Avinti Uncovers New Targeted Destination E-mail Attack Capable Of Bypassing Hosted Messaging Services
LINDON, Utah (September 28, 2005) – Avinti Inc., a leading provider of e-mail outbreak protection, today issued a security alert to all IT departments and e-mail hosting companies regarding a newly discovered Targeted Destination E-Mail attack. The Targeted Destination Attack uses a harvested, specific destination IP address to bypass existing hosted messaging services or internal gateways to deliver a malicious payload direct to a user. Avinti security identified the threat in active use against a customer when a significant number of desktops became infected with the Mytob virus, despite the customer’s use of a leading secure messaging service.
“As the dollar value of information such as digital identities, credit card numbers and intellectual property continues to increase on the black market, targeted destination attacks will increasingly become a preferred tool of the cyber criminal,” said Terry Dickson, chief executive officer of Avinti. “All e-mail depends on a destination IP address, so virtually every e-mail user is at risk from a targeted destination attack. This attack is explicit and site-specific. Mass mailing Spam attacks are quickly stopped by today’s advanced messaging security products and services. Targeted destination attacks, while potentially time consuming for the cyber thief to develop, have at higher potential for success.”
Targeted Destination Attack Overview
Conventional email protection schemas anticipate that all arriving messages are processed through an anti-virus SMTP gateway. With the Targeted Destination Attack, messages are sent directly to harvested IP addresses and ultimately to recipients without the expected MX record lookup and subsequent screening. Unlike the random mass-mailing propagation methods used by viruses in the past, this attack aims for specific sites and users. Harvested addresses could also include one or more servers (such as a test system) with open IP addresses. This may enable a perpetrator to target that specific server to receive incoming traffic. This unfiltered traffic is forwarded by the open system to the e-mail server for delivery and thus bypasses external or internal gateways.
Identifying Targeted Destination Attacks
Avinti security experts advised that the surest method of identifying this attack is to watch incoming traffic at the firewall to determine where the traffic is coming from and where it is directed to. A targeted attack will show incoming traffic from non-trusted or unknown IP addresses and e-mail sent to explicit IP addresses. Other indirect signs of such an attack include an increased number of discoveries by PC-based anti-virus scanning and an increase in the number of virus-laden e-mail that appear onsite.
Preventing Targeted Destination Attacks
Avinti advises IT departments to configure the firewall to accept incoming SMTP traffic only from the hosted service address. If necessary, add only those IP addresses from trusted partners as required. For sites with internal anti-virus gateways, the firewall should forward all Port 25 traffic only to the gateway.
About Avinti Inc.
Founded in 2002, Avinti Inc. is a leader in e-mail outbreak protection that enables organizations and individuals to safely use e-mail as a critical communications tool without fear of malicious, costly attacks. Avinti’s iSolation Server is the first e-mail security solution to close the window of vulnerability from unknown threats by using virtual machine technology and viewing the intended behavior of e-mail attachments to determine a message’s threat potential. Avinti works with existing anti-virus and e-mail security solutions in a layered security approach that eliminates time-zero e-mail viruses from corporate e-mail systems. For additional information, contact Avinti at (801) 443-3200 or visit www.avinti.com.