CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.3  The Web            9  2.3.4.2  ActiveX

2.3.4.6  CGI 1 2 2.4  Directory

What are the Security Implications?

Alas, there’s a down side to SMTP relays, which we hinted at when discussing Email and spam earlier in this section, due to the way SMTP works. Users connect to SMTP servers for the purposes of sending email, and then simply start dumping message data into them, without authenticating themselves to the SMTP server. Connecting to your ISP’s SMTP server is generally the same as connecting to another – after all, everyone uses the same standard protocol to send mail. What, then is to stop a spammer from connecting to ANY ISP’s SMTP server to send mail, as a way of helping obscure their identity? The answer is, very little, at least in the SMTP protocol itself.

Although SMTP servers didn’t start out this way, most now provide the administrator with the capability to block connections from anyone except users who are connecting from addresses in the SMTP server’s Internet domain, as a way of prohibiting anyone and everyone from using that SMTP server as a way to dump zillions of spam messages into the Internet. Others add a requirement that the users authenticate themselves when connecting to the SMTP server.

SMTP relays that do not perform this connection domain check and do not require authentication are referred to as “open relays”, and numerous administrators regard them as evil. Some administrators, on a perennial quest to rid their corner of the Internet of junk mail, maintain “black hole lists” of sites whose SMTP servers are open relays, and refuse to accept any email from those domains. This can be a minor nightmare for an administrator of one of the blocked domains who has a user who needs to send email to the other domain, and who has fixed the original open relay issue that landed them on the “black hole list” to begin with. Maintainers of these lists tend to be much more enthusiastic about adding sites to a black hole list, than they are about removing repaired sites from the list.

2.3.4.6  CGI 1 2 2.4  Directory