NET@DDRESS pro Email Attacks?

Dateline 04/20/98

"Attack is the reaction. I never think I have hit hard unless it rebounds."   Samuel Johnson

Aardvark has found out something spectacular: USA.net helps hackers launch email attacks!

   (Not uninteresting, "even a half-smart Net user" can be a "hacker" if only they are "malevolent".)

Denial of Service Attacks

Indeed, it is appallingly easy to create a flood of email (or, more dramatic, a "denial of service attack"; or, funnier, a DOS) to any Internet user with an email address:

   Net@ddress is a free Web-based email service. Among its many features is the ability to forward mail to another email address.

   Once the forwarding has been set up you just have to create some traffic to keep your enemy (?) entertained. Usa.net also tries to entertain its customers, mainly with another feature called "DirectDelivery", a service similar to Netscape's In-Box Direct. DirectDelivery lets you subscribe to email information from sources such as the LA Times or InfoBeat.

   Aardvark also suggest subscribing to mailing list to jam the victim's inbox, but - unfortunately - "normal" mailing lists are usually too easy to unsubscribe from, unlike the DirectDelivery mailing lists.

A Better DOS

When it comes to generating traffic another free Internet service looks much more promising: NetMind's URL-Minder.

   URL-Minder watches registered sites for you and sends an email notification when it finds they have changed. It is even possible to have the whole updated page emailed!

   Now that alone must be the "hacker's" dream... but in connection with the Net@ddress forwarding feature we have a seemingly unbeatable weapon.

What To Do About It

NetMind has implemented a policy that makes it almost impossible to create denial of service attacks with URL-minder. Upon each registration of a site the target email address receives a message that explains what happened and includes information how to cancel the subscription. This also renders it more or less useless for out pretty double stroke strategy.

   A similar confirmation email should also defuse the Net@ddress forwarding service. The forwarding works in connection with the mail filters, making it possible to have specific email sent to specific addresses. Why not tell the person behind the target email address what is going on and give them some control over it?

   This and a more responsive Usa.net should make everybody happy again - except the "half-smart, malevolent Net users". But they're never happy anyways.