August 13, 2008 15:30 by
hiho
So you ask: What is tar pitting?
IMHO, tar pitting is a very suitable way to stop misuse of your Windows 2003 / Exchange 2003 SMTP Virtual Server by delaying SMTP responses for 5.x.x errors. This efficiently stops DoS and harvesting attacks on your SMTP servers.
For example: Hacker A continously sends mail to your server, named yourserver.mail.net, the simple purpose being to gather valid e-mail-addresses from your domains. This Brute-Force-Attack is called a "Directory Harvest Attack".
Have a look at this telnet-screenshot, where a simple SMTP-communication is depicted:

Normally, this kind of communication would just take a view milliseconds of time on your SMTP server. With tar pitting enabled, SMTP Virtual Server will freeze the connection for a configurable amount of time before returning "550 5.7.1 Unable to relay". More...
Be the first to rate this post
- Currently 0/5 Stars.
- 1
- 2
- 3
- 4
- 5