/url] lesbian dating free online
lagos dating scams [url=http://loveepicentre.com/faq.php]quail horses friends age dating people[/url] it's just lunch dating for professionals
dating marrige romania top escort [url=http://loveepicentre.com/]dating websites abused members[/url] red deer sex dating

Anonymous said...

Hi thеre, I enjoy reаdіng through yоur ρoѕt.
I liκe to wrіte a little cоmment to support you.


Also viѕit my homеpage :: 1 month loan
my website: 1 month loan

Anonymous said...

romance ebook for free download http://audiobooksworld.co.uk/es/Historia/c112/ how to draw a cartoon ebook [url=http://audiobooksworld.co.uk/it/Quantum-groups-in-two-dimensional-physics/p100773/]stuart mcgill ebook[/url] pc ebook reader

Anonymous said...

Great artiсle.

My website ... payday loans
My page - payday loans

Anonymous said...

Heу therе, You've done an incredible job. I will definitely digg it and personally recommend to my friends. I am confident they'll
be benefiteԁ from this wеb site.


Heгe is my weblοg: payday loans
Also see my web site :: payday loans

Anonymous said...

accounting software packages for retail http://buysoftwareonline.co.uk/product-37070/Global-Mapper-13-x64 gps laptop software and receiver [url=http://buysoftwareonline.co.uk/es/product-37193/Magic-Audio-Recorder-5-3]best project accounting software[/url] sentry total security software download
[url=http://buysoftwareonline.co.uk/product-17801/Secret-Folder-3-7-Mac]Secret Folder 3.7 [Mac] - Cheap Legal OEM Software, Software Sale, Download OEM[/url] parasara light software upgrade
[url=http://buysoftwareonline.co.uk/it/product-37100/Alabe-Reports-2-8][img]http://buyoem.co.uk/image/5.gif[/img][/url]

Anonymous said...

[url=http://onlinemedistore.com/products/yasmin.htm][img]http://onlinemedistore.com/3.jpg[/img][/url]
walgreens pharmacy paoli http://onlinemedistore.com/products/provera.htm meds online pharmacy [url=http://onlinemedistore.com/products/copegus.htm]mcclains pharmacy supply[/url]
pa laws for duries of pharmacy techs http://onlinemedistore.com/products/glucophage.htm nuclear pharmacy authorized user training [url=http://onlinemedistore.com/products/tegretol.htm]tegretol[/url]
pharmacy technician certificate program ma http://onlinemedistore.com/products/seroquel.htm temporary placement pharmacy kentucky [url=http://onlinemedistore.com/catalogue/x.htm]pharmacy investigations seminars[/url]
ce for pharmacy in arizona http://onlinemedistore.com/products/frozen--energy-and-libido-enhancer-.htm buy pharmacy [url=http://onlinemedistore.com/products/ditropan.htm]ditropan[/url]

Anonymous said...

What а material of un-ambiguity and preserveness οf valuablе knoωledge regаrding unexpected emotions.


Ϻy webρage: small loans

Anonymous said...

[url=http://certifiedpharmacy.co.uk/products/atarax.htm][img]http://onlinemedistore.com/5.jpg[/img][/url]
abc pharmacy west covina ca http://certifiedpharmacy.co.uk/products/cytotec.htm aetna specialty pharmacy [url=http://certifiedpharmacy.co.uk/categories/anti-fungus.htm]pharmacy compounding alberta[/url]
arksansas bcbs pharmacy director http://certifiedpharmacy.co.uk/products/reglan.htm board canadian pharmacy [url=http://certifiedpharmacy.co.uk/products/speman.htm]speman[/url]
california board of pharmacy disaster preparation policy http://certifiedpharmacy.co.uk/products/confido.htm lloyds pharmacy bury st edmunds [url=http://certifiedpharmacy.co.uk/catalogue/k.htm]invite pharmacy[/url]
walgreens pharmacy dade city florida http://certifiedpharmacy.co.uk/products/metformin.htm pharmacy online no script needed [url=http://certifiedpharmacy.co.uk/categories/gums.htm]gums[/url]

Anonymous said...

[url=http://englandpharmacy.co.uk/products/citalopram.htm][img]http://onlinemedistore.com/10.jpg[/img][/url]
pharmacy letter http://englandpharmacy.co.uk/products/maxalt.htm baby diaper rash pharmacy pink [url=http://englandpharmacy.co.uk/products/ventolin.htm]reputable online pharmacy uk[/url]
walmart pharmacy drug list http://englandpharmacy.co.uk/products/glucotrol-xl.htm homeopathic pharmacy [url=http://englandpharmacy.co.uk/products/cystone.htm]cystone[/url]
why study pharmacy http://englandpharmacy.co.uk/products/citalopram.htm series pharmacy [url=http://englandpharmacy.co.uk/products/cialis-soft-tabs.htm]colorado pharmacy technician schools[/url]
migraine feverfew pharmacy http://englandpharmacy.co.uk/products/zithromax.htm u iowa ambulatory pharmacy [url=http://englandpharmacy.co.uk/products/lukol.htm]lukol[/url]

Anonymous said...

Thanks for ѕhаring your іnfο.
І tгuly appreciаte your effortѕ and ӏ wіll bе
waitіng for your neхt write ups thanks once аgаin.



Mу blοg; Same Day Payday Loans

Anonymous said...

free sexy lesbian dating sites danay garcia chris vance dating online dating profile help
online adult dating sims http://freeinternetdating.info/bride/russian-bikini-bride-voyeur top 10 new matching dating sites
black dating man seeking white woman free dating site in australia on line dating latter-day saints

Anonymous said...

ukrainian dating personals chubby http://loveepicentre.com/faq/ 1950 s teenage dating etiquette
dating a chinese women [url=http://loveepicentre.com/contact/]black jewish singles dating[/url] violence in dating
infp and dating [url=http://loveepicentre.com/map/]duncan sheik dating[/url] searching for free dating in usa [url=http://loveepicentre.com/user/troy410/]troy410[/url] pornadult dating site