4

Can someone explain why spammers use email injection? I am a victim and was wondering if there was any other malicious point besides annoying me and filling up my e-mail?

3 Answers 3

2

Email injection is a vulnerability of an application which allows a spammer to piggy-back on that application and send emails through it.

There are several advantages of using this technique:

  • the application sends them = the spammer is anonymous
  • your antispam system may lower its "spam threshold" if the email comes from a reputable place

Why do you think you were specifically a victim of that kind of spam?

To answer your question: there are no more malicious points, except if the spammer used the application not only as the spam vector but also made the spam look as if it was coming from that particular system (adding some phishing to the email)

7
  • 1
    But there are more malicious points! Using OPs website as a relay for sending spam to potentially hundreds of people. This could make common email vendors like GMail and Hotmail automatically filter all incoming messages from OPs site as spam, making it impossible for OP to ever send out a newsletter or whatever.
    – Mrtn
    Jul 7, 2015 at 21:18
  • OP said he was a victim and mentioned that he is annoyed by all the spam he receives as an effect. This suggests that he does not own the vulnerable site but gets email from one. So while your comment about multiple vulnerabilities is OK (this is in line with the link I posted) - he is not particularly impacted.
    – WoJ
    Jul 7, 2015 at 21:23
  • You are right. I misinterpreted what OP asked about. In that case, you are correct.
    – Mrtn
    Jul 7, 2015 at 21:29
  • 1
    Sorry for my improper language, I do own the website and I am being spammed through my "Inquire about Product" php mail() form.
    – Jahan
    Jul 7, 2015 at 21:32
  • 1
    Ok, can you help me understand? How are they able to relay the spam to people, as the email only goes to one inbox? Sorry if this is something simple, I do not understand :S
    – Jahan
    Jul 7, 2015 at 21:36
4

Email injection works exploiting the way a email server processes the requests. A typical email transaction works like this (S is the server, C is the client):

 S: 220 BBN-UNIX.ARPA Simple Mail Transfer Service Ready
 C: HELO USC-ISIF.ARPA
 S: 250 BBN-UNIX.ARPA

 C: MAIL FROM:<[email protected]>
 S: 250 OK

 C: RCPT TO:<[email protected]>
 S: 250 OK

 C: RCPT TO:<[email protected]>
 S: 550 No such user here

 C: RCPT TO:<[email protected]>
 S: 250 OK

 C: DATA
 S: 354 Start mail input; end with <CRLF>.<CRLF>
 C: Blah blah blah...
 C: ...etc. etc. etc.
 C: .
 S: 250 OK

 C: QUIT
 S: 221 BBN-UNIX.ARPA Service closing transmission channel

(got from here)

This is the case for sending a single email. But if you need to send several emails using the same SMTP server, you don't need to HELO again, just send another MAIL FROM and send the next.

An injection works by exploiting the MAIL FROM parameter, by including a full email message on it. For example, take this from address:

[email protected]\nRCPT TO: <[email protected]>\nDATA\nCheapo Viagra pillz\n.\nMAIL FROM: <[email protected]>`

For the mail server, there's two transactions occuring: the first one uses the concatenated overlong from address, and the second one will use the rest of the message your site intended to send.

This method is used a lot by spammers because they will use your bandwidth and your IP address to send spam, so you will end up banned around, not them.

How to solve this? Unless you are a good, security minded programmer, don't code your own email sending solution. There's lots of resources around that take care of validation, rate-limiting, queueing, and other tasks. Use them.

0

By 'Email Injection' , I am assuming that you mean malicious links embedded inside newsletters or spam emails.

Well, you are right in assuming that the hackers have an ulterior motive besides annoying you. These motives could vary from simply stealing your personal information to accessing your bank accounts. Typically, hackers are well aware that users "generally" don't open emails from extremely random agencies or people, so they tend to try and fool you by posing as you bank or your Internet service provider.

It is advised only to open 'in-email' links only when you trust the sender who sent you the mail. Apart from this if you are a victim of "spamming", stay alert and be on the lookout for any email addresses that you might find suspicious and mark them as spam mail. Try not to hand out your daily email address to advertising sites. This will help you in reducing the amount of spam filling your inbox.

2
  • 1
    In this case, the OP owns a site that is being used to send spam. Is the case of spammers abuusing the PHP mail() funcion to send spam.
    – ThoriumBR
    Jul 7, 2015 at 21:23
  • 1
    @user2339071 They are injecting through a php mail() form I have on my website. What's weird is that all the subject includes is comments from other blogs "spuncomments"
    – Jahan
    Jul 7, 2015 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .