Spread the word, not the virus!

Organizations have traditionally blocked outbound Simple Mail Transfer Protocol (SMTP) traffic on port 25 that originates from the local area network (LAN) and virtual private network (VPN) segments. This is done to prevent any internal machine that has been infected with a mass-mailer from spamming the outside world. Email can be traced back to its origin via ip address information contained in the mail header, and no organization wants to be held responsible for spreading malware onto the internet – it would be a public relations nightmare.

By blocking port 25 at the firewall, an organization prevents a mass-mailer from spreading. However, by blindly blocking outgoing SMTP traffic, valuable information on real-time internal infections or data leakage arising from threats that use port 25 is lost.

In this month’s Oct 2007 edition of Virus Bulletin, we proposed the need for an in-house SMTP honeypot. A copy of this article titled “The need for an in-house SMTP Honeypot” can be downloaded from our McAfee Avert Labs Technical White Papers page.

Simple Mail Transfer Protocol honeypots have traditionally been used to masquerade as open-relays in order to frustrate spammers and harvest spam. With changed spammer tactics over the years, it is high time we revisited traditional countermeasures and improved upon them.