Threats I hunted
SubdoMailing & EchoSpoofing
Two campaigns that sent millions of perfectly authenticated emails a day — from hijacked MSN and eBay subdomains, and through Proofpoint’s own relays as Disney, Nike and IBM. I named both, and both names became industry terms.
- 2 terms
- now used by Microsoft, Broadcom, Spamhaus and Red Sift
- 8,000+
- hijacked domains · SubdoMailing
- 3M / day
- spoofed emails, peaking at 14M · EchoSpoofing
SubdoMailing: a spam operation that passed every email check, because it was sending from domains the world already trusted. The trick was abandoned CNAME and SPF records of brands like MSN, VMware, McAfee and eBay, pointing at infrastructure nobody owned anymore. We mapped the whole factory — 8,000+ domains, 13,000+ subdomains — and Spamhaus and Red Sift built advisories and scanners around the name.
EchoSpoofing: an overly permissive relay setting let any Office 365 tenant push mail through Proofpoint’s outbound servers and come out with valid SPF and DKIM signatures of Fortune 100 brands. We traced the campaign, reproduced it end-to-end and worked with Proofpoint to shut it down. Microsoft and Broadcom then shipped protections named after it.
In the press
BleepingComputerHijacked subdomains of major brands used in massive spam campaign The Hacker News8,000+ Subdomains of Trusted Brands Hijacked in Massive 'SubdoMailing' Spam Operation Dark ReadingEBay, VMware, McAfee Subdomains Hijacked in Sprawling Phishing Operation Geektimeפתחתם מייל מדיסני פלוס? חוקרים ישראליים גילו שיכול להיות שאלו האקרים מתחזים
- ForbesSubdoMailing Threat To New Gmail Security Rules
- NJCCICBeware of Active Subdomain Hijacking Operation
- SpamhausSubdoMailing: Exploiting Dangling DNS Records and SPF Authentication
- BleepingComputerProofpoint settings exploited to send millions of phishing emails daily
- The Hacker NewsProofpoint Email Routing Flaw Exploited to Send Millions of Spoofed Messages
- SecurityWeekPhishing Campaign Exploited Proofpoint Email Protections for Spoofing
- Infosecurity MagazineMillions of Spoofed Emails Bypass Defenses in 'EchoSpoofing' Campaign
- Dark ReadingDisney, Nike, IBM Signatures Anchor 3M Fake Emails a Day
- SC MediaWidespread email spoofing facilitated by Proofpoint email routing flaw
- Risky BusinessRisky Biz News
- HalonEchoSpoofing explained: here's how you can protect your email software
- VirtruEchoSpoofing: Lessons Learned from Proofpoint Email Phishing Exploit
- MicrosoftSecure architecture design – How Defender for Office 365 protects against EchoSpoofing
- Broadcom / Symantec Enterprise SecurityAnti-EchoSpoofing Protection in Email Security.cloud
- PowerDMARCEchoSpoofing: Email Routing Exploit Explained
Read the research
- Subdomailing: The Campaign That Abused Thousands of Hijacked SubdomainsOn this blog →
- SubdoMailing: Thousands of Hijacked Major-Brand Subdomains Found Bombarding Users With Millions of Malicious EmailsGuardio Labs ↗
- EchoSpoofing: A Massive Phishing Campaign Exploiting Proofpoint’s Email Protection to Dispatch Millions of Perfectly Spoofed EmailsGuardio Labs ↗
360XSS