IP Networking

Yes, we sent them an email days ago. No reply.

Aus, the mailbomb you describe is one of many kinds of mailbombs. Most mail servers are now set up to limit the size of accepted files. To circumvent this, bomber send many small messages, to the same or similar effect.

However, it is easy and simple to launch many email-based denial of service attacks... the list is large and grows larger every month....

The "Zip of Death" is still a problem today. I can't remember the exact numbers, but you can somehow create a ~32k file that uncompresses to several gig. I've seen it crush mail servers that run AV software that tries to blindly unzip it to scan it.

Also, although difficult, TCP can be tampered with. You have to spoof the source address, and try to predict how the victim will respond so that you can send acceptable responces. This attack has been used in the wild for several years now, and automated tools do exist (think Mitnick vs. Shimomura - they injected commands to open up rsh to all users from all hosts this way). I have played with a few of these tools in the past, and have been able to follow telnet sessions, and inject my own commands (note that this was on my own network, so I wasn't doing this to someone else). I understand that this is doubtful in your situation, and you most likely have the correct people, but just because TCP is "connection oriented" it does not make it tamper-proof.

Hundreads of thousands of email bombs with sustained TCP connections from a single IP address are not hijacked TCP sessions

TCP session hijacking is not used to launch four days of mailbombing....... it is used to hijack independent TCP sessions.

Mailbombs normally have many sessions open at one time.... I am sorry to be so direct, but when I say that IP address blah.blah.blah is launching mailbombs you can be assured that it is..... these are not hijacked special cases of exotic TCP IP session hijacking...

As soon as we blocked the single offensive IP address (visible in lsof and netstat, continuously for days) , the bombs stopped ....

geeezzzz