1

To ease tracking replies and bounces, we send automated emails such as - order confirmations, password recovery, etc with a unique sender address typically like this FROM sup-[custno]-[invno]-[hash]@sup.ourdom.tld

Now I see failed login attempts to our IMAP-server, with these addresses. Each address is tried 6 times, from IP-addresses all over the world, China, Taiwan, Africa, South America, so it is obviously a botnet.

These addresses only exist in transit and on the recipients device, how could they be picked up by hackers? Do we inform the specific customers that somebody is reading their email?

Are we even allowed to send unsolicited emails to these customers, or can that be considered mails concerning transactions we have had with them previously?

  • The "allowed" part depends on country etc. But this is no unsolicited mass advertisement etc., it's a personal message to someone who is victim of some criminal action that affects you too. In the countries I know of, there might be court orders to not contact or visit a specific person anymore (and you would know this instead of asking here), but but other than that there should be no reason why it should be illegal. – user155462 Jun 19 '18 at 8:41
  • Other than that, don't start with "the mail address with the UUID has sent from IP xyz so I assume your IMAP server is used by a botnet", because IT-illiterate managers sometimes think "you" are the problem and sue you (sadly, some people really are that stupid). Just tell them they are attacking your servers and it needs to stop, and then "if" someone wants technical details, tell it. – user155462 Jun 19 '18 at 9:36
  • You misunderstand. – Lenne Jun 19 '18 at 10:25
  • We sent some emails with unique sender adresses to some customers. Somehow these addresses are now in the hand of somebody trying to access our IMAP. I'm not suspecting the users, because there are a handful of addresses tried, and customers do not know eachother. I'm not suspecting a leak from our servers, because then many more would be leaked, and the addresses are not stored anywhere. One customer order is more than 10 years old. – Lenne Jun 19 '18 at 10:31
  • Yes I did understand that. ... If the problem was "Just tell them they are attacking your servers", then I recommend that not because of users thenselves being evil, but because this is the only usable way to get past "normal" persons to some IT-savvy one. If you explain someone else if abusing their systems, they stop reading at "someone else" and don't care. If you explain technical details, they get afraid why you know eg. their IP etc. – user155462 Jun 19 '18 at 11:00
1

If the customer system is infected or email account is compromised then the attacker can easily get your details.

To answer your second point, I wont suggest to inform your customers about security breach. People wont trust on this part, and may lead to confusion and panic. Instead you can send email to make it look like routine security exercise in which you want people to change there password to have the communications secure.

Block those IP address at network level blacklist or hardware firewall level. One more way is to get new email address for sending.

  • There are way more ip's than is possible to block. I haven't looked back in logs yet (just migrated to new server), but it looks like they are trying slowly to fly beneath the radar. – Lenne Jun 19 '18 at 15:37
0

Attacks where email address books are stolen are fairly common. However, I have only seen this data used for spearphishing attacks, and IMAP login attempts are rather unusual.

I do not think you are not obligated to do anything about the situation. It perhaps would be nice to alert your customers, but by no means necessary. I do not know how this relates to any laws, regulations, or unwritten rules.

If you do choose to notify, to try and avoid backfire, as mentioned in the comments, you should make it clear that you are trying to be helpful, and avoid anything technical unless someone asks for it. You could say that parts of emails you specifically sent to them are being used by malicious parties to attack your company, and that they may want to consider evaluating the security of their email accounts and data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.