915124 - IMAP login - multiple usernames attemped

Status: RESOLVED INCOMPLETE

(Thunderbird :: Security, defect)

Description

[Chris Tampin]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36

Steps to reproduce:

Set up IMAP account - entered username and password and connection details - connected successfully. Used the account to download from a dovecot IMAP server which also runs fail2ban.


Actual results:

Server security software locked me out of the server after a few days. 

Inspecting the dovecot logs on the server ... Thunderbird usually uses the correct username (john.doe.domainname) to download mail but occasionally uses the incorrect username ([e-mail]), about 5 or 6 times a day out of maybe 100 connections. The authentication failures are picked up by security software on the server and my IP address gets banned in iptables. I then have to find somewhere else to connect from and reset the firewall to allow my home connection back through, or wait until my ISP's DHCP server gives me a new address (they can be quite "sticky" sometimes, multiple renewals required).


Expected results:

Always use the username I typed into the account setup to connect and once connection has been successful NEVER start guessing other credentials.

Comment 1

[WADA:World Anti-bad-Duping Agency]

(In reply to Chris Tampin from comment #0)
> correct username (john.doe.domainname) to download mail 
> but occasionally uses the incorrect username ([e-mail]), (snip)

AFAIK, Tb always uses mail.server.serverX.realuserName(or userName if realuserName doesn't exist) for login.
i.e. If UserID=abc@x.y.z instead of abc, user has to type abc@x.y.z fully as UserID at Server Settings in Tb, and if UserID=abc.x.y instead of abc@x.y.z, user has to type abc.x.y properly as UserID at Server Settings in Tb.

"login using [e-mail] by other IMAP client", isn't it?
- MS's mailer usually accepts account definition with "ServerName=domainname.com,
  Username=john.doe" even when actual/correct UserID=[e-mail],
  and MS's mailer usually tries to login with UserID = john.doe  + @ + ServerName
  if specified "john.doe" is not correct UserID.
- If IMAP connection uses SSL, and if mail scanner of anti-virus software is used,
  local proxy of anti-virus software is usually used.
  Tb <-non-SSL-> port=143, Proxy,actual Server/UserID def. <-SSL-> port=993, actual server

Comment 2

[Chris Tampin]

No other IMAP clients are used. 

I never thought about it before but there is AV software installed on the client. Avast mail shield sits between the connection from Thunderbird to the server. I will turn off the mail shield in the AV software and monitor logs again - as it could be the AV software occasionally mangling the credentials and not TB.

Comment 3

[WADA:World Anti-bad-Duping Agency]

(In reply to Chris Tampin from comment #2)
> No other IMAP clients are used. 

"other IMAP client" in this context is not "other mailer than Tb on your PC" only. All of following is "other IMAP client than Tb you use on your PC".
- different account in your Tb on your PC.
  Following are different account definitions in Tb.
   accountA: type=imap, server=imap.googlemail.com, UserID=[e-mail]/password=abcdefg
   accountB: type=imap, server=imap.gmail.com,      UserID=[e-mail]/password=abcdefg
   accountC: type=imap, server=74.125.129.109,      UserID=[e-mail]/password=abcdefg
  However, these are absolutely same account at server.
  So, if UserID setting of accountB/C is incorrect, phenomenon you saw can occur.
- other mailer including access via Browser(Web mail) on your PC.
- Anti-virus on your PC
- Tb, SeaMonkey, and other mailer including access via Browser(Web mail) on other PC,
  Anti-virus on other PC.
  Other PC: other PC owned by you, or other PC which unknown people owns.
  They tried to login with wrong UserID multiple times, then IP address was blocked.
  After it, same global IP address was assigned to your PC.

Please surely rule out such cases first, because here is bugzilla.mozilla.org to report actual Tb's bug8flaw in Tb's code) to developers.
Please provide evidence(log, trace data, account definition in prefs.js etc.) that Tb actually requested login with wrong [e-mail] even though you specfied correct john.doe.domainname at any places of your account definition in Tb.

Comment 4

[WADA:World Anti-bad-Duping Agency]

Did you tried to create the IMAP account via auto-config of Tb?
 (with specifiyng mail-addr=[e-mail] and passsword only)
If yes, Tb may try to login to domainname.com with UserID=john.doe and UserID=[e-mail], because UserID guessing and trial&error is meeded to know correct UserID for account of mail-addr=[e-mail].
If you tried to create multiple accounts on your domainname.com server using auto-config of Tb, it may cause exceeding "maximum number of contiguous login error".

Comment 5

[Chris Tampin]

The server was set up using Virtualmin to generate auto-config settings for TB for each virtual domain. 

I did use auto-config to get the settings from the server into the TB client and they were filled in correctly in the account setup dialog of TB. Connected successfully and I collected and sent mail without issues for a few days before the iptable bans started (once I had exceeded the login failure limits of the security software). Dovecot logs show hundreds of successful connections/logins using the correct details and 5-10 login failures per day.

Comment 6

[WADA:World Anti-bad-Duping Agency]

(In reply to Chris Tampin from comment #5)
> and 5-10 login failures per day.

Actually "try of login with wrong UserID=[e-mail] by the your Tb on the your PC"?

Comment 7

[Wayne Mery (:wsmwk)]

(In reply to WADA from comment #6)
> Actually "try of login with wrong UserID=[e-mail] by the your
> Tb on the your PC"?

Comment 8

[Phoenix]

Resolved per whiteboard