How did the spammers get this address?

Question

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, [email protected]).

I've now started getting spam mail to that very address. It is highly unlikely that a spammer would have 'guessed' that address. How might the spammer have gotten that address?

Note that I used the standard Ubuntu Server 12.04 LTS virtual machine as provided by Amazon. The server was on a special testing Security Group (like a hardware firewall in Amazon Web Services) which allows world access to ports 25 (legacy SMTP), 80, 443, 465 (SSL SMTP), and 587 (SMTP) but no others. Specifically, ports 22 (SSH), 993 (SSL IMAP) and everything else is accessible only from the IP address of our office.

Additionally, the computer used to send and receive from the test server is a Kubunu Linux machine, thus I doubt that the machine itself was infected with malware. All mail was sent and received in Thunderbird, so a compromised browser plugin also seems unlikely.

I suppose that the mail might have been intercepted in transit. Though most of the testing was done over SSL, there were at least two emails downloaded over IMAP on port 143 without SSL. Is this the most likely attack surface? Am I disregarding other potential attack surfaces?

EDIT: Adding some information to answer comments.

1. The server (actually virtual machine running in Amazon's cloud AWS) was created, tested, and decommissioned all in a single workday, from images (virtual appliances) from Amazon. I find it highly unlikely that the server image was compromised as I use the same image on other servers, and it happens to be one of the most common Amazon server images (Ubuntu Server 12.04 64-bit).

2. The email address was never exposed via Apache. In fact, I don't remember even having installed Apache on the box, though it is possible that I did. In any case, I certainly did not perform any Apache configuration such as setting the email address for "contact admin".

3. The only email sent via the machine were a few test emails to the account in question from my regular email account in Thunderbird, and a few replies to those emails (also done in Thunderbird). Mails were sent and received both via SSL-secured and unsecured connections (SMTP and IMAP).

Answer 1

If it is a catch-all address, they don't need the actual address. The entire point of a catch-all e-mail address is that it catches all mail that would otherwise be undeliverable. If you have [email protected] set as the catch-all, then if I sent an e-mail to [email protected], you would get the message in the super secret mailbox unless there happened to be a bob e-mail account.

Catch-all addresses generally shouldn't be used as your primary mail address. The point of catch-all addresses is to see if people are trying to get ahold of you by some other address (good for finding people trying to connect to dead accounts for example), however they are also always flooded by spammers who will routinely spam common e-mail addresses at any registered domain name.

If they are sending to that address specifically, it is possible that your mail server is disclosing the catch-all address in the way it responds to the servers that are attempting to send mail.

Answer 2

I would check your workstation for malware. Anywhere where that address was a sender or recipient is a candidate.

It is common for malware on your workstation to harvest email addresses for spam, which includes scanning through documents, address books, saved mail messages, and by monitoring mail traffic.

Answer 3

Here are some of the ways which a spammer uses to extract email address of a real user:

• Crawl the web for @ sign with the help of harvesting programs/applications.
• Illegally buy email address from ISP providers via dishonest
  employees.
• Uses dictionary or brute force programs like the one which is used by hackers.
• Gathers email id from free registration/subscription platforms.
• By using backdoor virus/worms.
• Via social channels.

In short each and every platforms where you can register your mail id is used by spammers to gather mail address of companies, users etc. So it is advised to use Words (Name dot Gmail Dot Com) or Images to display email address. Most of the harvesters/virus or programs made to collect email addresses cannot read these formats as they search for ‘@’ sign. Spammers hits most of the computer user via spam mails and you can end up having serious infection. So, it is important for the webmasters, companies, small/large e-businesses to use spam prevention software/services like Scrapesentry (http://www.scrapesentry.com/) , Akismet (http://akismet.com/) , Proofpoint etc on their social/professional platforms.