6

I remember reading somewhere that you shouldn't reply to spam because it confirms that the email is used, and makes it more likely that you will be targetted.

Does this mean that automatic replies that say "I'm out of the office" when you're going to be on holiday for a couple of weeks are bad security practice?

Beyond confirming the existence of the email address, it seems like the information could also be used by offline thieves to time their burglaries. Is there any evidence that spam mails have been used like this in the past?

5

On many email servers it is possible to confirm whether an email address exists or not depending on whether you get a bounce message back from their SMTP server.

e.g.

Return-path: <>
Envelope-to: sender@example.com
Delivery-date: Thu, 25 Oct 2012 16:42:54 -0400
Received: from mailnull by ecbiz103.example.org with local (Exim 4.77)
id 1TRUGT-0005Qd-RT
for sender@example.com; Thu, 25 Oct 2012 16:42:54 -0400
X-Failed-Recipients: recipient@example.edu
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@ecbiz103.example.org>
To: sender@example.com
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1TRUGT-0005Qd-RT@ecbiz103.example.org>
Date: Thu, 25 Oct 2012 16:42:53 -0400

This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

recipient@example.edu
No Such User Here

------ This is a copy of the message, including all the headers. ------
Return-path: <s...

However, existent but inactive accounts would not generate such a message.

The out of office autoreply does confirm that the email exists, and that it is in active use. As you say, depending on the contents it could leak information regarding the whereabouts of the recipient. This would be more of a concern for personal email accounts than that of a corporation because it is more likely that the user is physically not present at their home should such an email be received.

Some mail systems can be set to only reply to known addresses in the local address book with the out of office message. This prevents any malicious senders from gaining from their information gathering exercise. Also, many systems that filter email into spam folders do not send autoreplies for such messages.

1

Another problem with auto-responders is that they can cause your mail server to become blacklisted in spam block lists. Many spam messages are sent from spoofed/forged sender addresses. If a spam message is sent to your address, and the sender address is a trap address, and your auto-responder responds to the spam message and sends a message back to the trap address, then this may cause your mail server to become blacklisted. See https://www.spamcop.net/fom-serve/cache/329.html for more info.

1

This question is subjective to the firm you are working for and the position you hold with the firm. This tool that is built into office can be used against you and provide target rich Intel to mass spammers and exploiteers.

For example your primary smtp gets leaked (somehow or another). This address gets hit with an automated spam cannon and returns a hit to attacker saying you are out office. The contents of auto reply is the real security issue- although all auto replies should be questioned. If the contents contain supervisor or other position redundancies then this data could be used to socially engineer a chain of command within the company. This can also be used to identify failures in employee redundancy. If your title is "malware intrusion analyst lead" then it could be assumed by attackers that the first and second tier incident responders are still actively watching for intrusion. Either way having a title can sway the attacker in a direction to act upon the return:

If it is believed you are the sole analyst then attacks seem welcome, if you are believed to be one of many but the lead then actionability may be degraded until you return.

If you include your supervisors details then this can be used to "leak" other higher value targets to the attacker.

I am a malware intrusion detection analyst and have never used the out of office functionality for this very reason. If you need to have comms external from exchange for emergency IR, I would suggest groupme or slack to provide a specific IR channel to only use in emergency contact scenarios.

Groupme provides a free API service that you can hit using their "bots" and a message will come to your phone.

Again this is subjective but true security professionals and supporting staff are always "in office" because the attacker can be "in office" anytime day or night.

http://www.scientificamerican.com/article/how-out-of-office-replies-can-put-workers-at-risk/

  • +1 for the link, but I'm not convinced that out-of-office replies are the best/most likely target for those who are after chain-of-command and social engineering information. – craq Mar 30 '16 at 9:26
  • Agreed that the likelihood for targeting is minimal due to the smaller data return in most cases, but to speak to the question asked...auto replies can and are used to extort information from users. Of course there are more viable social engineering methods, but that would be out of this scope. – Charles Mar 30 '16 at 10:16
-1

You can specify to send out of office messages only to people internal to your organization if you are using Outlook

Based on the other answers this might seem like the best option.

I don't know of any option that allows you to add domains to the list of "internal" e-mails. It would be practical to add your customer domains or third parties to the list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.