Thursday, September 30, 1993

E-mail for denial of services and corruption I just did an experiment sending massive quantities of e-mail to a typical Unix box, and of course, I was able to overrun the disk capacity on the recipient machine, thus making the system grind to a crunching halt for lack of space. Since I sent it to daemon, nobody noticed the mail for quite some time, and it took a bit before they figured out the problem and were able to fix it. I don't know for sure, but I think a lot of systems are susceptible to this attack, and there is no easy solution, at least if you still want to get mail. To assess the degree to which this might be a threat, I got a listing of DoD and US Government sites from the Chaos Computer Club (thank you Charles) and tried sending mail to them - only 1 refused the mail out of 67 tried. Several told me there was no such mail recipient, but gave me a directory of other recipients with simnilar names - how helpful. A few told me they didn't have sucha user and identified that they were a particular type of system - now I know for certain what UID to send to. Under some versions of Unix, you can put quotas on users, but not on e-mail space - as far as I know. The ULIMIT prevents unbounded growth, but it is now set high enough by default on most systems that it won't stop this attack. You can explicitly refuse mail on some systems, but I don't think there is a general way to do this selectively enough to defend against this attack. The default is almost always to get all that comes to you. Your suggestions are welcomed - FC [Fredrick B. Cohen via risks-digest Volume 15, Issue 06] 10:48 # G!