> On 17 Nov 2021, at 08:12, Hans-Martin Mosner <h...@heeg.de> wrote: > > Hi folks, > > I'm trying to understand the root causes and vulnerabilities that lead to > hacked mailboxes. Currently, we can handle dynamic IP ranges pretty well, and > we have an extensive list of network ranges whose owner are spammers or > knowingly accept spammers as customers. > > So what mainly remains as spam sources are hacked servers/websites, hacked > mail accounts, and freemail accounts registered with the purpose of spamming > (I'm looking at you, Google). > > Here I want to focus on hacked mail accounts. I can think of two major root > causes but I have no idea about their relative significance: > > Easily guessable passwords, with two subcauses for exploits: > Brute force authentication attempts - I'm seeing them regularly, and the most > egregious networks (e.g. 5.188.206.0/24) are fully blocked at our mailserver, > but some mailops are less struct about blocking such abusers. > Hashed password data exfiltration and cracking (for example using JtR) these > lists - this would work better with weaker password hashing, but with weak > passwords and some CPU power it is probably possible even for strong hash > algorithms. > Malware on client machines where passwords are either stored in a password > vault, or entered manually.
Reused passwords is another. A fair number of websites seem to store user accounts with email addresses and plaintext passwords. When they inevitably get compromised there are bad actors who’ll grab those dumps and try those passwords against the email accounts. > My gut feeling is that some organizations are especially prone to hacked mail > accounts. We're seeing lots of south american government agency users, and > many accounts at educational institutions. The latter are often hosted using > Microsoft O365 services, and I highly suspect that weak passwords for all the > freshly created student accounts may be a major cause, although exfiltrated > password data may be a possibility, too. > > So does anyone have pointers to studies analyzing these (and probably more) > causes of exploited mail accounts > > Cheers, Steve
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/anti-abuse-wg
