Is it possible to defend against a backscatter attack?

Question

Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender.

The usual best practices are in place: My provider (apparently) uses Bounce Address Tag Validation, and our Sender Policy Framework record ends with -all. Thus, the amount of "regular" NDRs was a lot smaller than it could have been.

Still, I received about 1-3 auto-replies per minute: "I'm on vacation...", "Thanks for contacting us...", "You message contained malicious content...", "I'm out of office...", "Mr. X is no longer with the firm...", "Our e-mail address has changed...", "Your message has been received and a support ticket has been generated..." - just to name a few. Obviously from around the globe and in a multitude of different languages. Quite an interesting read, actually, if you don't have anything better to do.

Unfortunately, I do have better things to do, and, fortunately, some of the auto-replies included a copy of the original message, allowing me to determine the spammer's IP address and get him (or the poor guy whose server he hacked) shut down by his hosting provider.

Still, I was wondering: 1-3 unsolicited mails per minute I can handle next to my "regular" work, but if the spammer had used more hosts (or even a bot network), my mail account would have effectively been DDOS'ed into uselessness.

Is there anything one can do to defend against this kind of "backscatter auto-reply attack"?

Answer 1

The problem is that autoresponders exist, and that they reply to the senders email address, which is easy to spoof.

There is nothing you can do to prevent this. Filtering is ineffective since they are (from the computer's perspective) legitimate messages. Banning the IP is also ineffective since any particular IP is unlikely to send more than a few messages.

Answer 2

An approach that some people take with this is to report these companies for spamming you.

It is a bit questionable, since the senders are themselves being deceived. However, if your SPF record clearly stated that the message was fake and they negligently did not check that before spamming you with a NDR, it may be considered spamming (I know, everyone has its own definition). Some companies have end up at blacklists by issues like this.

Autoreplies that are reacting to From: header rather than the Return path are not as straightforward, though, as they are not covered by SPF, you would need a DMARC policy there, which would have its own issues.

Vacation replies at least (when properly implemented) usually remember addresses emailed and reply only once.

On the other hand, one can't but wonder what would happen for those systems that automatically send a "We have generated a ticket for you" message every time, if they were pointed one to another...

Answer 3

The solution is to pre-process the email headers and subject line in a heuristic filter (using a conditional probability framework, e.g., Bayesian). See similar questions here:

1. Detecting Outlook autoreply/out-of-office emails
2. Filter for Autoreplies in Gmail

If you wish to implement a solution, your IT can program small script that runs on the server prior to serving emails to inboxes (exact implementation depends on your email server type). Email that employs Microsoft Office 365, for example, can quarantine email messages according to various heuristics for review by an administrator.

It is possible to build an add-in for Microsoft Exchange servers using the method documented by Microsoft here: https://docs.microsoft.com/en-us/office/dev/add-ins/publish/centralized-deployment