11 October 2013 smtp auth compromise analysis

gistfile1.txt

   
Top smtp auth talkers for Friday (deidentified).  I believe that only A is compromised.
   1228  authid=A
    314  authid=B 
    190  authid=C
     77  authid=D
     49  authid=E
     44  authid=F


Total volume is too rough to make decisions on.  
I looked at per hour, minute, second rates. 
Per minute seems to be the most useful target. 
 A's rates are below.  
None of the other top 5 ever exceeded 11 messages per minute, 
including B, who I incorrectly reported as compromised (reversed).
B appears to have dysfunctional clients pounding away 24/7.

I think we should be able to *alert* on a per minute threshold.  
Taking *action* will require vendor cooperation.




Thursday log per minute smtp auth for compromised id A 
(log rotates at midnight, so there is a bit of Friday in the Thursday log)

23:32 1
23:36 2
23:40 1
23:41 1
23:42 1
23:44 6
23:53 3
23:56 3
23:57 2
23:58 21
23:59 2
00:00 11
00:02 2
00:03 8
00:05 5
00:06 17
00:07 2
00:08 6
00:09 6


Friday log per minute for compromised id A


00:10 6
00:11 7
00:12 2
00:13 1
00:14 16
00:15 9
00:16 1
00:17 9
00:18 3
00:19 17
00:20 4
00:21 4
00:22 4
00:23 13
00:24 4
00:25 5
00:28 13
00:29 3
00:31 6
00:32 6
00:33 6
00:34 8
00:36 23
00:37 5
00:38 4
00:39 1
00:40 2
00:41 6
00:42 16
00:43 2
00:44 18
00:45 5
00:46 1
00:47 3
00:48 2
00:51 2
00:52 6
00:53 2
00:54 2
00:55 10
00:56 6
00:57 2
00:58 6
00:59 3
01:00 12
01:02 6
01:03 3
01:04 2
01:05 5
01:06 3
01:07 6
01:08 4
01:09 4
01:10 9
01:11 3
01:12 3
01:13 9
01:14 4
01:15 4
01:16 2
01:17 2
01:18 5
01:19 1
01:20 2
01:22 3
01:23 5
01:24 10
01:25 3
01:26 1
01:27 17
01:28 4
01:29 1
01:30 12
01:31 2
01:32 7
01:33 2
01:34 2
01:35 1
01:36 2
01:37 12
01:38 4
01:39 9
01:40 3
01:41 1
01:42 3
01:43 2
01:44 4
01:45 4
01:46 2
01:47 2
01:48 3
01:49 20
01:50 11
01:52 1
01:56 1
01:57 7
01:58 5
01:59 5
02:00 1
02:01 2
02:02 2
02:04 1
02:05 10
02:06 1
02:07 2
02:08 1
02:09 1
02:10 1
02:11 1
02:12 7
02:13 4
02:14 6
02:15 13
02:16 3
02:17 3
02:18 2
02:19 1
02:20 4
02:21 2
02:22 1
02:23 2
02:24 1
02:25 3
02:26 8
02:27 16
02:28 1
02:29 1
02:33 2
02:35 1
02:36 6
02:39 1
02:41 10
02:42 1
02:43 2
02:44 6
02:45 5
02:46 1
02:48 1
02:49 3
02:52 4
02:54 1
02:57 1
02:58 1
03:00 17
03:01 2
03:02 2
03:03 1
03:04 1
03:06 1
03:07 1
03:08 4
03:09 6
03:10 1
03:12 2
03:14 1
03:15 1
03:16 16
03:17 6
03:18 7
03:19 5
03:22 1
03:23 2
03:26 10
03:27 1
03:28 2
03:29 1
03:30 1
03:34 7
03:35 2
03:36 1
03:38 1
03:41 1
03:42 8
03:43 4
03:44 3
03:45 8
03:46 3
03:48 2
03:49 10
03:50 3
03:52 2
03:53 1
03:54 2
03:55 5
03:57 3
03:59 6
04:00 1
04:02 1
04:03 7
04:04 2
04:05 1
04:06 2
04:07 9
04:08 1
04:10 1
04:11 3
04:12 2
04:13 2
04:14 1
04:15 1
04:16 4
04:26 7
04:27 3
04:28 1
04:30 1
04:31 6
04:33 1
04:35 2
04:36 2
04:38 5
04:41 7
04:43 1
04:44 2
04:45 3
04:46 2
04:47 2
04:48 3
04:51 3
04:53 3
04:54 1
04:56 2
04:57 1
04:58 3
04:59 11
05:03 1
05:04 6
05:06 2
05:08 1
05:11 2
05:12 1
05:15 1
05:16 1
05:17 1
05:23 4
05:27 1
05:28 1
05:29 1
05:31 1
05:33 2
05:35 2
05:36 1
05:37 13
05:39 2
05:41 3
05:42 3
05:43 2
05:44 1
05:45 2
05:46 3
05:47 1
05:48 1
05:51 3
05:52 18
05:55 4
05:56 1
05:58 2
05:59 7
06:04 1
06:06 1
06:08 2
06:09 1
06:10 1
06:11 1
06:13 9
06:14 8
06:16 8
06:17 1
06:18 7
06:20 2
06:21 1
06:22 2
06:23 1
06:24 2
06:25 11
06:26 7
06:27 5
06:29 1
06:30 1
06:32 1
06:33 2
06:34 1
06:35 5
06:38 2
06:41 3
06:42 1
06:43 7
06:44 5
06:45 1
06:46 4
06:47 1
06:48 5
06:50 2
06:51 2
06:52 6
06:53 5
06:54 5
06:55 3
06:56 1
06:58 1
07:00 2
07:01 7
07:02 1
07:03 10
07:04 8
07:05 2
07:08 2
07:09 1
07:10 3
07:11 1
07:12 3
07:13 2

Saturday 1 compromise

01:50 3
01:53 13
01:54 1
01:55 30
01:59 1
02:09 13
02:19 2
02:20 2
02:22 15
02:24 1
02:27 2
02:28 29
02:29 1
02:31 3
02:32 17
02:33 5
02:35 4
02:36 6
02:39 7
02:44 3
02:45 8
02:46 2
02:47 14
02:48 14
02:55 1
02:59 16
03:00 3
03:01 2
03:02 12
03:03 1
03:04 3
03:05 4
03:06 1
03:17 3
03:18 21
03:19 4
03:20 1
03:21 1
03:22 6
03:24 6
03:25 1
03:26 2
03:27 2
03:28 2
03:29 1
03:30 7
03:31 10
03:32 1
03:33 1
03:34 1
03:36 14
03:38 1
03:39 1
03:40 11
03:41 7
03:42 2
03:43 1
03:44 1
03:45 4
03:46 7
03:48 1
03:51 5
03:52 10
03:53 2
03:55 3
03:56 10
03:57 5
03:58 10
03:59 3
04:00 2
04:02 3
04:03 10
04:04 3
04:05 7
04:07 1
04:08 3
04:09 2
04:11 6
04:12 4
04:13 4
04:14 2
04:16 3
04:17 1
04:18 3
04:19 1
04:24 3
04:25 2
04:27 1
04:29 4
04:30 1
04:31 3
04:32 1
04:33 2
04:34 13
04:36 12
04:37 2
04:38 7
04:39 3
04:40 6
04:41 2
04:42 17
04:44 9
04:45 4
04:46 2
04:48 1
04:50 5
04:52 2
04:54 5
04:56 1
04:57 5
04:58 4
04:59 4
05:01 9
05:03 3
05:06 1
05:08 1
05:09 4
05:10 3
05:11 3
05:13 1
05:14 2
05:15 1
05:16 1
05:17 1
05:18 4
05:19 4
05:20 11
05:21 2
05:23 2
05:24 7
05:25 13
05:26 4
05:27 6
05:28 1
05:30 2
05:31 2
05:32 3
05:33 11
05:34 1
05:36 6
05:37 10
05:38 1
05:39 2
05:40 9
05:41 1
05:42 2
05:43 1
05:44 2
05:47 8
05:48 7
05:49 2
05:50 4
05:52 3
05:53 3
05:57 4
05:58 4
05:59 2
06:01 1
06:03 3
06:05 1
06:06 1
06:07 2
06:08 3
06:09 1
06:10 9
06:11 3
06:13 5
06:14 2
06:15 2
06:16 2
06:17 3
06:18 2
06:19 1
06:20 6
06:21 2
06:25 1

Saturday 2 compromise. Ramps up after 1 is locked.

01:56 2
01:58 3
01:59 3
02:00 2
02:01 2
02:02 2
02:03 4
02:04 2
02:05 4
02:07 1
02:54 1
02:55 1
03:04 4
05:59 1
06:00 1
06:01 1
06:08 1
06:13 2
06:14 1
06:16 1
06:24 2
06:35 2
06:36 4
06:37 4
06:38 1
06:39 3
06:42 5
06:43 9
06:46 25
06:47 18
06:54 2
06:55 1
06:56 12
06:57 3
06:58 2