2

Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender.

The usual best practices are in place: My provider (apparently) uses Bounce Address Tag Validation, and our Sender Policy Framework record ends with -all. Thus, the amount of "regular" NDRs was a lot smaller than it could have been.

Still, I received about 1-3 auto-replies per minute: "I'm on vacation...", "Thanks for contacting us...", "You message contained malicious content...", "I'm out of office...", "Mr. X is no longer with the firm...", "Our e-mail address has changed...", "Your message has been received and a support ticket has been generated..." - just to name a few. Obviously from around the globe and in a multitude of different languages. Quite an interesting read, actually, if you don't have anything better to do.

Unfortunately, I do have better things to do, and, fortunately, some of the auto-replies included a copy of the original message, allowing me to determine the spammer's IP address and get him (or the poor guy whose server he hacked) shut down by his hosting provider.

Still, I was wondering: 1-3 unsolicited mails per minute I can handle next to my "regular" work, but if the spammer had used more hosts (or even a bot network), my mail account would have effectively been DDOS'ed into uselessness.

Is there anything one can do to defend against this kind of "backscatter auto-reply attack"?

  • This is no security real measure. You can filter mails you want to receive and unwanted ones with your mailing box if it is Office 365. Either whitelist only the ones you want and keep them in a separated folder, or if there aren't too much different auto-reply, black list their domain. – Kaël Oct 31 '18 at 8:57
  • Has your provider implemented DKIM in addition to SPF? blog.woodpecker.co/cold-email/spf-dkim – Mavaddat Javid Oct 31 '18 at 10:31
  • @MavaddatJavid: We haven't set up DKIM yet - we need to evaluate compatibility with all our systems first. Is it worth the effort, or is it likely that those who ignore SPF will also ignore DKIM? – Heinzi Oct 31 '18 at 12:16
  • @MavaddatJavid DKIM and SPF are useful but will do nothing for what you're asking about. auto-replies come from legitimate mail servers with actual users. – PushfPopf Oct 31 '18 at 15:35
  • @PushfPopf: DKIM and SPF should prevent the spam mails from reaching those legitimate servers in the first place. If the actual users don't get the spam mails, I don't get their auto replies. – Heinzi Oct 31 '18 at 15:48
1

The problem is that autoresponders exist, and that they reply to the senders email address, which is easy to spoof.

There is nothing you can do to prevent this. Filtering is ineffective since they are (from the computer's perspective) legitimate messages. Banning the IP is also ineffective since any particular IP is unlikely to send more than a few messages.

0

An approach that some people take with this is to report these companies for spamming you.

It is a bit questionable, since the senders are themselves being deceived. However, if your SPF record clearly stated that the message was fake and they negligently did not check that before spamming you with a NDR, it may be considered spamming (I know, everyone has its own definition). Some companies have end up at blacklists by issues like this.

Autoreplies that are reacting to From: header rather than the Return path are not as straightforward, though, as they are not covered by SPF, you would need a DMARC policy there, which would have its own issues.

Vacation replies at least (when properly implemented) usually remember addresses emailed and reply only once.

On the other hand, one can't but wonder what would happen for those systems that automatically send a "We have generated a ticket for you" message every time, if they were pointed one to another...

0

The solution is to pre-process the email headers and subject line in a heuristic filter (using a conditional probability framework, e.g., Bayesian). See similar questions here:

  1. Detecting Outlook autoreply/out-of-office emails
  2. Filter for Autoreplies in Gmail

If you wish to implement a solution, your IT can program small script that runs on the server prior to serving emails to inboxes (exact implementation depends on your email server type). Email that employs Microsoft Office 365, for example, can quarantine email messages according to various heuristics for review by an administrator.

It is possible to build an add-in for Microsoft Exchange servers using the method documented by Microsoft here: https://docs.microsoft.com/en-us/office/dev/add-ins/publish/centralized-deployment

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.