2KKUU7ita

E-mail bombs
Chapter 13: Communication and Messaging Systems
E-mail bombs attack by creating denial of service (DoS) conditions against
your e-mail software and even your network and Internet connection by
taking up a large amount of bandwidth and, sometimes, requiring large
amounts of storage space. E-mail bombs can crash a server and provide
unauthorized administrator access.
Attachments
An attacker can create an attachment-overload attack by sending hundreds
or thousands of e-mails with very large attachments to one or more recipients
on your network.
Attacks using e-mail attachments
Attachment attacks have a couple of goals:
✓ The whole e-mail server might be targeted for a complete interruption
of service with these failures:
• Storage overload: Multiple large messages can quickly fill the total
storage capacity of an e-mail server. If the messages aren’t automatically
deleted by the server or manually deleted by individual
user accounts, the server will be unable to receive new messages.
This can create a serious DoS problem for your e-mail system,
either crashing it or requiring you to take your system offline to
clean up the junk that has accumulated. A 100MB file attachment
sent ten times to 100 users can take 100GB of storage space. Yikes!
• Bandwidth blocking: An attacker can crash your e-mail service or
bring it to a crawl by filling the incoming Internet connection with
junk. Even if your system automatically identifies and discards
obvious attachment attacks, the bogus messages eat resources
and delay processing of valid messages.
✓ An attack on a single e-mail address can have serious consequences if
the address is for an important user or group.
Countermeasures against e-mail attachment attacks
These countermeasures can help prevent attachment-overload attacks:
✓ Limit the size of either e-mails or e-mail attachments. Check for this
option in your e-mail server’s configuration settings (such as those provided
in Novell GroupWise and Microsoft Exchange), your e-mail content
filtering system, and even at the e-mail client level.
253