Last Updated: 2021-10-13 13:45:31 UTC
by Johannes Ullrich (Version: 1)
Recently, I am seeing a lot of identical failed login attempts against my mail server. Just today, about 130,000 of them. The vast majority (124k+) come from one subnet: 126.96.36.199/24
inetnum: 188.8.131.52 - 184.108.40.206
Brute force attempts by themselves are not that special, but these are in particular annoying as the tool they are using appears to be broken. Here is the complete login attempt (they all look exactly the same):
[Blue: data from server, Red: data from client]
It starts harmless enough with my mail server sending a standard banner
220 mail.localdomain ESMTP Postfix (Debian/GNU)
The "attacker" responds with an EHLO. The "localhost" is a bit odd, but well, I told them that I am mail.localdomain. So I will take that.
As it should in response to an "EHLO", my mail server will list its capabilities. Note that the client is not taking advantage of STARTTLS.
250-AUTH PLAIN LOGIN
Insert the Client "resets" the connect. Bit odd, and I probably should drop things here. But I am always interested in seeing where things go...
So I am responding with a standard "OK".
250 2.0.0 Ok
The client now attempts to "Login"
As common for "AUTH LOGIN", my mail server responds with a base64 encoded string "Username:". I am sure the bot appreciates that my mail server tells it what to send next.
The username, also base64 encoded, is "nan".
For those of you familiar with Base64 (or standard logins), you will probably know what comes next: "Password:"
The password sent: Nan (upper case N unlike the username).
Sadly, this fails... and I send you an error telling you so.
535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
221 2.0.0 Bye
Ok. The attacker is going at this all day long, the strategy appears to be more "password spraying" than "brute forcing" as it does not attempt too many attempts on a particular account. I don't believe they even bother with using leaked credentials of mine, but instead they just simply go for volume.
There are a number of ways how this attack could be a lot more effective:
- Use more IP addresses. I long blocked that /24 and it still keeps coming.
- Figure out if the usernames actually exist. It isn't that hard. Don't waste your time on nonexisting accounts
- Use better password lists
- Try this against a government network. They may (a) be not as well protected and (b) have more valuable data.