* Several approaches to dealing with dictionary harvest attacks
Last week, I discussed Project Honey Pot, Unspam’s effort aimed at going after harvesters of e-mail addresses to reduce the supply of fresh e-mail addresses used by spammers. This week, I’d like to talk about some other approaches that are intended to do the same thing.
MailChannels, a Canadian e-mail security start-up, has built a feature into its offering that, with a small amount of HTML code, causes a server to issue a unique e-mail address for each new Web site visitor. While the visitor sees a normal-looking ‘mailto:’ link and can send e-mail to it, the MailChannels server collects information in a database about the visitor’s browser, the time they visited and other information. The unique e-mail address generated for each visitor can be manipulated in the database so that it disappears after a short period of time. Because harvesters typically collect e-mail addresses and don’t send to them until later, the MailChannels system can make the harvested addresses unusable.
NorthSeas AMT, another Canadian company, blocks dictionary harvest attacks through its “tarpitting” feature. When the server detects a predetermined number of consecutive, badly addressed e-mail messages from the same sender, the system slows incoming messages from that address to about 2 to 3 seconds per message.
A reader of this newsletter has a homegrown approach to the problem: “When I find [a bogus e-mail address] repeatedly, I configure an automatic script to add the sender to a list of spammers. There are some checks to make sure that the domain I’m flagging belongs to the IP address space the mail came from and such. Hence, a faked domain of aol.com won’t be added.”
These are but three of the many approaches to thwarting dictionary harvest attacks (DHA) offered by a variety of vendors and created internally by e-mail administrators. I’d like to hear how much of a problem DHAs are for you and what you’re doing to address them – please drop me a line at mailto:michael@ostermanresearch.com
