Toriss

"An IIS plug-in that makes the SMTP service immune to Reverse NDR Attacks."

Toriss is an IIS plug-in that makes the SMTP service immune to Reverse NDR Attacks (a.k.a. Backscatter Spam).

The Attack
By sending spam to invalid users, the SMTP service will send a bounce-back to the forged From: header with the spam attached. As a result, the mail queue fills up with thousands of undeliverable bounce-backs, slowing down the whole system and making the SMTP service unresponsive. Toriss solves this problem completely.

The Solution
Instead of bouncing emails that are sent to invalid users, Toriss will reject the email as soon as the RCPT command is received. Microsoft left this important security feature out of IIS to motivate people to buy its $1500 ISA Server. However, this foolishly allows the server to be used to send spam by way of the Reverse NDR Attack.

Features

• Prevents Reverse NDR Attacks (also known as Backscatter Spam).
• Blocks email that is addressed to invalid/nonexistent users.
• Email is blocked at the SMTP level, in response to a RCPT command.
• Prevents the mail queue from filling up with undeliverable bounce-backs.
• Automatically detects local POP3 domains and users.
• Can be manually configured to accept specific domains and users.
• Unless auto-detection fails (unlikely), Toriss works right out of the box with no need for configuration.
• Uses virtually no resources. Verified to not leak memory or resources.
• Can be temporarily disabled without restarting IIS.
• Works with all versions of Windows® 2000, XP, 2003, Vista, 2008, and 7.