3

An email was sent from our MS Exchange server and the addresses were listed in the bcc area. This email was forwarded to another person who was able to somehow extract the bcc list and email everyone contained in the list.

Can you tell me how this might have been done and how to best prevent it in the future? Or could you please provide a resource that would provide this information. I'm concerned about sending any additional emails knowing that the bcc is not secure.

Improve this question
2
  • 2
    The sender's version of the email was forwarded? I'd want to confirm the actual flow of data in this scenario.
    – schroeder ♦
    Commented Nov 22, 2016 at 7:48
  • I double-checked this. No, the person who exposed the list was on the original BCC email list. They were then able to extract the list and email everyone with the list fully available to everyone. I am amazed at these responses. Thank you so much for your help and for your clear and concise information.
    – MWM
    Commented Nov 26, 2016 at 19:45

2 Answers 2

Reset to default
2

The whole idea of BCC is to not disclose any BCC recipients to each other. An email program whose sent mails allow the recovery of BCC recipients is terribly broken.

The Exchange Online docs also confirm that they don't intend to forward addresses in BCC:

Bcc recipients are stored in the message in the sender’s mailbox, but not included in headers of the message delivered to recipients.

Ideas about what could have happened:

  • Did you use BCC correctly? It only hides the list of BCC recipients. Any addresses in the TO and CC fields will be disclosed to everyone who received the mail, regardless which field they're in themselves. (That is, a BCC recipient will know who was in CC.)
  • Did you use any email encryption system? There is some research, for example in this Stanford paper, on how numerous encryption systems completely expose BCC recipients due to their encryption mechanisms.
  • Does the person who accessed the recipients have access to the mail server or its traffic? The messages to BCC recipients are visible in the traffic and server logs just like any other emails.

To investigate the problem further, you could send a test mail with you and someone else on BCC, and inspect the raw email data to see if there are any hidden headers indicating the BCC recipients.

If you only have a small number of BCC recipients you might prefer to first send the message to all disclosed recipients and afterwards forward it to everyone else individually.

Improve this answer
1
  • Thank you very much for your response. Nothing was placed in the TO or the CC areas. No encryption system was used. The person who exposed the list has no access to the server or the server traffic. They are completely external. We will be implementing a solution that will do exactly as you have suggested to send the messages out individually. We were operating under the false impression that BCC prevented the email addressed from being exposed. I really wanted to understand how this happened.
    – MWM
    Commented Nov 26, 2016 at 19:58
2

The BCC is a very special header field. It is intended to be used by the mail user agent (MUA) sending the mail to build the enveloppe address list and should immediately be removed from the text of the mail.

The enveloppe address list is what is used in the SMTP protocol as value for the SMTP RCPT TO: command and can be fully independant of any header value in the text of the message - this feature is use both by spammers and by spam filters...

The RFC 5322 says:

The "Bcc:" field (where the "Bcc" means "Blind Carbon Copy") contains addresses of recipients of the message whose addresses are not to be revealed to other recipients of the message. There are three ways in which the "Bcc:" field is used. In the first case, when a message containing a "Bcc:" field is prepared to be sent, the "Bcc:" line is removed even though all of the recipients (including those specified in the "Bcc:" field) are sent a copy of the message. In the second case, recipients specified in the "To:" and "Cc:" lines each are sent a copy of the message with the "Bcc:" line removed as above, but the recipients on the "Bcc:" line get a separate copy of the message containing a "Bcc:" line. (When there are multiple recipient addresses in the "Bcc:" field, some implementations actually send a separate copy of the message to each recipient with a "Bcc:" containing only the address of that particular recipient.) Finally, since a "Bcc:" field may contain no addresses, a "Bcc:" field can be sent without any addresses indicating to the recipients that blind copies were sent to someone. Which method to use with "Bcc:" fields is implementation dependent...

In any case, the BCC line as composed in the initial message should never reach any recipient. More exactly it should never leave the original MUA. So you should wonder:

  • was the BCC list find in the message itself => the original MUA is to blame
  • was the BCC list rebuild from the logs of a mail transfert agent (sendmail or postfix) => it is normal. After all the mail transfert agent has to know to what addresses or mail boxes it should deliver the mail...
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .