Re: fingering e-mail addresses

Article View: aus.net.mail

Article #57

#57

From: Jacques Distler
Date: Sun, 05 Sep 1999 00:00

52 lines
2984 bytes

In article <37D27ACE.B9548F91@e-softinc.com>, Thomas Reinke
<reinke@e-softinc.com> wrote:

>And unless i miss my guess (tested this on Sendmail on RedHat 5.2),
>the default install always responds with a 250 OK, even if the
>address is not valid. So does our ISP (8.8.7, 8.9.1 respectively).

Really, I tried this on Redhat 6.0 (Sendmail 8.9.3) and AIX (Sendmail
8.8.8), and found:

3> telnet xxxx smtp
Trying nnn.nnn.nnn.nnn... Connected to xxxx.utexas.edu.
Escape character is '^]'.
220 xxxx.utexas.edu ESMTP Sendmail 8.9.3/8.9.3; Sun, 5 Sep 1999 10:39:43 -0500
HELO yyyy.utexas.edu
250 xxxx.utexas.edu Hello
IDENT:NwxyXYA7+fffYaAa0y/OWQmavji2QBPu@yyyy.utexas.edu [mmm.mmm.mmm.mmm],
pleased to meet you
MAIL FROM: me@yyyy.utexas.edu
250 me@yyyy.utexas.edu... Sender ok
RCPT TO: zarquan@xxxx.utexas.edu
550 zarquan@xxxx.utexas.edu... User unknown
RCPT TO: zarquan@physics.utexas.edu
550 zarquan@xxxx.utexas.edu... Addressee unknown
RCPT TO: ralph@xxxx.utexas.edu
250 ralph@xxxx.utexas.edu... Recipient ok
QUIT
221 xxxx.utexas.edu closing connection
Connection closed by foreign host.

It's true that the RFC does not *require* the 250 response to be accurate.
But in my experience almost all mail servers do respond correctly.

>Tollef Fog Heen wrote:
>> 
>> distler@golem.ph.utexas.edu (Jacques Distler) writes:
>> 
>> > There's no way to disable *that* without breaking SMTP (which is why only
>> > a bozo would disable VRFY).
>> 
>> There was a discussion regarding this on bugtraq some time ago, where
>> spammers had used exactly this method of gathering addresses.

Which is probably why some Sendmail setups (including, evidently, that of
the poster) have been modified to conceal this information until after the
DATA portion.

Jacques

-- 
PGP public key: http://golem.ph.utexas.edu/~distler/distler.asc

Technical Details

Message-ID: <distler-0509991105430001@192.168.0.1>

Path: arc1-ca.pugleaf.net!unknown!not-for-mail

References:

<37CB6A34.7178@cygnus.uwa.edu> <7qqnji$q2l$1@lios.apana.org.au> <37d985c4.7783654@news.earthlink.net> <distler-0409992051420001@192.168.0.1> <37D21508.6828@cygnus.uwa.edu> <distler-0509990250210001@192.168.0.1> <m37lm57ew4.fsf@ft193216227195.dep.no> <37D27ACE.B9548F91@e-softinc.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10952f,23199f1e3f0d22e7
X-Google-Attributes: gid10952f,public
X-Google-Thread: 108c83,23199f1e3f0d22e7
X-Google-Attributes: gid108c83,public
X-Google-Thread: 1090e7,37552a33cbddf452
X-Google-Attributes: gid1090e7,public
From: distler@golem.ph.utexas.edu (Jacques Distler)
Subject: Re: fingering e-mail addresses
Date: 1999/09/05
Message-ID: <distler-0509991105430001@192.168.0.1>
X-Deja-AN: 521343285
References: <37CB6A34.7178@cygnus.uwa.edu> <7qqnji$q2l$1@lios.apana.org.au> <37d985c4.7783654@news.earthlink.net> <distler-0409992051420001@192.168.0.1> <37D21508.6828@cygnus.uwa.edu> <distler-0509990250210001@192.168.0.1> <m37lm57ew4.fsf@ft193216227195.dep.no> <37D27ACE.B9548F91@e-softinc.com>
X-Image-URL: http://golem.ph.utexas.edu/~distler/x-image.jpg
X-Face: #m:M:[ZK_2%p0fVui~CU:PB(Lv<2h/^?'zdcs29!62<k:VuJnr=j}IK$ohm&T /gnVR"|LWyKVK{`$&t&`k{]Q^x*"ihe+^hTvWs@IEMtYI5RVzGFBPcMu`}>@#^Fm:<)M w83/\[@#\u?TVrF3fqDjK?
Organization: Physics Department, University of Texas at Austin
Newsgroups: aus.net.mail,aus.computers,comp.security.unix

Reply to Parent Message