Spammers turn to directory harvest attacks

Have you been done by a harvester before?

Iain Thomson, vnunet.com 03 Feb 2005

Spammers are increasingly turning to directory attacks against company email servers, according to research carried out by email management company Postini.

Of the 14.7 billion emails monitored by the company last month, spam accounted for 88 per cent and a significant proportion of that spam consisted not of targeted emails but of so-called directory harvest attacks.

These occur when the spammer uses a company's email string and either runs through common names or every character and monitors the emails rejected by the company's server. Any that are not returned are assumed to be live and are heavily spammed.

"Companies need to be aware of how much unwanted email isn't spam per se, but is actually directory harvest attack messages," said Andrew Lochart, Postini's director of product marketing.

"Of the 88 per cent of messages that were bad, 32 per cent were directory harvest delivery attempts. These messages would go undetected by spam filters that only look at content."

The resultant flood of spam can slow email systems dramatically, mimicking a denial of service attack. Reconfiguring email servers to ignore unidentified emails does not help either, since this simply encourages even more spam, the report warned.

Postini reported that these attacks rose by a third last year, and that January's figures mirror the relentless rise.

"I am not sure how serious a problem it is," said Professor Neil Barrett, of Cranfield University's computer science department.

"A lot of servers are being configured to bounce back these kinds of emails much earlier. There are also techniques to throttle back emails from sources that send too many."

See also: