作者 主題: 請問email攻擊行為  (閱讀 5150 次)

0 會員 與 1 訪客 正在閱讀本文。

lc

  • 懷疑的國中生
  • **
  • 文章數: 80
    • 檢視個人資料
請問email攻擊行為
« 於: 2006-01-18 17:12 »
昨天我們的email系統受到大量的退回郵件, 初步懷疑是某人大量發送廣告信, 其中的From欄位填入我們被攻擊的email, 但廣告信寄送的地址Username是不正確的, 但是domain是正確的, 因此善意的第三者mail server就送出退信給我們那個受攻擊的信箱
會做這樣設想的理由有:
1. 退件IP的來源皆不定, 寄最多信的大約一百多封, 少量的甚至只有一封, IP數目很多
2. X-Mailer的欄位出現了好幾種不同的client

不知道我這樣的推論是正確的嗎? 以及要如何阻擋這類攻擊?

信件header如下


引用
The original message was received at Tue, 17 Jan 2006 16:01:40 +0800 (CST)
from localhost

   ----- The following addresses had permanent fatal errors -----
<test@system.mail>

   ----- Transcript of session follows -----
550 <test@system.mail>... Host unknown (Name server: system.mail: host not found)



Reporting-MTA: dns; mail.cwb.gov.tw
Received-From-MTA: DNS; localhost
Arrival-Date: Tue, 17 Jan 2006 16:01:40 +0800 (CST)

Final-Recipient: RFC822; test@system.mail
Action: failed
Status: 5.1.2
Remote-MTA: DNS; system.mail
Last-Attempt-Date: Tue, 17 Jan 2006 16:01:40 +0800 (CST)



Subject:
Returned mail: Data format error
From:
Mail Delivery Subsystem <MAILER-DAEMON>
Date:
Tue, 17 Jan 2006 16:01:40 +0800 (CST)
To:
<test@system.mail>

The original message was received at Tue, 17 Jan 2006 16:01:19 +0800 (CST)
from localhost [[UNIX: localhost]]

   ----- The following addresses had permanent fatal errors -----
anticorr@ms1.cwb.gov.tw
    (expanded from: <anticorr@cwb.gov.tw>)

   ----- Transcript of session follows -----
... while talking to ms1.cwb.gov.tw.:

>>>>>> MAIL From:<test@system.mail> SIZE=4580 BODY=8BITMIME

<<< 553 5.1.8 <test@system.mail>... Domain of sender address test@system.mail does not exist
501 anticorr@ms1.cwb.gov.tw... Data format error



Reporting-MTA: dns; mail.cwb.gov.tw
Received-From-MTA: DNS; localhost
Arrival-Date: Tue, 17 Jan 2006 16:01:19 +0800 (CST)

Final-Recipient: RFC822; <anticorr@cwb.gov.tw>
X-Actual-Recipient: RFC822; anticorr@ms1.cwb.gov.tw
Action: failed
Status: 5.1.3
Remote-MTA: DNS; ms1.cwb.gov.tw
Diagnostic-Code: SMTP; 553 5.1.8 <test@system.mail>... Domain of sender address test@system.mail does not exist
Last-Attempt-Date: Tue, 17 Jan 2006 16:01:40 +0800 (CST)



Subject:
邮件投递超时错误
From:
"test@system.mail" <test@system.mail>
Date:
Tue, 17 Jan 2006 15:46:51 +0800
To:
"anticorr@cwb.gov.tw" <anticorr@cwb.gov.tw>

邮件地址无效-无法将您的邮件投递至以下指定地址:
paidemail@tjnh.com : 投递失败, 帐号不存在.


//----------------------------------------------------------
Received: from [218.206.99.226]; Tue, 17 Jan 2006 15:46:51 +0800
From: =B2312?B?t/LG3rfOxqzCsc62ydXAsLe7?= <anticorr@cwb.gov.tw>
Subject: =B2312?B?z+PJxbS6t/LG3rfOxqzCsc62ydXAsLe7xOrA+zMwzfI=?=
To: paidemail@tjnh.com
Content-Type: text/html;charset=B2312"
Reply-To: anticorr@cwb.gov.tw
Date: Tue, 17 Jan 2006 15:46:47 +0800
X-Priority: 3
X-Mailer: Microsoft Outlook Express 5.00.2615.200