The attack started around 8:00am Tuesday morning, when several hundred mail servers from around the world tried sending thousands of emails to a single address. Unfortunately for the attackers PacketViper was on guard.
The customer says they got keyed to the attack when they started receiving unusual mail counts to one of their email addresses. Within a few minutes they realized the attack was on.
“We thought we would need to shut down ports to save our systems. We prepared to apply our port denies to our router/firewalls, and kill mail services. We didn't though, this time we jumped on PacketViper and clicked the networks away. Took less than 30 minutes to get it under control with no outages or delays! Normally we would have to wait for the storm to pass, but this time we went on the offensive and fought back!”
Although the event at its surface seemed serious and could have caused disruption if left unattended, the attack was watered down because of preexisting Country and GNL blocks on the customers PacketViper.
The customer was able to simply point and click the attacking networks within their unfiltered countries, and block all the networks of the sending IP’s. In just a few minutes this customer was able to turn a global email bomb attack into a small, less than irritating spamming event. No ports or email accounts had to be shut down.
Post assessment revealed PacketViper was dropping roughly a million new connections per hour, and although only 10-15 thousand messages made it to their spam firewall, the number could have been well over hundred thousand if country and GNL blocks were not in place.
Viper Network Systems said their Global Network Lists grew by several hundred, which now have network dossiers, and already been published to all PacketViper customers.
PacketViper held its ground and turned a popular email weapon ineffective. See the customer’s statistics at http://www.packetviper.com/
Viper Network Systems: “ We did find a silver lining in this attack. We identified several thousand additional vulnerable networks, added those to our Global Network Lists (GNLs), cataloged them, and published them to all PacketVipers.”
