We do a lot of work with ISPs and Telcos and we get it.. you don’t want to make changes that might affect your customers. However, if you don’t make some simple changes to account and password policies, not only are you doing your customers a disservice, you also might end up increasing your support costs when having to deal with spam outbreaks (or worse, when dealing with the abuse of your customers’ email accounts..).
Example Case of BotNet Activity
Here is a sample of a very large BotNet being used to do dictionary and brute force attacks against your servers right now. The IP(s) involved are primarily from China, Brazil, and Vietnam (you do know that you can block authentication by country right? Oh, of course, you’re worried about customers potentially complaining while they are traveling..).
200.23.226.47 (BR) 200.23.226.152 (BR) 200.23.226.185 (BR) 200.23.226.205 (BR) 200.23.226.235 (BR) 200.23.228.38 (BR) 200.23.229.20 (BR) 200.23.229.46 (BR) 200.23.229.74 (BR) 200.23.229.173 (BR) 200.23.230.5 (BR) 200.23.230.101 (BR) 200.23.230.131 (BR) 200.23.230.133 (BR) 200.23.230.185 (BR)
In this case, the “BotNet” operators have probably hacked the common Internet routers that ISP customers are using. Judging by this one Brazilian ISP, the “Ubiquiti’s AirOS” routers are commonly hacked, and it is not hard to see that a quick ‘google’ search will reveal a history of compromises.
When analyzing the patterns we can quickly see that this is likely the case. It’s surprising that this Brazilian ISP hasn’t noticed all the extra bandwidth consumption, or that their customers aren’t complaining about slow speeds (and compromises).
So what is this Bot doing right now? Attacking your customers. It is attempting to do two things. First, dictionary attacks are done to see if ‘info@‘ exists at your domain. They can build up an email database that can be sold to other spammers. Second, it tries to authenticate using common/weak passwords as well as passwords found from other sources. Did you know it has been reported that 70% of people admit to using the same password at multiple sites? So when one of THOSE places are hacked (which we hear about all the time), it potentially puts other accounts at risk.
The attacks are against Port 587 (Submission Port of SMTP), usually using Plain Text Login methods if they are able to (script kiddies like the easy way..). Now, you can’t effectively block IP(s) that constantly change without the risk of eventually blocking your own customers, but you CAN do things that will reduce the attacks.
Password Policy Considerations
Below are simple and easy steps that every ISP should implement (though it is surprising just how many haven’t gotten around to it yet). Most of it revolves around password policies. Remember, your customers’ accounts could be compromised already and you just don’t know it yet, but one day those accounts will be utilized…
First of all, ENFORCE using TLS/SSL for all email connections. Again, we get it.. you don’t want everyone calling you, and some old email clients might not work any more, but it’s time.. If you can’t force it globally, at least start doing it on a domain by domain basis. Worried about calls from customers that they cannot configure their email clients? Aside from also offering webmail for those who don’t have a decent email client, you could…
Set up AUTO DISCOVER mechanisms, this will reduce the work load. That way, the customer only has to put in their email address and the email client will automatically figure out your safer configurations. While we do wish that a common method of Auto Discover would be agreed upon by all vendors (you might need to implement a couple of methods yourself, and it MIGHT seem complicated), it is well worth the reward.
Lastly, of course, enforce STRONG passwords. Don’t give your customers a choice.
While there is a lot of talk about ‘two factor’ authentication, just doing the three things above will get you the biggest bang for your buck.
For kicks and giggles.. we’ve included a random sampling of IP(s) being used in this form of attack.
1.162.106.51 (TW) 5.101.78.105 (RU) 5.36.222.139 (OM) 5.59.82.77 (ES) 14.117.176.13 (CN) 14.161.23.133 (VN) 14.161.42.211 (VN) 14.161.43.54 (VN) 14.162.163.32 (VN) 14.162.204.189 (VN) 14.163.120.235 (VN) 14.166.93.72 (VN) 14.169.100.239 (VN) 14.169.145.95 (VN) 14.169.153.206 (VN) 14.169.177.116 (VN) 14.169.234.9 (VN) 14.177.181.42 (VN) 14.177.234.41 (VN) 14.177.66.224 (VN) 14.186.12.28 (VN) 14.186.136.130 (VN) 14.186.144.151 (VN) 14.186.161.130 (VN) 14.186.200.76 (VN) 14.186.47.57 (VN) 14.187.159.91 (VN) 14.187.186.140 (VN) 14.187.249.235 (VN) 14.187.75.172 (VN) 14.226.224.67 (VN) 14.226.229.151 (VN) 14.228.123.249 (VN) 14.231.119.49 (VN) 14.231.133.225 (VN) 14.231.136.255 (VN) 14.231.216.122 (VN) 14.231.245.33 (VN) 14.234.204.121 (VN) 27.66.232.216 (VN) 27.73.122.114 (VN) 27.73.30.146 (VN) 27.79.199.176 (VN) 31.8.18.82 (RU) 36.24.2.239 (CN) 36.6.57.40 (CN) 37.114.178.19 (AZ) 42.115.110.96 (KH) 42.249.162.67 (CN) 42.249.189.123 (CN) 42.54.93.104 (CN) 45.226.158.218 (BR) 45.228.91.188 (BR) 45.7.181.243 (BR) 46.244.208.60 (DE) 46.99.135.154 (AL) 49.76.124.161 (CN) 49.76.125.158 (CN) 58.219.29.247 (CN) 58.82.129.119 (TH) 61.158.188.21 (CN) 62.232.215.42 (GB) 71.231.199.52 (US) 72.2.21.133 (CA) 77.245.76.119 (GB) 77.40.61.191 (RU) 80.188.10.210 (CZ) 81.191.197.64 (NO) 82.232.56.200 (FR) 84.117.127.60 (RO) 86.124.121.244 (RO) 86.20.21.213 (GB) 86.57.134.12 (BY) 88.26.216.95 (ES) 89.107.99.41 (KZ) 89.249.65.195 (DE) 91.18.21.245 (DE) 92.242.208.15 (IR) 94.103.80.105 (RU) 95.67.31.207 (UA) 103.89.88.248 (VN) 106.110.198.172 (CN) 106.110.215.124 (CN) 110.38.240.37 (PK) 110.77.171.161 (TH) 112.84.192.2 (CN) 113.110.45.19 (CN) 113.160.18.90 (VN) 113.161.32.65 (VN) 113.161.59.0 (VN) 113.168.135.224 (VN) 113.169.42.220 (VN) 113.170.4.241 (VN) 113.172.127.158 (VN) 113.172.25.41 (VN) 113.173.100.211 (VN) 113.173.130.143 (VN) 113.173.16.236 (VN) 113.173.191.78 (VN) 113.173.81.41 (VN) 113.175.93.177 (VN) 113.184.188.245 (VN) 113.188.132.241 (VN) 113.190.158.240 (VN) 113.190.165.77 (VN) 114.223.211.23 (CN) 114.239.254.244 (CN) 114.24.231.153 (TW) 114.44.217.15 (TW) 115.84.92.133 (LA) 116.104.22.99 (VN) 116.107.118.134 (VN) 116.107.236.79 (VN) 116.111.84.93 (VN) 116.118.104.96 (VN) 116.255.194.62 (CN) 116.96.94.25 (VN) 116.97.166.168 (VN) 116.97.76.67 (VN) 117.0.208.164 (VN) 117.0.218.134 (VN) 117.7.146.29 (VN) 118.143.205.156 (HK) 118.173.171.120 (TH) 119.98.99.59 (CN) 120.89.118.207 (NP) 121.18.137.2 (CN) 121.235.195.88 (CN) 122.114.169.229 (CN) 122.114.215.225 (CN) 122.225.234.78 (CN) 122.236.182.188 (CN) 122.7.240.12 (CN) 122.7.242.178 (CN) 122.7.242.238 (CN) 123.16.136.180 (VN) 123.16.180.1 (VN) 123.16.230.219 (VN) 123.16.240.53 (VN) 123.17.155.224 (VN) 123.20.145.86 (VN) 123.20.146.123 (VN) 123.20.167.66 (VN) 123.20.174.137 (VN) 123.20.252.63 (VN) 123.20.32.94 (VN) 123.20.36.203 (VN) 123.20.52.125 (VN) 123.21.113.118 (VN) 123.21.116.106 (VN) 123.21.225.58 (VN) 123.21.234.5 (VN) 123.21.32.173 (VN) 123.22.87.103 (VN) 123.23.188.211 (VN) 123.52.175.192 (CN) 123.55.187.235 (CN) 123.55.94.204 (CN) 124.229.194.51 (CN) 125.106.130.208 (CN) 125.33.94.247 (CN) 128.201.179.213 (BR) 128.201.179.236 (BR) 128.201.179.243 (BR) 131.0.120.136 (BR) 131.100.77.174 (BR) 131.196.84.124 (BR) 131.196.93.131 (BR) 131.196.93.194 (BR) 131.196.93.226 (BR) 131.221.149.56 (BR) 138.0.188.122 (BR) 138.0.188.145 (BR) 138.118.185.48 (BR) 138.121.30.5 (BR) 138.122.170.16 (BR) 138.122.38.217 (BR) 138.122.39.225 (BR) 138.122.39.229 (BR) 138.185.232.152 (BR) 138.204.70.25 (BR) 138.255.188.135 (BR) 138.59.130.252 (BR) 138.97.145.166 (BR) 140.250.115.19 (CN) 143.255.153.116 (AR) 143.255.153.175 (AR) 144.0.105.187 (CN) 144.0.83.129 (CN) 144.0.92.18 (CN) 151.177.87.62 (SE) 153.222.107.52 (JP) 157.32.73.65 (IN) 167.250.217.153 (BR) 167.250.90.14 (BR) 167.250.90.45 (BR) 168.0.225.153 (BR) 168.0.226.176 (BR) 168.0.226.239 (BR) 168.0.226.7 (BR) 168.197.5.103 (BR) 168.197.7.242 (BR) 168.227.57.74 (BR) 168.228.116.117 (BR) 168.228.117.168 (BR) 170.231.183.234 (BR) 170.238.230.122 (BR) 170.239.21.51 (BR) 170.244.214.121 (BR) 170.245.118.99 (BR) 170.246.237.10 (BR) 170.246.237.35 (BR) 170.246.237.58 (BR) 170.246.238.247 (BR) 170.80.211.106 (BR) 171.224.245.53 (VN) 171.241.124.68 (VN) 171.253.51.174 (VN) 171.35.163.167 (CN) 171.35.170.137 (CN) 174.200.42.53 (US) 175.146.97.130 (CN) 175.15.29.69 (CN) 175.171.161.164 (CN) 177.10.195.43 (BR) 177.104.241.211 (BR) 177.11.118.15 (BR) 177.11.118.56 (BR) 177.11.119.132 (BR) 177.125.31.23 (BR) 177.125.31.66 (BR) 177.128.144.237 (BR) 177.130.160.195 (BR) 177.130.161.141 (BR) 177.130.161.218 (BR) 177.130.161.64 (BR) 177.130.162.163 (BR) 177.130.162.89 (BR) 177.137.139.173 (BR) 177.155.204.79 (BR) 177.184.170.165 (BR) 177.20.179.216 (BR) 177.20.181.97 (BR) 177.221.106.193 (BR) 177.221.97.253 (BR) 177.221.98.228 (BR) 177.23.187.148 (BR) 177.23.208.74 (BR) 177.23.208.94 (BR) 177.23.210.129 (BR) 177.23.211.7 (BR) 177.23.211.85 (BR) 177.23.212.220 (BR) 177.23.215.148 (BR) 177.23.215.252 (BR) 177.23.62.201 (BR) 177.38.190.38 (BR) 177.38.190.72 (BR) 177.44.170.26 (BR) 177.44.25.246 (BR) 177.44.26.3 (BR) 177.44.26.55 (BR) 177.44.27.122 (BR) 177.55.149.27 (BR) 177.55.154.235 (BR) 177.66.226.156 (BR) 177.66.226.80 (BR) 177.66.230.100 (BR) 177.66.230.105 (BR) 177.66.230.45 (BR) 177.66.231.114 (BR) 177.66.234.116 (BR) 177.66.237.224 (BR) 177.66.237.230 (BR) 177.66.237.233 (BR) 177.66.237.244 (BR) 177.66.75.19 (BR) 177.66.75.24 (BR) 177.66.75.7 (BR) 177.67.163.125 (BR) 177.67.163.171 (BR) 177.69.243.193 (BR) 177.69.243.77 (BR) 177.72.170.113 (BR) 177.72.173.116 (BR) 177.72.173.237 (BR) 177.72.2.198 (BR) 177.75.133.209 (BR) 177.86.106.155 (BR) 177.86.106.190 (BR) 177.86.107.242 (BR) 177.86.108.37 (BR) 177.86.110.21 (BR) 177.86.110.56 (BR) 177.87.219.228 (BR) 177.87.249.47 (BR) 177.87.252.119 (BR) 177.87.255.177 (BR) 177.87.255.179 (BR) 177.91.116.191 (BR) 177.91.116.93 (BR) 177.91.117.111 (BR) 178.168.200.120 (BY) 179.109.57.205 (BR) 179.109.57.82 (BR) 179.109.61.159 (BR) 179.127.194.19 (BR) 179.190.124.48 (BR) 179.83.124.239 (BR) 180.108.177.44 (CN) 180.117.96.188 (CN) 180.118.11.230 (CN) 180.52.71.179 (JP) 181.191.201.167 (BR) 181.198.203.197 (EC) 181.198.203.53 (EC) 182.123.186.102 (CN) 182.207.15.25 (CN) 182.74.255.58 (IN) 182.75.114.26 (IN) 182.75.119.210 (IN) 182.75.82.158 (IN) 183.167.171.20 (CN) 183.167.172.97 (CN) 184.170.54.62 (JM) 184.82.54.248 (TH) 185.3.151.42 (UA) 185.66.130.184 (AL) 185.87.102.113 (FR) 186.178.31.174 (EC) 186.195.100.25 (BR) 186.195.101.113 (BR) 186.224.245.115 (BR) 186.227.37.163 (BR) 186.227.37.202 (BR) 186.227.40.190 (BR) 186.233.177.104 (BR) 186.235.24.169 (BR) 186.235.38.9 (BR) 186.235.46.169 (BR) 186.249.217.204 (BR) 186.250.114.93 (BR) 186.250.115.19 (BR) 186.251.211.82 (BR) 186.251.56.179 (BR) 186.251.56.234 (BR) 186.251.56.72 (BR) 186.251.56.75 (BR) 186.33.181.22 (EC) 186.47.170.195 (EC) 186.47.173.114 (EC) 187.1.39.95 (BR) 187.1.41.103 (BR) 187.108.229.254 (BR) 187.109.52.136 (BR) 187.109.52.139 (BR) 187.109.55.228 (BR) 187.109.56.238 (BR) 187.109.58.147 (BR) 187.109.58.47 (BR) 187.109.59.119 (BR) 187.109.60.58 (BR) 187.109.61.202 (BR) 187.109.62.151 (BR) 187.109.62.161 (BR) 187.111.154.63 (BR) 187.111.155.106 (BR) 187.111.155.3 (BR) 187.111.49.16 (BR) 187.111.49.62 (BR) 187.111.51.175 (BR) 187.111.51.204 (BR) 187.111.52.165 (BR) 187.111.52.191 (BR) 187.111.52.202 (BR) 187.111.52.23 (BR) 187.111.52.42 (BR) 187.111.53.118 (BR) 187.111.53.120 (BR) 187.111.53.97 (BR) 187.111.54.110 (BR) 187.111.54.38 (BR) 187.111.55.190 (BR) 187.111.57.161 (BR) 187.111.57.67 (BR) 187.111.58.238 (BR) 187.111.58.247 (BR) 187.111.58.250 (BR) 187.111.58.92 (BR) 187.111.59.112 (BR) 187.111.59.165 (BR) 187.111.59.230 (BR) 187.111.59.234 (BR) 187.111.59.89 (BR) 187.111.63.158 (BR) 187.111.63.180 (BR) 187.17.24.228 (BR) 187.19.197.134 (BR) 187.32.88.130 (BR) 187.61.124.147 (BR) 187.84.10.237 (BR) 187.84.168.173 (BR) 187.84.170.154 (BR) 187.84.172.210 (BR) 187.84.175.206 (BR) 187.85.200.97 (BR) 187.85.209.168 (BR) 187.85.209.172 (BR) 187.85.209.186 (BR) 187.85.209.243 (BR) 187.85.210.193 (BR) 187.87.36.26 (BR) 187.94.246.221 (BR) 187.95.9.80 (BR) 188.165.219.27 (FR) 188.195.44.83 (DE) 189.112.151.192 (BR) 189.112.217.142 (BR) 189.124.7.13 (BR) 189.127.33.235 (BR) 189.207.62.6 (MX) 189.51.106.168 (BR) 189.51.203.231 (BR) 189.65.92.241 (BR) 189.85.83.131 (BR) 190.214.218.182 (EC) 190.99.40.245 (SV) 191.240.65.80 (BR) 191.243.208.76 (BR) 191.253.26.240 (BR) 191.253.29.113 (BR) 191.253.29.255 (BR) 191.253.30.183 (BR) 191.253.31.140 (BR) 191.253.31.166 (BR) 191.253.31.168 (BR) 191.253.43.145 (BR) 191.253.44.226 (BR) 191.253.44.227 (BR) 191.253.45.130 (BR) 191.253.45.75 (BR) 191.37.203.50 (BR) 191.53.104.183 (BR) 191.53.17.145 (BR) 191.53.18.116 (BR) 191.53.18.15 (BR) 191.53.193.57 (BR) 191.53.195.143 (BR) 191.53.205.13 (BR) 191.53.208.30 (BR) 191.53.22.24 (BR) 191.53.238.77 (BR) 191.53.239.62 (BR) 192.141.30.74 (BR) 196.46.202.80 (ZM) 197.48.205.91 (EG) 200.0.55.115 (BR) 200.169.4.242 (BR) 200.187.116.57 (BR) 200.189.9.13 (BR) 200.229.193.206 (BR) 200.23.226.152 (BR) 200.23.226.185 (BR) 200.23.226.205 (BR) 200.23.226.235 (BR) 200.23.226.47 (BR) 200.23.228.38 (BR) 200.23.229.173 (BR) 200.23.229.20 (BR) 200.23.229.46 (BR) 200.23.229.74 (BR) 200.23.230.101 (BR) 200.23.230.131 (BR) 200.23.230.133 (BR) 200.23.230.185 (BR) 200.23.230.5 (BR) 200.23.232.177 (BR) 200.24.69.185 (BR) 200.24.69.196 (BR) 200.3.18.148 (BR) 200.3.18.61 (BR) 200.33.89.201 (BR) 200.33.91.37 (BR) 200.33.92.164 (BR) 200.6.141.169 (BR) 200.66.116.183 (BR) 200.66.116.83 (BR) 200.66.119.212 (BR) 200.66.120.147 (BR) 200.66.124.104 (BR) 200.66.126.231 (BR) 201.148.186.218 (BR) 201.150.123.240 (BR) 201.23.234.91 (BR) 201.33.229.85 (BR) 201.33.229.87 (BR) 201.46.62.43 (BR) 201.62.69.119 (BR) 201.77.14.148 (BR) 202.137.141.144 (LA) 202.137.155.222 (LA) 202.75.100.74 (ID) 203.73.94.22 (TW) 219.235.4.66 (CN) 220.136.54.145 (TW) 220.225.7.87 (IN) 220.243.132.68 (CN) 221.153.146.96 (KR) 221.227.106.64 (CN) 221.227.110.115 (CN) 221.227.110.150 (CN) 222.103.129.15 (KR) 222.222.138.36 (CN) 222.245.183.247 (CN) 222.252.49.250 (VN) 223.153.32.78 (CN) 223.157.155.231 (CN)