Email Account under attack (really) - anything I can do? The 2019 Stack Overflow Developer Survey Results Are InWhen secure email, is not really secureSpam Mail - have someone broke in to my shared hosting account?Could someone stop another from accessing their own online account?Can/do botnets brute force “high value” users of services like Gmail?Hijacked Aol Email Account - Lack of security?Sending password reset links in emailIs there more of a security risk by providing an email when creating a new account?How viable is MITM interception of email, really?Email really sent or not?A safer way to read emails on Android devices
What does ひと匙 mean in this manga and has it been used colloquially?
Shouldn't "much" here be used instead of "more"?
Can a rogue use sneak attack with weapons that have the thrown property even if they are not thrown?
Did Scotland spend $250,000 for the slogan "Welcome to Scotland"?
How come people say “Would of”?
Can we generate random numbers using irrational numbers like π and e?
Does a dangling wire really electrocute me if I'm standing in water?
How can I autofill dates in Excel excluding Sunday?
Falsification in Math vs Science
What are the motivations for publishing new editions of an existing textbook, beyond new discoveries in a field?
Why did Acorn's A3000 have red function keys?
Where to refill my bottle in India?
Can one be advised by a professor who is very far away?
Is "plugging out" electronic devices an American expression?
Protecting Dualbooting Windows from dangerous code (like rm -rf)
Am I thawing this London Broil safely?
Are children permitted to help build the Beis Hamikdash?
Loose spokes after only a few rides
If I score a critical hit on an 18 or higher, what are my chances of getting a critical hit if I roll 3d20?
Identify boardgame from Big movie
What does "fetching by region is not available for SAM files" means?
Is flight data recorder erased after every flight?
What could be the right powersource for 15 seconds lifespan disposable giant chainsaw?
What do the Banks children have against barley water?
Email Account under attack (really) - anything I can do?
The 2019 Stack Overflow Developer Survey Results Are InWhen secure email, is not really secureSpam Mail - have someone broke in to my shared hosting account?Could someone stop another from accessing their own online account?Can/do botnets brute force “high value” users of services like Gmail?Hijacked Aol Email Account - Lack of security?Sending password reset links in emailIs there more of a security risk by providing an email when creating a new account?How viable is MITM interception of email, really?Email really sent or not?A safer way to read emails on Android devices
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.
My password is as strong as a password can be so the chance of brute force winning is infinitesimal. However as a result of the authentication failures, my hosting provider keeps locking the email account.
Is there anything I can do (or that I can ask my hosting provider to do), or am I just screwed until the botnet moves on? Anyone with similar experience who can comment on whether I can expect this to ever end?
email botnet
New contributor
|
show 1 more comment
Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.
My password is as strong as a password can be so the chance of brute force winning is infinitesimal. However as a result of the authentication failures, my hosting provider keeps locking the email account.
Is there anything I can do (or that I can ask my hosting provider to do), or am I just screwed until the botnet moves on? Anyone with similar experience who can comment on whether I can expect this to ever end?
email botnet
New contributor
41
Ask your email provider to make a change, that's the only options. In the meantime, open a new account and forward all emails to your new account so that you are still functional?
– schroeder♦
Apr 6 at 15:04
8
Are you using one of the big email providers (Gmail, etc) or something smaller?
– Anders
Apr 6 at 17:20
30
Get a better provider that isn't so vulnerable to this kind of trivial DoS?
– Nate Eldredge
Apr 6 at 22:46
23
Maybe another account is under attack (Bank? Facebook? Income tax refund? Domain in your possession?), and they are taking out your email so you don't get notified.
– jww
Apr 6 at 23:57
49
I had a similar experience with my account: The culprit actually was my phone, that had an outdated password for the account and repeatedly tried to log into it unsuccessfully.
– pat3d3r
Apr 7 at 9:30
|
show 1 more comment
Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.
My password is as strong as a password can be so the chance of brute force winning is infinitesimal. However as a result of the authentication failures, my hosting provider keeps locking the email account.
Is there anything I can do (or that I can ask my hosting provider to do), or am I just screwed until the botnet moves on? Anyone with similar experience who can comment on whether I can expect this to ever end?
email botnet
New contributor
Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.
My password is as strong as a password can be so the chance of brute force winning is infinitesimal. However as a result of the authentication failures, my hosting provider keeps locking the email account.
Is there anything I can do (or that I can ask my hosting provider to do), or am I just screwed until the botnet moves on? Anyone with similar experience who can comment on whether I can expect this to ever end?
email botnet
email botnet
New contributor
New contributor
New contributor
asked Apr 6 at 14:51
clemdiaclemdia
491125
491125
New contributor
New contributor
41
Ask your email provider to make a change, that's the only options. In the meantime, open a new account and forward all emails to your new account so that you are still functional?
– schroeder♦
Apr 6 at 15:04
8
Are you using one of the big email providers (Gmail, etc) or something smaller?
– Anders
Apr 6 at 17:20
30
Get a better provider that isn't so vulnerable to this kind of trivial DoS?
– Nate Eldredge
Apr 6 at 22:46
23
Maybe another account is under attack (Bank? Facebook? Income tax refund? Domain in your possession?), and they are taking out your email so you don't get notified.
– jww
Apr 6 at 23:57
49
I had a similar experience with my account: The culprit actually was my phone, that had an outdated password for the account and repeatedly tried to log into it unsuccessfully.
– pat3d3r
Apr 7 at 9:30
|
show 1 more comment
41
Ask your email provider to make a change, that's the only options. In the meantime, open a new account and forward all emails to your new account so that you are still functional?
– schroeder♦
Apr 6 at 15:04
8
Are you using one of the big email providers (Gmail, etc) or something smaller?
– Anders
Apr 6 at 17:20
30
Get a better provider that isn't so vulnerable to this kind of trivial DoS?
– Nate Eldredge
Apr 6 at 22:46
23
Maybe another account is under attack (Bank? Facebook? Income tax refund? Domain in your possession?), and they are taking out your email so you don't get notified.
– jww
Apr 6 at 23:57
49
I had a similar experience with my account: The culprit actually was my phone, that had an outdated password for the account and repeatedly tried to log into it unsuccessfully.
– pat3d3r
Apr 7 at 9:30
41
41
Ask your email provider to make a change, that's the only options. In the meantime, open a new account and forward all emails to your new account so that you are still functional?
– schroeder♦
Apr 6 at 15:04
Ask your email provider to make a change, that's the only options. In the meantime, open a new account and forward all emails to your new account so that you are still functional?
– schroeder♦
Apr 6 at 15:04
8
8
Are you using one of the big email providers (Gmail, etc) or something smaller?
– Anders
Apr 6 at 17:20
Are you using one of the big email providers (Gmail, etc) or something smaller?
– Anders
Apr 6 at 17:20
30
30
Get a better provider that isn't so vulnerable to this kind of trivial DoS?
– Nate Eldredge
Apr 6 at 22:46
Get a better provider that isn't so vulnerable to this kind of trivial DoS?
– Nate Eldredge
Apr 6 at 22:46
23
23
Maybe another account is under attack (Bank? Facebook? Income tax refund? Domain in your possession?), and they are taking out your email so you don't get notified.
– jww
Apr 6 at 23:57
Maybe another account is under attack (Bank? Facebook? Income tax refund? Domain in your possession?), and they are taking out your email so you don't get notified.
– jww
Apr 6 at 23:57
49
49
I had a similar experience with my account: The culprit actually was my phone, that had an outdated password for the account and repeatedly tried to log into it unsuccessfully.
– pat3d3r
Apr 7 at 9:30
I had a similar experience with my account: The culprit actually was my phone, that had an outdated password for the account and repeatedly tried to log into it unsuccessfully.
– pat3d3r
Apr 7 at 9:30
|
show 1 more comment
5 Answers
5
active
oldest
votes
A few thoughts:
- Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.
- If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.
- If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)
- Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.
- Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.
20
Would 2FA really help? The second factor isn't usually attemped until after a correct password is entered, and the attacker will never get that far.
– Barmar
Apr 6 at 18:35
3
What makes you think he's not already using IMAP?
– Barmar
Apr 6 at 18:36
2
@Barmar If the attacker's script isn't written to try to enter anything on the second factor, it might prevent the lock out. Worth a try at least.
– jpmc26
Apr 6 at 20:27
7
I think most 2FA systems don't prompt for the second factor until after you successfully pass the first.
– Barmar
Apr 6 at 21:21
15
@Barmar Yes, that is true, but my advice still stands. There is a non zero chance it helps, the effort is near zero, the risk is zero, and you should probably do it anyway. So even if it probably doesn't help, you should still do it.
– Anders
Apr 7 at 7:09
|
show 3 more comments
No. That's pretty much the background noise of being on the internet.
From a random server I have with e-mail:
$ sudo grep -c "auth failed" /var/log/mail.log
1109
That's today. It's with fail2ban blocking more than five attempts from the same IP.
32
This is not the same thing. He is referring to one specific account, not the complete authentication log for a mailserver. This is attempts at one specific user.
– John Keates
Apr 6 at 21:27
True it is my account specifically - but I think vidario has it right in a general sense. My hosting company recently updated their implementation of csf, and I wonder if it’s too strict - I’ve been wondering if the attacks are nothing new - just a new policy of locking account after “x failed attempts in y minutes”...
– clemdia
Apr 7 at 3:53
6
I understood this answer to show that even for some random server online, failed authentication attempts are plentiful and should be expected (which is true), not trying to equate the example to OP's use-case.
– aaaaaa
2 days ago
2
@clemdia yeah, you might want to contact them then, and let them know that their "security" is turning a run-of-the-mill brute force drive-by into a DoS by locking the legitmate user (you) out of the account. They should be blocking authentication attempts by IP, not by account, that's terrible practice.
– Doktor J
yesterday
add a comment |
tl/dr: This is your hosting company's problem, not yours. You'll have
to contact them to get it fixed. Their security policies shouldn't
lock you out of your own account. They need to do security better.
You already have some answers that I agree heartily with and which cover the technical aspects of this, but I'm throwing in another answer to cover a "business" item. Here you hit on the crux of the issue:
However as a result of the authentication failures, my hosting
provider keeps locking the email account.
In otherwords, the problem isn't your problem. You have done everything you can to secure your account on someone else's mail server - you are using a strong password that can't be brute forced. The underlying issue here is that your hosting provider has implemented a bad security policy. As @vidarlo mentioned, this is just the background noise of the internet. Your hosting provider should know this. Unfortunately their chosen response has the side effect of locking you out of your account.
In essence the combination of your hosting company's choice of security policies and the standard password scanning that happens to every server on the internet has resulted in a denial of service (DoS) of your email. If your email went down because someone attempted an actual DoS of your hosting provider and filled their networks with useless bandwidth, the solution would be quite simple. You wouldn't be here asking what you can do to fix the problem - you'd be talking to your provider and asking them to fix it. After all, the whole point of using a third party email service provider is for them to provide you with a service. If you are not being provided with that service, either because their servers went down, or because their network is crippled by a DoS, or because their security policy is overly zealous and locks you out of your account, then the only real solution is for your hosting provider to fix it and provide you with the service that you are paying them to give you.
Many questions we get here are the result of people ignoring security all together.. However, there are plenty more examples of people trying to do security but just doing it wrong. This is one of the latter. Therefore, you definitely need talk to your hosting provider and get them to fix it. If they can't provide you with the service you are paying for, then you need to switch to a provider that will (although hopefully it won't be the kind of provider that simply doesn't do security at all).
7
Yes, +1 for this. I work for an email security company, and we have far more intelligent anti-bruteforce systems than the OP is experiencing. This sort of blunt-instrument protection is unnecessary - locking out the legitimate user because of a brute-force is just inviting denial-of-service. Consider changing your email provider if possible...
– Steve Shipway
Apr 7 at 20:42
3
Turns out they reimplemented CSF (and maybe some other things) just before this started happening. I suspect they've implemented a policy that deflects/denies all authentication requests (regardless of source IP) after "x attempts in n minutes" - I can watch myself connect to the server, get refused, submit the same credentials a few more times, get refused a few more times, and then suddenly the credentials work. I do this with them live on the phone. They agree it's odd, and then email me log files that show "authentication failures" from my IP address. Yeah, no kidding...
– clemdia
2 days ago
2
@clemdia hard to say with 100% certainty, but it definitely sounds like this is exclusively an issue on their end and (either way) can only be fixed on their end. To some extent they are also using you as a beta tester (intentionally or not). Just about all tech companies do that to some extent, so I give you props for your patience, but it also isn't something that you have to continue to do, especially if they continue to provide a broken service.
– Conor Mancone
2 days ago
2
@clemdia An example of a simple bug that could explain this: "Authentication failure" is a very broad error message. It could be that their system uses that for any broad class of authentication failures including, "Automatically blocked because of too many failed attempts". Therefore, botnets trigger the block on your account, then you try to login and get Authentication Failure - not because your credentials were wrong, but because you were auto banned. They see "Authentication failure" and therefore conclude you typed your password wrong, missing the larger issue.
– Conor Mancone
2 days ago
1
I'm not claiming for sure that that is what happened, but stuff like that is easy to have happen and easy to miss. As a programmer on the other end, it is easy to put bugs in the most obvious box and sometimes miss the root cause, causing issues to take longer to resolve than necessary... of course I've never done that myself...
– Conor Mancone
2 days ago
|
show 1 more comment
Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email address. That way mails go out like this.
From: account-I-always-had@oldserver.com
Subject: Re: so-and-so
In-Reply-To: <4735813474834434634@theirmail.com>
Sender: burneraccount@newserver.com
Or something like that.
Anyway, that lets you keep your identity at the official email address. The attacks on the login server are irrelevant to receiving and forwarding email.
As is evident from the above, your new email address may be obvious from headers so don't set up an autoresponder. Only correspond with people you trust. If this burner email account comes under attack, trash this burner account, setup another one, and tell the official email server to forward to the new burner.
Then, research who you sent mail to in the last 2 days to the last burner account. One of them compromised it. Use one tactic or another to trick them into attacking this or another burner account, that lets you distinguish who exactly did it.
2
Or if possible, change username to be different from the address. This way you reply from the same address and have the same mailbox, but prevent account lockout.
– Esa Jokinen
Apr 7 at 4:05
4
THIS (if only it were possible) - btw this experience has highlighted the lunacy of websites REQUIRING email address as username - just stupid.
– clemdia
Apr 7 at 4:36
1
you might try using + to add a per domain suffix. then when you get spam it will (most likely) include who leaked your email. plus it becomes easy to block all emails that came from the domain
– sudo rm -rf slash
Apr 7 at 7:31
@sudorm-rfslash - I think the the +suffix trick might be gmail specific.
– Justin
yesterday
@sudorm-rfslash yeah... I actually have my mail server configured to use_
as the "decorator" or "suffix" character. Since many (especially business) domains use a first_last@example.com format, even sites that reject emails with+
in them will still happily accept an email with_
in it!
– Doktor J
yesterday
|
show 1 more comment
This is dependent on your provider and what they are willing to do.
If you had a static IP you could ask them to whitelist your IP. Maybe even your CIDR, but if you do too many of those some of the bad traffic may start to come through.
After so many attempts your provider should temporarily ban the IP addresses attacking them. Now hackers have thousands even 10's of thousands of IP to choose from but eventually they might be able to block them all.
Obviously your provider needs better ddos protection.
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "162"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
clemdia is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206923%2femail-account-under-attack-really-anything-i-can-do%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
5 Answers
5
active
oldest
votes
5 Answers
5
active
oldest
votes
active
oldest
votes
active
oldest
votes
A few thoughts:
- Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.
- If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.
- If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)
- Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.
- Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.
20
Would 2FA really help? The second factor isn't usually attemped until after a correct password is entered, and the attacker will never get that far.
– Barmar
Apr 6 at 18:35
3
What makes you think he's not already using IMAP?
– Barmar
Apr 6 at 18:36
2
@Barmar If the attacker's script isn't written to try to enter anything on the second factor, it might prevent the lock out. Worth a try at least.
– jpmc26
Apr 6 at 20:27
7
I think most 2FA systems don't prompt for the second factor until after you successfully pass the first.
– Barmar
Apr 6 at 21:21
15
@Barmar Yes, that is true, but my advice still stands. There is a non zero chance it helps, the effort is near zero, the risk is zero, and you should probably do it anyway. So even if it probably doesn't help, you should still do it.
– Anders
Apr 7 at 7:09
|
show 3 more comments
A few thoughts:
- Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.
- If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.
- If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)
- Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.
- Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.
20
Would 2FA really help? The second factor isn't usually attemped until after a correct password is entered, and the attacker will never get that far.
– Barmar
Apr 6 at 18:35
3
What makes you think he's not already using IMAP?
– Barmar
Apr 6 at 18:36
2
@Barmar If the attacker's script isn't written to try to enter anything on the second factor, it might prevent the lock out. Worth a try at least.
– jpmc26
Apr 6 at 20:27
7
I think most 2FA systems don't prompt for the second factor until after you successfully pass the first.
– Barmar
Apr 6 at 21:21
15
@Barmar Yes, that is true, but my advice still stands. There is a non zero chance it helps, the effort is near zero, the risk is zero, and you should probably do it anyway. So even if it probably doesn't help, you should still do it.
– Anders
Apr 7 at 7:09
|
show 3 more comments
A few thoughts:
- Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.
- If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.
- If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)
- Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.
- Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.
A few thoughts:
- Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.
- If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.
- If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)
- Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.
- Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.
answered Apr 6 at 17:01
AndersAnders
50.4k22144167
50.4k22144167
20
Would 2FA really help? The second factor isn't usually attemped until after a correct password is entered, and the attacker will never get that far.
– Barmar
Apr 6 at 18:35
3
What makes you think he's not already using IMAP?
– Barmar
Apr 6 at 18:36
2
@Barmar If the attacker's script isn't written to try to enter anything on the second factor, it might prevent the lock out. Worth a try at least.
– jpmc26
Apr 6 at 20:27
7
I think most 2FA systems don't prompt for the second factor until after you successfully pass the first.
– Barmar
Apr 6 at 21:21
15
@Barmar Yes, that is true, but my advice still stands. There is a non zero chance it helps, the effort is near zero, the risk is zero, and you should probably do it anyway. So even if it probably doesn't help, you should still do it.
– Anders
Apr 7 at 7:09
|
show 3 more comments
20
Would 2FA really help? The second factor isn't usually attemped until after a correct password is entered, and the attacker will never get that far.
– Barmar
Apr 6 at 18:35
3
What makes you think he's not already using IMAP?
– Barmar
Apr 6 at 18:36
2
@Barmar If the attacker's script isn't written to try to enter anything on the second factor, it might prevent the lock out. Worth a try at least.
– jpmc26
Apr 6 at 20:27
7
I think most 2FA systems don't prompt for the second factor until after you successfully pass the first.
– Barmar
Apr 6 at 21:21
15
@Barmar Yes, that is true, but my advice still stands. There is a non zero chance it helps, the effort is near zero, the risk is zero, and you should probably do it anyway. So even if it probably doesn't help, you should still do it.
– Anders
Apr 7 at 7:09
20
20
Would 2FA really help? The second factor isn't usually attemped until after a correct password is entered, and the attacker will never get that far.
– Barmar
Apr 6 at 18:35
Would 2FA really help? The second factor isn't usually attemped until after a correct password is entered, and the attacker will never get that far.
– Barmar
Apr 6 at 18:35
3
3
What makes you think he's not already using IMAP?
– Barmar
Apr 6 at 18:36
What makes you think he's not already using IMAP?
– Barmar
Apr 6 at 18:36
2
2
@Barmar If the attacker's script isn't written to try to enter anything on the second factor, it might prevent the lock out. Worth a try at least.
– jpmc26
Apr 6 at 20:27
@Barmar If the attacker's script isn't written to try to enter anything on the second factor, it might prevent the lock out. Worth a try at least.
– jpmc26
Apr 6 at 20:27
7
7
I think most 2FA systems don't prompt for the second factor until after you successfully pass the first.
– Barmar
Apr 6 at 21:21
I think most 2FA systems don't prompt for the second factor until after you successfully pass the first.
– Barmar
Apr 6 at 21:21
15
15
@Barmar Yes, that is true, but my advice still stands. There is a non zero chance it helps, the effort is near zero, the risk is zero, and you should probably do it anyway. So even if it probably doesn't help, you should still do it.
– Anders
Apr 7 at 7:09
@Barmar Yes, that is true, but my advice still stands. There is a non zero chance it helps, the effort is near zero, the risk is zero, and you should probably do it anyway. So even if it probably doesn't help, you should still do it.
– Anders
Apr 7 at 7:09
|
show 3 more comments
No. That's pretty much the background noise of being on the internet.
From a random server I have with e-mail:
$ sudo grep -c "auth failed" /var/log/mail.log
1109
That's today. It's with fail2ban blocking more than five attempts from the same IP.
32
This is not the same thing. He is referring to one specific account, not the complete authentication log for a mailserver. This is attempts at one specific user.
– John Keates
Apr 6 at 21:27
True it is my account specifically - but I think vidario has it right in a general sense. My hosting company recently updated their implementation of csf, and I wonder if it’s too strict - I’ve been wondering if the attacks are nothing new - just a new policy of locking account after “x failed attempts in y minutes”...
– clemdia
Apr 7 at 3:53
6
I understood this answer to show that even for some random server online, failed authentication attempts are plentiful and should be expected (which is true), not trying to equate the example to OP's use-case.
– aaaaaa
2 days ago
2
@clemdia yeah, you might want to contact them then, and let them know that their "security" is turning a run-of-the-mill brute force drive-by into a DoS by locking the legitmate user (you) out of the account. They should be blocking authentication attempts by IP, not by account, that's terrible practice.
– Doktor J
yesterday
add a comment |
No. That's pretty much the background noise of being on the internet.
From a random server I have with e-mail:
$ sudo grep -c "auth failed" /var/log/mail.log
1109
That's today. It's with fail2ban blocking more than five attempts from the same IP.
32
This is not the same thing. He is referring to one specific account, not the complete authentication log for a mailserver. This is attempts at one specific user.
– John Keates
Apr 6 at 21:27
True it is my account specifically - but I think vidario has it right in a general sense. My hosting company recently updated their implementation of csf, and I wonder if it’s too strict - I’ve been wondering if the attacks are nothing new - just a new policy of locking account after “x failed attempts in y minutes”...
– clemdia
Apr 7 at 3:53
6
I understood this answer to show that even for some random server online, failed authentication attempts are plentiful and should be expected (which is true), not trying to equate the example to OP's use-case.
– aaaaaa
2 days ago
2
@clemdia yeah, you might want to contact them then, and let them know that their "security" is turning a run-of-the-mill brute force drive-by into a DoS by locking the legitmate user (you) out of the account. They should be blocking authentication attempts by IP, not by account, that's terrible practice.
– Doktor J
yesterday
add a comment |
No. That's pretty much the background noise of being on the internet.
From a random server I have with e-mail:
$ sudo grep -c "auth failed" /var/log/mail.log
1109
That's today. It's with fail2ban blocking more than five attempts from the same IP.
No. That's pretty much the background noise of being on the internet.
From a random server I have with e-mail:
$ sudo grep -c "auth failed" /var/log/mail.log
1109
That's today. It's with fail2ban blocking more than five attempts from the same IP.
answered Apr 6 at 16:47
vidarlovidarlo
3,869823
3,869823
32
This is not the same thing. He is referring to one specific account, not the complete authentication log for a mailserver. This is attempts at one specific user.
– John Keates
Apr 6 at 21:27
True it is my account specifically - but I think vidario has it right in a general sense. My hosting company recently updated their implementation of csf, and I wonder if it’s too strict - I’ve been wondering if the attacks are nothing new - just a new policy of locking account after “x failed attempts in y minutes”...
– clemdia
Apr 7 at 3:53
6
I understood this answer to show that even for some random server online, failed authentication attempts are plentiful and should be expected (which is true), not trying to equate the example to OP's use-case.
– aaaaaa
2 days ago
2
@clemdia yeah, you might want to contact them then, and let them know that their "security" is turning a run-of-the-mill brute force drive-by into a DoS by locking the legitmate user (you) out of the account. They should be blocking authentication attempts by IP, not by account, that's terrible practice.
– Doktor J
yesterday
add a comment |
32
This is not the same thing. He is referring to one specific account, not the complete authentication log for a mailserver. This is attempts at one specific user.
– John Keates
Apr 6 at 21:27
True it is my account specifically - but I think vidario has it right in a general sense. My hosting company recently updated their implementation of csf, and I wonder if it’s too strict - I’ve been wondering if the attacks are nothing new - just a new policy of locking account after “x failed attempts in y minutes”...
– clemdia
Apr 7 at 3:53
6
I understood this answer to show that even for some random server online, failed authentication attempts are plentiful and should be expected (which is true), not trying to equate the example to OP's use-case.
– aaaaaa
2 days ago
2
@clemdia yeah, you might want to contact them then, and let them know that their "security" is turning a run-of-the-mill brute force drive-by into a DoS by locking the legitmate user (you) out of the account. They should be blocking authentication attempts by IP, not by account, that's terrible practice.
– Doktor J
yesterday
32
32
This is not the same thing. He is referring to one specific account, not the complete authentication log for a mailserver. This is attempts at one specific user.
– John Keates
Apr 6 at 21:27
This is not the same thing. He is referring to one specific account, not the complete authentication log for a mailserver. This is attempts at one specific user.
– John Keates
Apr 6 at 21:27
True it is my account specifically - but I think vidario has it right in a general sense. My hosting company recently updated their implementation of csf, and I wonder if it’s too strict - I’ve been wondering if the attacks are nothing new - just a new policy of locking account after “x failed attempts in y minutes”...
– clemdia
Apr 7 at 3:53
True it is my account specifically - but I think vidario has it right in a general sense. My hosting company recently updated their implementation of csf, and I wonder if it’s too strict - I’ve been wondering if the attacks are nothing new - just a new policy of locking account after “x failed attempts in y minutes”...
– clemdia
Apr 7 at 3:53
6
6
I understood this answer to show that even for some random server online, failed authentication attempts are plentiful and should be expected (which is true), not trying to equate the example to OP's use-case.
– aaaaaa
2 days ago
I understood this answer to show that even for some random server online, failed authentication attempts are plentiful and should be expected (which is true), not trying to equate the example to OP's use-case.
– aaaaaa
2 days ago
2
2
@clemdia yeah, you might want to contact them then, and let them know that their "security" is turning a run-of-the-mill brute force drive-by into a DoS by locking the legitmate user (you) out of the account. They should be blocking authentication attempts by IP, not by account, that's terrible practice.
– Doktor J
yesterday
@clemdia yeah, you might want to contact them then, and let them know that their "security" is turning a run-of-the-mill brute force drive-by into a DoS by locking the legitmate user (you) out of the account. They should be blocking authentication attempts by IP, not by account, that's terrible practice.
– Doktor J
yesterday
add a comment |
tl/dr: This is your hosting company's problem, not yours. You'll have
to contact them to get it fixed. Their security policies shouldn't
lock you out of your own account. They need to do security better.
You already have some answers that I agree heartily with and which cover the technical aspects of this, but I'm throwing in another answer to cover a "business" item. Here you hit on the crux of the issue:
However as a result of the authentication failures, my hosting
provider keeps locking the email account.
In otherwords, the problem isn't your problem. You have done everything you can to secure your account on someone else's mail server - you are using a strong password that can't be brute forced. The underlying issue here is that your hosting provider has implemented a bad security policy. As @vidarlo mentioned, this is just the background noise of the internet. Your hosting provider should know this. Unfortunately their chosen response has the side effect of locking you out of your account.
In essence the combination of your hosting company's choice of security policies and the standard password scanning that happens to every server on the internet has resulted in a denial of service (DoS) of your email. If your email went down because someone attempted an actual DoS of your hosting provider and filled their networks with useless bandwidth, the solution would be quite simple. You wouldn't be here asking what you can do to fix the problem - you'd be talking to your provider and asking them to fix it. After all, the whole point of using a third party email service provider is for them to provide you with a service. If you are not being provided with that service, either because their servers went down, or because their network is crippled by a DoS, or because their security policy is overly zealous and locks you out of your account, then the only real solution is for your hosting provider to fix it and provide you with the service that you are paying them to give you.
Many questions we get here are the result of people ignoring security all together.. However, there are plenty more examples of people trying to do security but just doing it wrong. This is one of the latter. Therefore, you definitely need talk to your hosting provider and get them to fix it. If they can't provide you with the service you are paying for, then you need to switch to a provider that will (although hopefully it won't be the kind of provider that simply doesn't do security at all).
7
Yes, +1 for this. I work for an email security company, and we have far more intelligent anti-bruteforce systems than the OP is experiencing. This sort of blunt-instrument protection is unnecessary - locking out the legitimate user because of a brute-force is just inviting denial-of-service. Consider changing your email provider if possible...
– Steve Shipway
Apr 7 at 20:42
3
Turns out they reimplemented CSF (and maybe some other things) just before this started happening. I suspect they've implemented a policy that deflects/denies all authentication requests (regardless of source IP) after "x attempts in n minutes" - I can watch myself connect to the server, get refused, submit the same credentials a few more times, get refused a few more times, and then suddenly the credentials work. I do this with them live on the phone. They agree it's odd, and then email me log files that show "authentication failures" from my IP address. Yeah, no kidding...
– clemdia
2 days ago
2
@clemdia hard to say with 100% certainty, but it definitely sounds like this is exclusively an issue on their end and (either way) can only be fixed on their end. To some extent they are also using you as a beta tester (intentionally or not). Just about all tech companies do that to some extent, so I give you props for your patience, but it also isn't something that you have to continue to do, especially if they continue to provide a broken service.
– Conor Mancone
2 days ago
2
@clemdia An example of a simple bug that could explain this: "Authentication failure" is a very broad error message. It could be that their system uses that for any broad class of authentication failures including, "Automatically blocked because of too many failed attempts". Therefore, botnets trigger the block on your account, then you try to login and get Authentication Failure - not because your credentials were wrong, but because you were auto banned. They see "Authentication failure" and therefore conclude you typed your password wrong, missing the larger issue.
– Conor Mancone
2 days ago
1
I'm not claiming for sure that that is what happened, but stuff like that is easy to have happen and easy to miss. As a programmer on the other end, it is easy to put bugs in the most obvious box and sometimes miss the root cause, causing issues to take longer to resolve than necessary... of course I've never done that myself...
– Conor Mancone
2 days ago
|
show 1 more comment
tl/dr: This is your hosting company's problem, not yours. You'll have
to contact them to get it fixed. Their security policies shouldn't
lock you out of your own account. They need to do security better.
You already have some answers that I agree heartily with and which cover the technical aspects of this, but I'm throwing in another answer to cover a "business" item. Here you hit on the crux of the issue:
However as a result of the authentication failures, my hosting
provider keeps locking the email account.
In otherwords, the problem isn't your problem. You have done everything you can to secure your account on someone else's mail server - you are using a strong password that can't be brute forced. The underlying issue here is that your hosting provider has implemented a bad security policy. As @vidarlo mentioned, this is just the background noise of the internet. Your hosting provider should know this. Unfortunately their chosen response has the side effect of locking you out of your account.
In essence the combination of your hosting company's choice of security policies and the standard password scanning that happens to every server on the internet has resulted in a denial of service (DoS) of your email. If your email went down because someone attempted an actual DoS of your hosting provider and filled their networks with useless bandwidth, the solution would be quite simple. You wouldn't be here asking what you can do to fix the problem - you'd be talking to your provider and asking them to fix it. After all, the whole point of using a third party email service provider is for them to provide you with a service. If you are not being provided with that service, either because their servers went down, or because their network is crippled by a DoS, or because their security policy is overly zealous and locks you out of your account, then the only real solution is for your hosting provider to fix it and provide you with the service that you are paying them to give you.
Many questions we get here are the result of people ignoring security all together.. However, there are plenty more examples of people trying to do security but just doing it wrong. This is one of the latter. Therefore, you definitely need talk to your hosting provider and get them to fix it. If they can't provide you with the service you are paying for, then you need to switch to a provider that will (although hopefully it won't be the kind of provider that simply doesn't do security at all).
7
Yes, +1 for this. I work for an email security company, and we have far more intelligent anti-bruteforce systems than the OP is experiencing. This sort of blunt-instrument protection is unnecessary - locking out the legitimate user because of a brute-force is just inviting denial-of-service. Consider changing your email provider if possible...
– Steve Shipway
Apr 7 at 20:42
3
Turns out they reimplemented CSF (and maybe some other things) just before this started happening. I suspect they've implemented a policy that deflects/denies all authentication requests (regardless of source IP) after "x attempts in n minutes" - I can watch myself connect to the server, get refused, submit the same credentials a few more times, get refused a few more times, and then suddenly the credentials work. I do this with them live on the phone. They agree it's odd, and then email me log files that show "authentication failures" from my IP address. Yeah, no kidding...
– clemdia
2 days ago
2
@clemdia hard to say with 100% certainty, but it definitely sounds like this is exclusively an issue on their end and (either way) can only be fixed on their end. To some extent they are also using you as a beta tester (intentionally or not). Just about all tech companies do that to some extent, so I give you props for your patience, but it also isn't something that you have to continue to do, especially if they continue to provide a broken service.
– Conor Mancone
2 days ago
2
@clemdia An example of a simple bug that could explain this: "Authentication failure" is a very broad error message. It could be that their system uses that for any broad class of authentication failures including, "Automatically blocked because of too many failed attempts". Therefore, botnets trigger the block on your account, then you try to login and get Authentication Failure - not because your credentials were wrong, but because you were auto banned. They see "Authentication failure" and therefore conclude you typed your password wrong, missing the larger issue.
– Conor Mancone
2 days ago
1
I'm not claiming for sure that that is what happened, but stuff like that is easy to have happen and easy to miss. As a programmer on the other end, it is easy to put bugs in the most obvious box and sometimes miss the root cause, causing issues to take longer to resolve than necessary... of course I've never done that myself...
– Conor Mancone
2 days ago
|
show 1 more comment
tl/dr: This is your hosting company's problem, not yours. You'll have
to contact them to get it fixed. Their security policies shouldn't
lock you out of your own account. They need to do security better.
You already have some answers that I agree heartily with and which cover the technical aspects of this, but I'm throwing in another answer to cover a "business" item. Here you hit on the crux of the issue:
However as a result of the authentication failures, my hosting
provider keeps locking the email account.
In otherwords, the problem isn't your problem. You have done everything you can to secure your account on someone else's mail server - you are using a strong password that can't be brute forced. The underlying issue here is that your hosting provider has implemented a bad security policy. As @vidarlo mentioned, this is just the background noise of the internet. Your hosting provider should know this. Unfortunately their chosen response has the side effect of locking you out of your account.
In essence the combination of your hosting company's choice of security policies and the standard password scanning that happens to every server on the internet has resulted in a denial of service (DoS) of your email. If your email went down because someone attempted an actual DoS of your hosting provider and filled their networks with useless bandwidth, the solution would be quite simple. You wouldn't be here asking what you can do to fix the problem - you'd be talking to your provider and asking them to fix it. After all, the whole point of using a third party email service provider is for them to provide you with a service. If you are not being provided with that service, either because their servers went down, or because their network is crippled by a DoS, or because their security policy is overly zealous and locks you out of your account, then the only real solution is for your hosting provider to fix it and provide you with the service that you are paying them to give you.
Many questions we get here are the result of people ignoring security all together.. However, there are plenty more examples of people trying to do security but just doing it wrong. This is one of the latter. Therefore, you definitely need talk to your hosting provider and get them to fix it. If they can't provide you with the service you are paying for, then you need to switch to a provider that will (although hopefully it won't be the kind of provider that simply doesn't do security at all).
tl/dr: This is your hosting company's problem, not yours. You'll have
to contact them to get it fixed. Their security policies shouldn't
lock you out of your own account. They need to do security better.
You already have some answers that I agree heartily with and which cover the technical aspects of this, but I'm throwing in another answer to cover a "business" item. Here you hit on the crux of the issue:
However as a result of the authentication failures, my hosting
provider keeps locking the email account.
In otherwords, the problem isn't your problem. You have done everything you can to secure your account on someone else's mail server - you are using a strong password that can't be brute forced. The underlying issue here is that your hosting provider has implemented a bad security policy. As @vidarlo mentioned, this is just the background noise of the internet. Your hosting provider should know this. Unfortunately their chosen response has the side effect of locking you out of your account.
In essence the combination of your hosting company's choice of security policies and the standard password scanning that happens to every server on the internet has resulted in a denial of service (DoS) of your email. If your email went down because someone attempted an actual DoS of your hosting provider and filled their networks with useless bandwidth, the solution would be quite simple. You wouldn't be here asking what you can do to fix the problem - you'd be talking to your provider and asking them to fix it. After all, the whole point of using a third party email service provider is for them to provide you with a service. If you are not being provided with that service, either because their servers went down, or because their network is crippled by a DoS, or because their security policy is overly zealous and locks you out of your account, then the only real solution is for your hosting provider to fix it and provide you with the service that you are paying them to give you.
Many questions we get here are the result of people ignoring security all together.. However, there are plenty more examples of people trying to do security but just doing it wrong. This is one of the latter. Therefore, you definitely need talk to your hosting provider and get them to fix it. If they can't provide you with the service you are paying for, then you need to switch to a provider that will (although hopefully it won't be the kind of provider that simply doesn't do security at all).
edited 2 days ago
answered Apr 7 at 17:46
Conor ManconeConor Mancone
10.6k32152
10.6k32152
7
Yes, +1 for this. I work for an email security company, and we have far more intelligent anti-bruteforce systems than the OP is experiencing. This sort of blunt-instrument protection is unnecessary - locking out the legitimate user because of a brute-force is just inviting denial-of-service. Consider changing your email provider if possible...
– Steve Shipway
Apr 7 at 20:42
3
Turns out they reimplemented CSF (and maybe some other things) just before this started happening. I suspect they've implemented a policy that deflects/denies all authentication requests (regardless of source IP) after "x attempts in n minutes" - I can watch myself connect to the server, get refused, submit the same credentials a few more times, get refused a few more times, and then suddenly the credentials work. I do this with them live on the phone. They agree it's odd, and then email me log files that show "authentication failures" from my IP address. Yeah, no kidding...
– clemdia
2 days ago
2
@clemdia hard to say with 100% certainty, but it definitely sounds like this is exclusively an issue on their end and (either way) can only be fixed on their end. To some extent they are also using you as a beta tester (intentionally or not). Just about all tech companies do that to some extent, so I give you props for your patience, but it also isn't something that you have to continue to do, especially if they continue to provide a broken service.
– Conor Mancone
2 days ago
2
@clemdia An example of a simple bug that could explain this: "Authentication failure" is a very broad error message. It could be that their system uses that for any broad class of authentication failures including, "Automatically blocked because of too many failed attempts". Therefore, botnets trigger the block on your account, then you try to login and get Authentication Failure - not because your credentials were wrong, but because you were auto banned. They see "Authentication failure" and therefore conclude you typed your password wrong, missing the larger issue.
– Conor Mancone
2 days ago
1
I'm not claiming for sure that that is what happened, but stuff like that is easy to have happen and easy to miss. As a programmer on the other end, it is easy to put bugs in the most obvious box and sometimes miss the root cause, causing issues to take longer to resolve than necessary... of course I've never done that myself...
– Conor Mancone
2 days ago
|
show 1 more comment
7
Yes, +1 for this. I work for an email security company, and we have far more intelligent anti-bruteforce systems than the OP is experiencing. This sort of blunt-instrument protection is unnecessary - locking out the legitimate user because of a brute-force is just inviting denial-of-service. Consider changing your email provider if possible...
– Steve Shipway
Apr 7 at 20:42
3
Turns out they reimplemented CSF (and maybe some other things) just before this started happening. I suspect they've implemented a policy that deflects/denies all authentication requests (regardless of source IP) after "x attempts in n minutes" - I can watch myself connect to the server, get refused, submit the same credentials a few more times, get refused a few more times, and then suddenly the credentials work. I do this with them live on the phone. They agree it's odd, and then email me log files that show "authentication failures" from my IP address. Yeah, no kidding...
– clemdia
2 days ago
2
@clemdia hard to say with 100% certainty, but it definitely sounds like this is exclusively an issue on their end and (either way) can only be fixed on their end. To some extent they are also using you as a beta tester (intentionally or not). Just about all tech companies do that to some extent, so I give you props for your patience, but it also isn't something that you have to continue to do, especially if they continue to provide a broken service.
– Conor Mancone
2 days ago
2
@clemdia An example of a simple bug that could explain this: "Authentication failure" is a very broad error message. It could be that their system uses that for any broad class of authentication failures including, "Automatically blocked because of too many failed attempts". Therefore, botnets trigger the block on your account, then you try to login and get Authentication Failure - not because your credentials were wrong, but because you were auto banned. They see "Authentication failure" and therefore conclude you typed your password wrong, missing the larger issue.
– Conor Mancone
2 days ago
1
I'm not claiming for sure that that is what happened, but stuff like that is easy to have happen and easy to miss. As a programmer on the other end, it is easy to put bugs in the most obvious box and sometimes miss the root cause, causing issues to take longer to resolve than necessary... of course I've never done that myself...
– Conor Mancone
2 days ago
7
7
Yes, +1 for this. I work for an email security company, and we have far more intelligent anti-bruteforce systems than the OP is experiencing. This sort of blunt-instrument protection is unnecessary - locking out the legitimate user because of a brute-force is just inviting denial-of-service. Consider changing your email provider if possible...
– Steve Shipway
Apr 7 at 20:42
Yes, +1 for this. I work for an email security company, and we have far more intelligent anti-bruteforce systems than the OP is experiencing. This sort of blunt-instrument protection is unnecessary - locking out the legitimate user because of a brute-force is just inviting denial-of-service. Consider changing your email provider if possible...
– Steve Shipway
Apr 7 at 20:42
3
3
Turns out they reimplemented CSF (and maybe some other things) just before this started happening. I suspect they've implemented a policy that deflects/denies all authentication requests (regardless of source IP) after "x attempts in n minutes" - I can watch myself connect to the server, get refused, submit the same credentials a few more times, get refused a few more times, and then suddenly the credentials work. I do this with them live on the phone. They agree it's odd, and then email me log files that show "authentication failures" from my IP address. Yeah, no kidding...
– clemdia
2 days ago
Turns out they reimplemented CSF (and maybe some other things) just before this started happening. I suspect they've implemented a policy that deflects/denies all authentication requests (regardless of source IP) after "x attempts in n minutes" - I can watch myself connect to the server, get refused, submit the same credentials a few more times, get refused a few more times, and then suddenly the credentials work. I do this with them live on the phone. They agree it's odd, and then email me log files that show "authentication failures" from my IP address. Yeah, no kidding...
– clemdia
2 days ago
2
2
@clemdia hard to say with 100% certainty, but it definitely sounds like this is exclusively an issue on their end and (either way) can only be fixed on their end. To some extent they are also using you as a beta tester (intentionally or not). Just about all tech companies do that to some extent, so I give you props for your patience, but it also isn't something that you have to continue to do, especially if they continue to provide a broken service.
– Conor Mancone
2 days ago
@clemdia hard to say with 100% certainty, but it definitely sounds like this is exclusively an issue on their end and (either way) can only be fixed on their end. To some extent they are also using you as a beta tester (intentionally or not). Just about all tech companies do that to some extent, so I give you props for your patience, but it also isn't something that you have to continue to do, especially if they continue to provide a broken service.
– Conor Mancone
2 days ago
2
2
@clemdia An example of a simple bug that could explain this: "Authentication failure" is a very broad error message. It could be that their system uses that for any broad class of authentication failures including, "Automatically blocked because of too many failed attempts". Therefore, botnets trigger the block on your account, then you try to login and get Authentication Failure - not because your credentials were wrong, but because you were auto banned. They see "Authentication failure" and therefore conclude you typed your password wrong, missing the larger issue.
– Conor Mancone
2 days ago
@clemdia An example of a simple bug that could explain this: "Authentication failure" is a very broad error message. It could be that their system uses that for any broad class of authentication failures including, "Automatically blocked because of too many failed attempts". Therefore, botnets trigger the block on your account, then you try to login and get Authentication Failure - not because your credentials were wrong, but because you were auto banned. They see "Authentication failure" and therefore conclude you typed your password wrong, missing the larger issue.
– Conor Mancone
2 days ago
1
1
I'm not claiming for sure that that is what happened, but stuff like that is easy to have happen and easy to miss. As a programmer on the other end, it is easy to put bugs in the most obvious box and sometimes miss the root cause, causing issues to take longer to resolve than necessary... of course I've never done that myself...
– Conor Mancone
2 days ago
I'm not claiming for sure that that is what happened, but stuff like that is easy to have happen and easy to miss. As a programmer on the other end, it is easy to put bugs in the most obvious box and sometimes miss the root cause, causing issues to take longer to resolve than necessary... of course I've never done that myself...
– Conor Mancone
2 days ago
|
show 1 more comment
Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email address. That way mails go out like this.
From: account-I-always-had@oldserver.com
Subject: Re: so-and-so
In-Reply-To: <4735813474834434634@theirmail.com>
Sender: burneraccount@newserver.com
Or something like that.
Anyway, that lets you keep your identity at the official email address. The attacks on the login server are irrelevant to receiving and forwarding email.
As is evident from the above, your new email address may be obvious from headers so don't set up an autoresponder. Only correspond with people you trust. If this burner email account comes under attack, trash this burner account, setup another one, and tell the official email server to forward to the new burner.
Then, research who you sent mail to in the last 2 days to the last burner account. One of them compromised it. Use one tactic or another to trick them into attacking this or another burner account, that lets you distinguish who exactly did it.
2
Or if possible, change username to be different from the address. This way you reply from the same address and have the same mailbox, but prevent account lockout.
– Esa Jokinen
Apr 7 at 4:05
4
THIS (if only it were possible) - btw this experience has highlighted the lunacy of websites REQUIRING email address as username - just stupid.
– clemdia
Apr 7 at 4:36
1
you might try using + to add a per domain suffix. then when you get spam it will (most likely) include who leaked your email. plus it becomes easy to block all emails that came from the domain
– sudo rm -rf slash
Apr 7 at 7:31
@sudorm-rfslash - I think the the +suffix trick might be gmail specific.
– Justin
yesterday
@sudorm-rfslash yeah... I actually have my mail server configured to use_
as the "decorator" or "suffix" character. Since many (especially business) domains use a first_last@example.com format, even sites that reject emails with+
in them will still happily accept an email with_
in it!
– Doktor J
yesterday
|
show 1 more comment
Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email address. That way mails go out like this.
From: account-I-always-had@oldserver.com
Subject: Re: so-and-so
In-Reply-To: <4735813474834434634@theirmail.com>
Sender: burneraccount@newserver.com
Or something like that.
Anyway, that lets you keep your identity at the official email address. The attacks on the login server are irrelevant to receiving and forwarding email.
As is evident from the above, your new email address may be obvious from headers so don't set up an autoresponder. Only correspond with people you trust. If this burner email account comes under attack, trash this burner account, setup another one, and tell the official email server to forward to the new burner.
Then, research who you sent mail to in the last 2 days to the last burner account. One of them compromised it. Use one tactic or another to trick them into attacking this or another burner account, that lets you distinguish who exactly did it.
2
Or if possible, change username to be different from the address. This way you reply from the same address and have the same mailbox, but prevent account lockout.
– Esa Jokinen
Apr 7 at 4:05
4
THIS (if only it were possible) - btw this experience has highlighted the lunacy of websites REQUIRING email address as username - just stupid.
– clemdia
Apr 7 at 4:36
1
you might try using + to add a per domain suffix. then when you get spam it will (most likely) include who leaked your email. plus it becomes easy to block all emails that came from the domain
– sudo rm -rf slash
Apr 7 at 7:31
@sudorm-rfslash - I think the the +suffix trick might be gmail specific.
– Justin
yesterday
@sudorm-rfslash yeah... I actually have my mail server configured to use_
as the "decorator" or "suffix" character. Since many (especially business) domains use a first_last@example.com format, even sites that reject emails with+
in them will still happily accept an email with_
in it!
– Doktor J
yesterday
|
show 1 more comment
Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email address. That way mails go out like this.
From: account-I-always-had@oldserver.com
Subject: Re: so-and-so
In-Reply-To: <4735813474834434634@theirmail.com>
Sender: burneraccount@newserver.com
Or something like that.
Anyway, that lets you keep your identity at the official email address. The attacks on the login server are irrelevant to receiving and forwarding email.
As is evident from the above, your new email address may be obvious from headers so don't set up an autoresponder. Only correspond with people you trust. If this burner email account comes under attack, trash this burner account, setup another one, and tell the official email server to forward to the new burner.
Then, research who you sent mail to in the last 2 days to the last burner account. One of them compromised it. Use one tactic or another to trick them into attacking this or another burner account, that lets you distinguish who exactly did it.
Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email address. That way mails go out like this.
From: account-I-always-had@oldserver.com
Subject: Re: so-and-so
In-Reply-To: <4735813474834434634@theirmail.com>
Sender: burneraccount@newserver.com
Or something like that.
Anyway, that lets you keep your identity at the official email address. The attacks on the login server are irrelevant to receiving and forwarding email.
As is evident from the above, your new email address may be obvious from headers so don't set up an autoresponder. Only correspond with people you trust. If this burner email account comes under attack, trash this burner account, setup another one, and tell the official email server to forward to the new burner.
Then, research who you sent mail to in the last 2 days to the last burner account. One of them compromised it. Use one tactic or another to trick them into attacking this or another burner account, that lets you distinguish who exactly did it.
answered Apr 6 at 19:02
HarperHarper
2,200414
2,200414
2
Or if possible, change username to be different from the address. This way you reply from the same address and have the same mailbox, but prevent account lockout.
– Esa Jokinen
Apr 7 at 4:05
4
THIS (if only it were possible) - btw this experience has highlighted the lunacy of websites REQUIRING email address as username - just stupid.
– clemdia
Apr 7 at 4:36
1
you might try using + to add a per domain suffix. then when you get spam it will (most likely) include who leaked your email. plus it becomes easy to block all emails that came from the domain
– sudo rm -rf slash
Apr 7 at 7:31
@sudorm-rfslash - I think the the +suffix trick might be gmail specific.
– Justin
yesterday
@sudorm-rfslash yeah... I actually have my mail server configured to use_
as the "decorator" or "suffix" character. Since many (especially business) domains use a first_last@example.com format, even sites that reject emails with+
in them will still happily accept an email with_
in it!
– Doktor J
yesterday
|
show 1 more comment
2
Or if possible, change username to be different from the address. This way you reply from the same address and have the same mailbox, but prevent account lockout.
– Esa Jokinen
Apr 7 at 4:05
4
THIS (if only it were possible) - btw this experience has highlighted the lunacy of websites REQUIRING email address as username - just stupid.
– clemdia
Apr 7 at 4:36
1
you might try using + to add a per domain suffix. then when you get spam it will (most likely) include who leaked your email. plus it becomes easy to block all emails that came from the domain
– sudo rm -rf slash
Apr 7 at 7:31
@sudorm-rfslash - I think the the +suffix trick might be gmail specific.
– Justin
yesterday
@sudorm-rfslash yeah... I actually have my mail server configured to use_
as the "decorator" or "suffix" character. Since many (especially business) domains use a first_last@example.com format, even sites that reject emails with+
in them will still happily accept an email with_
in it!
– Doktor J
yesterday
2
2
Or if possible, change username to be different from the address. This way you reply from the same address and have the same mailbox, but prevent account lockout.
– Esa Jokinen
Apr 7 at 4:05
Or if possible, change username to be different from the address. This way you reply from the same address and have the same mailbox, but prevent account lockout.
– Esa Jokinen
Apr 7 at 4:05
4
4
THIS (if only it were possible) - btw this experience has highlighted the lunacy of websites REQUIRING email address as username - just stupid.
– clemdia
Apr 7 at 4:36
THIS (if only it were possible) - btw this experience has highlighted the lunacy of websites REQUIRING email address as username - just stupid.
– clemdia
Apr 7 at 4:36
1
1
you might try using + to add a per domain suffix. then when you get spam it will (most likely) include who leaked your email. plus it becomes easy to block all emails that came from the domain
– sudo rm -rf slash
Apr 7 at 7:31
you might try using + to add a per domain suffix. then when you get spam it will (most likely) include who leaked your email. plus it becomes easy to block all emails that came from the domain
– sudo rm -rf slash
Apr 7 at 7:31
@sudorm-rfslash - I think the the +suffix trick might be gmail specific.
– Justin
yesterday
@sudorm-rfslash - I think the the +suffix trick might be gmail specific.
– Justin
yesterday
@sudorm-rfslash yeah... I actually have my mail server configured to use
_
as the "decorator" or "suffix" character. Since many (especially business) domains use a first_last@example.com format, even sites that reject emails with +
in them will still happily accept an email with _
in it!– Doktor J
yesterday
@sudorm-rfslash yeah... I actually have my mail server configured to use
_
as the "decorator" or "suffix" character. Since many (especially business) domains use a first_last@example.com format, even sites that reject emails with +
in them will still happily accept an email with _
in it!– Doktor J
yesterday
|
show 1 more comment
This is dependent on your provider and what they are willing to do.
If you had a static IP you could ask them to whitelist your IP. Maybe even your CIDR, but if you do too many of those some of the bad traffic may start to come through.
After so many attempts your provider should temporarily ban the IP addresses attacking them. Now hackers have thousands even 10's of thousands of IP to choose from but eventually they might be able to block them all.
Obviously your provider needs better ddos protection.
add a comment |
This is dependent on your provider and what they are willing to do.
If you had a static IP you could ask them to whitelist your IP. Maybe even your CIDR, but if you do too many of those some of the bad traffic may start to come through.
After so many attempts your provider should temporarily ban the IP addresses attacking them. Now hackers have thousands even 10's of thousands of IP to choose from but eventually they might be able to block them all.
Obviously your provider needs better ddos protection.
add a comment |
This is dependent on your provider and what they are willing to do.
If you had a static IP you could ask them to whitelist your IP. Maybe even your CIDR, but if you do too many of those some of the bad traffic may start to come through.
After so many attempts your provider should temporarily ban the IP addresses attacking them. Now hackers have thousands even 10's of thousands of IP to choose from but eventually they might be able to block them all.
Obviously your provider needs better ddos protection.
This is dependent on your provider and what they are willing to do.
If you had a static IP you could ask them to whitelist your IP. Maybe even your CIDR, but if you do too many of those some of the bad traffic may start to come through.
After so many attempts your provider should temporarily ban the IP addresses attacking them. Now hackers have thousands even 10's of thousands of IP to choose from but eventually they might be able to block them all.
Obviously your provider needs better ddos protection.
answered yesterday
cybernardcybernard
49528
49528
add a comment |
add a comment |
clemdia is a new contributor. Be nice, and check out our Code of Conduct.
clemdia is a new contributor. Be nice, and check out our Code of Conduct.
clemdia is a new contributor. Be nice, and check out our Code of Conduct.
clemdia is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206923%2femail-account-under-attack-really-anything-i-can-do%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
41
Ask your email provider to make a change, that's the only options. In the meantime, open a new account and forward all emails to your new account so that you are still functional?
– schroeder♦
Apr 6 at 15:04
8
Are you using one of the big email providers (Gmail, etc) or something smaller?
– Anders
Apr 6 at 17:20
30
Get a better provider that isn't so vulnerable to this kind of trivial DoS?
– Nate Eldredge
Apr 6 at 22:46
23
Maybe another account is under attack (Bank? Facebook? Income tax refund? Domain in your possession?), and they are taking out your email so you don't get notified.
– jww
Apr 6 at 23:57
49
I had a similar experience with my account: The culprit actually was my phone, that had an outdated password for the account and repeatedly tried to log into it unsuccessfully.
– pat3d3r
Apr 7 at 9:30