Securing Groups

An important step in securing your messaging environment is to secure distribution and
mail-enabled security groups. For instance, CompanyABC is a medium-sized company
with 1,000 users. To facilitate companywide notifications, the HR department created a
distribution group called “All Employees,” which contains all 1,000 employees. By default,
there are no message restrictions for new groups, meaning that anyone can send to this
list. If CompanyABC has an Internet Mail SMTP Connector, this group will also have an
SMTP address.

Consider what would happen if a new user sent an email to “All Employees” advertising a
car for sale. Let’s take it one step further and imagine that the user sent it with a read
receipt and delivery notification requested. Thousands of messages can now be generated
from this one mistake and could negatively impact server performance.

Often, intentions are not as innocent as the new user simply making a mistake. Sending
repeated email messages to mail-enabled groups with large memberships is sometimes
used in an attempted denial of service (DoS) attack. The attacker sends an SMTP message
to the “All Employees” group with a delivery notification receipt requested and spoofs the
“Return to” address with the same SMTP address used for the distribution group. So, 1,000
messages are sent, and 1,000 delivery notifications are returned—each of which is then
sent to all 1,000 users in the group! From this one spoofed message, the net effect is (1 +
1000) + (1000 * 1000)=1,001,001 messages! By spoofing the distribution list and including
a delivery notification receipt, this single email results in more than 1 million messages
processed by the system.

Fortunately, for this easy problem, there is an even easier solution. Exchange Server 2010
allows you to configure message restrictions on your distribution groups.

Post a Comment

0 Comments