Email Bombing And Spamming, And Ways To Protect Yourself
Janet Denzel
Bombarded by thousands of unsolicited subscription confirmation emails in your inbox? Your organization may be experiencing an email bomb attack. Read on to learn how to survive an email bomb attack.
Beyond the initial strike, a steady and annoying stream of unwanted emails can keep arriving even years after the attack. To add insult to injury, other attackers will add the victim to additional spam, phishing, and malware lists. For sectors such as healthcare especially, it is critical to keep email HIPAA compliant and secure.
An email bomb is a denial of service attack (DoS) against an email server, designed to make email accounts unusable or cause network downtime. Email bombs started in the late 1990s with high-profile cases such as the cyber attack on Langley Air Force Base in Virginia.
Historically, journalists have found themselves the target of email bombing campaigns in retribution for critical stories. Anyone can be a victim though, including government officials, policymakers, emergency coordinators, healthcare providers, and many others.
An email bomb attack is almost impossible to prevent because any user with a valid email address can spam any other valid email address. However, there are important ways your organization can prepare for an attack.
Attackers compile lists of vulnerable websites and sometimes even advertise how often these lists are updated. Anyone can do a quick online search to find sellers and marketplaces that will email bomb a particular email address for a low fee.
GridBuddy Connect is the data productivity platform that combines your data into an editable, spreadsheet-simple view so your team can get all of their insights in one place and engage confidently using the right data.
Keep marketing campaigns and sales teams running smoothly with accurate data to increase engagement and productivity. When you can trust your data, you can target, engage, and convert customers more effectively.
A mailbombing/mail flooding attack uses a script to fill out hundreds of subscription forms to be sent to one email address. This process sends the target of the attack confirmation messages, subscription notifications, and other transactional messages that overwhelm their inbox and cause it to stop working for an extended period of time.
Any single email enrollment form is usually not abusive on its own, but as part of a massive subscription effort across hundreds of websites at the same time, the impact is exponential. This process makes it harder for a single company to recognize they are part of the problem.
Wondering how to stop email bombing? It takes a few different approaches. Keep reading to understand how you can best prevent mailbombing and minimize the damage to your brand if/when it is unknowingly recruited into a mail bombing attack.
Standard practice is to send a confirmation email for an email recipient to opt-in for messages from your brand. This is a necessary step to ensure your email servers do not automatically send multiple messages to a recipient without their consent.
Continue to update your website to ensure it meets the latest security standards. Everything from your content management systems, plugins, themes, extensions, and server should be routinely updated to make certain they do not present a potential security threat.
Tracking your daily subscription patterns over time can help you identify when it was that your normal trending pattern started to change or subscriptions started to rise more quickly than normal. Once you identify this timeframe, you can evaluate your next steps, which include the following:
Although it can be difficult to immediately know when your emails are being used in a mail bombing email attack, there are proven ways to strengthen your website forms and ensure that your website security is up to date.
Email spoofing attacks are conducted by using a Simple Mail Transfer Protocol or SMTP server and an email platform, such as Outlook, Gmail, etc. The scammer changes fields within the message header, such as the FROM, REPLY-TO, and RETURN-PATH fields.
This is possible because of the way email has evolved. Message headers, which include the TO, FROM, and BCC fields, are separated from the body of the message. Because security was not built in when SMTP was created, SMTP has no way to authenticate addresses.
Email spoofing is a type of cyberattack that targets businesses by using emails with forged sender addresses. Because the recipient trusts the alleged sender, they are more likely to open the email and interact with its contents, such as a malicious link or attachment.
Most email spoofing attempts lead to phishing attacks. A phishing email can appear to be from your bank, employer or boss, or use techniques to coerce information out of you by pretending, for example, to be a government agency.
When the spoofed email appears to be trustworthy, many unsuspecting users send personal information and credentials to hackers. For example, hackers may ask for healthcare information or identity verification.
Email security protocols use domain authentication to reduce threats and spam. The email security protocols in use today are Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
DKIM uses public and private keys to prove that a sender is who they say they are. Each message that goes out through SMTP needs a pair of keys that match a public DNS record, which is verified by the receiving mail server.
Email security gateways, or Secure Email Gateways, are a collection of technologies that work on a network level to block emails that do not meet security policy requirements. An email security gateway scans all incoming and outbound email and may also include capabilities like malware blocking, spam filtering, content filtering, and email archiving. Because these protective actions occur at the network level, users are not impacted at all.
Bart is Senior Product Marketing Manager of Threat Intelligence at CrowdStrike and holds +20 years of experience in threat monitoring, detection and intelligence. After starting his career as a network security operations analyst at a Belgian financial organization, Bart moved to the US East Coast to join multiple cybersecurity companies including 3Com/Tippingpoint, RSA Security, Symantec, McAfee, Venafi and FireEye-Mandiant, holding both product management, as well as product marketing roles.
Email bombing attacks, also known as mail bomb attacks, occur when bots flood an email address or server with hundreds to thousands of email messages. Since the late 2000s, these attacks have been a significant thorn in the sides of CISOs and ordinary email users. This nefarious act can achieve a similar outcome to that of a distributed denial of service (DDoS) attack. Email bomb spam is also frequently deployed to distract and hide important emails.
With over 20 years experience protecting FinTech companies, Daniel has developed and delivered cybersecurity solutions to market for both growing startups and highly-regulated financial sector companies alike.
Specifically, Daniel leads the daily SOC operations by empowering a team of cybersecurity analysts, penetration testers and threat intelligence experts to monitor, prevent, detect, and respond to both suspicious activity and confirmed cyberattacks of potential consequence to BlackCloak clients.
Daniel holds a B.S. in Information Technology from Western Governors University. He also maintains several cybersecurity industry certifications, including Offensive Security Certified Professional (OSCP) and GIAC Certified Forensic Analysts (GCFA). Daniel is also a Microsoft Certified Systems Engineer (MCSE) and a member of InfraGard, a partnership between the Federal Bureau of Investigation (FBI) and members of the private sector for the protection of U.S. Critical Infrastructure.
Maybe, but you need to balance inconvenience of changing email, and be aware that it could simply happen again at some point right after you send you first email or someone CCs you into an email; both these actions put your email address out there
Software exists to register your email with a massive number of companies; effectively everyone who sets up a "register your account with us, we just need to confirm your email" with no barrier such as captcha or having to pay them first effectively creates a robot that can be manipulated into flooding your mailbox with junk. The real question is why was it flooded; it's less likely that the person who broke in last time is doing it just to annoy, and more likely that this flood of emails contains in the center a couple of confirmations of things they bought as you etc. The hope being that you just select all 900 and hit delete
I think it's highly likely, and you should carefully examine the extent to which you were compromised; they'll have been able to comb your entire email history and find all the sites you've purchased from that may still be holding your credit card details, and possibly made purchases from those sites, not just eBay and amazon
You don't need access to an email address to sign up for an account, even if they just reach "confirm your email" stage with some company, then the company still sent you an email. These emails aren't of any concern unless they're actually completing signup (indicating the third party still has access to your email). Bear in mind that if someone does have access to your email then the follow up "you're fully signed up!" could be erased, though it might be curious that the "verify your email" emails remain. The read/unread status isn't much help either as that can be toggled - what you need is a log of activity as to what IP addresses have signed into your mail and when, and review them carefully
bcf7231420