Open relays
Spamhaus wrote about the return of open relays yesterday. What they’re seeing today matches what I see: there is fairly consistent abuse of open relays to send spam. As spam problems go it’s not as serious as compromised machines or abuse-tolerant ESPs / ISPs/ freemail providers – either in terms of volume or user inbox experience – but it’s definitely part of the problem.
I’m not sure how much of a new problem it is, though.
Spammers scan the ‘net for mailservers and attempt to relay email through them back to email addresses they control. Any mail that’s delivered is a sign of an open relay. They typically put the IP address of the mailserver they connected to in the subject line of the email, making it easy for them to mechanically extract a list of open relays.
We run some honeypots that will accept and log any transaction, which looks just like an open relay to spammers other than not actually relaying any email. They let us see what’s going on. Here’s a fairly typical recent relay attempt:
MAIL FROM: <test@live.com>
RCPT TO: <therichsheickc@yahoo.com>
RCPT TO: <therichsheick1@yahoo.com>
RCPT TO: <therichsheick9@yahoo.com>
RCPT TO: <therichsheick2@yahoo.com>
RCPT TO: <therichsheick0@yahoo.com>
RCPT TO: <therichsheickb@yahoo.com>
RCPT TO: <therichsheick7@yahoo.com>
RCPT TO: <therichsheick13@yahoo.com>
RCPT TO: <therichsheick4@yahoo.com>
RCPT TO: <therichsheickf@yahoo.com>
RCPT TO: <therichsheick12@yahoo.com>
RCPT TO: <therichsheick5@yahoo.com>
RCPT TO: <therichsheicke@yahoo.com>
RCPT TO: <therichsheickd@yahoo.com>
RCPT TO: <therichsheicka@yahoo.com>
RCPT TO: <therichsheick10@yahoo.com>
RCPT TO: <therichsheick6@yahoo.com>
RCPT TO: <therichsheick3@yahoo.com>
RCPT TO: <therichsheick@yahoo.com>
RCPT TO: <therichsheick11@yahoo.com>
RCPT TO: <therichsheick8@yahoo.com>
DATA
From: <test@live.com>
Date: Sun, 1 Dez 2013 12:17:21 +0000
Subject: ip.ad.ddr.ess@pauletteOpen Relay
It’s 106 miles to Chicago, we got a full tank of gas, half a pack of cigarettes, it’s dark… and we’re wearing sunglasses.
.
This test came from an IP address apparently in the Amazon cloud, which isn’t unusual, but they also come from compromised machines or grubby little /28 allocations from all over the place.
You can see that they use multiple test destination addresses, so that even if they lose access to some they won’t lose the results of the relay test. In this case they’re using yahoo.com addresses, which isn’t at all unusual.
The same relay scanner has been using exactly that same set of yahoo.com email addresses unchanged for over a year, so it seems that their losing access to them isn’t a serious risk.
How new is this?
We saw over 100,000 relay attempts in March 2010. The break in 2011 is when the machine running the honeypot moved providers. That the relay attempts didn’t increase back to previous levels is interesting; I’m guessing that some ranges of network space are more profitable to mine for open relays than others. This graph is a logarithmic scale, as otherwise the more recent volumes would be dwarfed by the older ones.
Lets just look at traffic since mid-2011, with a linear scale, instead. Broken down by week, rather than month too:
Well, something is certainly happening. But it’s a very spiky sort of traffic anyway, so short term changes don’t necessarily mean anything.
I’m not sure if there’s any trend or message to draw from this other than “Here, have some data.” and “Open relays are still an issue, and spammers are still actively looking for them.”