• Hacking on SMTP and POP3

    From Elwood@1:103/705 to All on Fri Jul 7 20:49:50 2017
    For info:
    Today the DOSNETZ BBS was subjected to violent attacks. On the one hand from Germany and after that was clarified one second later from the Netherlands. Synchro has stood up. ;-)
    In total over 2500 attacks between 12:00 and 17:00 CET. Attack target wa the mailserver on the services SMTP and POP3.
    IP addresses: 37.49.225.111 and 37.10.114.94
    Both subnets are now in ip.cam and then was silence. Both coporations got a mail from me.


    Here is an extract of the log file:
    7.7 03: 29: 23p 2320 POP3 client disconnected from port 63264 on <no name> [37.49.225.111]
    7.7 03: 29: 24p 2216 POP3 client disconnected from port 63251 on <no name> [37.49.225.111]
    7.7 03: 29: 24p 2336 Socket closed by peer on receive
    7.7 03: 29: 24p 2336 POP3 client disconnected from port 63267 on <no name> [37.49.225.111]
    7.7 03: 29: 25p 2244 POP3 client disconnected from port 63254 on <no name> [37.49.225.111]
    7.7 03: 29: 25p 2876 SMTP! MAXIMUM CLIENTS (10) reached, access denied (5 total)
    7.7 03: 29: 25p 2360 Socket closed by peer on receive
    7.7 03: 29: 25p 2360 POP3 client disconnected from port 63271 on <no name> [37.49.225.111]
    7.7 03: 29: 28p 2384 Socket closed by peer on receive
    7.7 03: 29: 28p 2384 POP3 client disconnected from port 63275 on <no name> [37.49.225.111]
    7.7 03: 29: 28p 2408 Socket closed by peer on receive
    7.7 03: 29: 28p 2408 POP3 client disconnected from port 63278 on <no name> [37.49.225.111]
    7.7 03: 29: 28p 2876 POP3! MAXIMUM CLIENTS (10) reached, access denied (6 total)

    7.7 12: 54: 46p 1636 SMTP Connection accepted on port 25 from: 37.10.114.94 port 33070
    7.7 12: 54: 46p 1636 SMTP hostname: 94.114.10.37.dedicated.zare.com
    7.7 12: 55: 10p 1636! SMTP UNKNOWN USER: 'postmaster' (password: killer)
    7.7 12: 55: 15p 1636 SMTP Session thread terminated (2 threads remain, 1 clients served)
    7.7 12: 55: 17p 1648 SMTP Connection accepted on port 25 from: 37.10.114.94 port 37394
    7.7 12: 55: 17p 1648 SMTP hostname: 94.114.10.37.dedicated.zare.com
    7.7 12: 55: 39p 1648! SMTP UNKNOWN USER: 'postmaster' (password: abcdef)
    7.7 12:55:44 1648 SMTP Session thread terminated (2 threads remain, 2 clients served)
    7.7 12: 55: 44p 1636 SMTP Connection accepted on port 25 from: 37.10.114.94 port 40042
    7.7 12: 55: 44p 1636 SMTP hostname: 94.114.10.37.dedicated.zare.com
    7.7 12: 56: 09p 1636! SMTP UNKNOWN USER: 'postmaster' (password: hannah)
    7.7 12: 56: 14p 1636 SMTP Session thread terminated (2 threads remain, 3 clients served)
    7.7 12: 56: 14p 1696 SMTP Connection accepted on port 25 from: 37.10.114.94 port 42834
    7.7 12: 56: 14p 1696 SMTP hostname: 94.114.10.37.dedicated.zare.com
    7.7 12: 56: 54p 1696! SMTP UNKNOWN USER: 'postmaster' (password: test)
    7.7 12: 56: 59p 1696 SMTP Session thread terminated (2 threads remain, 4 clients served)
    7.7 12: 57: 00p 1704 SMTP Connection accepted on port 25 from: 37.10.114.94 port 46984
    7.7 12: 57: 00p 1704 SMTP hostname: 94.114.10.37.dedicated.zare.com
    7.7 12: 57: 19p 1704! SMTP UNKNOWN USER: 'postmaster' (password: alexander)
    7.7 12: 57: 24p 1704 SMTP Session thread terminated (2 threads remain, 5 clients served)

    THX & greetz
    Juergen
    aka Elwood
    BBS-Internet-Mail: elwood@bbs.dosnetz.de ------------------------------------------------
    Synchronet BBS.DOSNETZ.DE - Telnet via Port 1023 ------------------------------------------------

    ---
    * Synchronet * DOSNETZ BBS - TELNET 1023 - BBS.DOSNETZ.DE
    * Origin: Vertrauen - vert.synchro.net (1:103/705)
  • From Digital Man@1:103/705 to Elwood on Fri Jul 7 14:34:58 2017
    Re: Hacking on SMTP and POP3
    By: Elwood to All on Fri Jul 07 2017 08:49 pm

    For info:
    Today the DOSNETZ BBS was subjected to violent attacks. On the one hand from Germany and after that was clarified one second later from the Netherlands. Synchro has stood up. ;-)
    In total over 2500 attacks between 12:00 and 17:00 CET. Attack target wa the mailserver on the services SMTP and POP3.
    IP addresses: 37.49.225.111 and 37.10.114.94
    Both subnets are now in ip.cam and then was silence. Both coporations got a mail from me.

    If you upgrade to the latest development build (of v3.17) you can benefit from automatic temporary bans, limited connections from the same IP, and more. See http://wiki.synchro.net/howto:block-hackers for more details.

    digital man

    Synchronet/BBS Terminology Definition #12:
    DCE = Data Communications Equipment (or Deuce, Stephen Hurd)
    Norco, CA WX: 99.9oF, 30.0% humidity, 15 mph ESE wind, 0.00 inches rain/24hrs --- SBBSecho 3.01-Win32
    * Origin: Vertrauen - vert.synchro.net (1:103/705)