82

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.

My password is as strong as a password can be so the chance of brute force winning is infinitesimal. However as a result of the authentication failures, my hosting provider keeps locking the email account.

Is there anything I can do (or that I can ask my hosting provider to do), or am I just screwed until the botnet moves on? Anyone with similar experience who can comment on whether I can expect this to ever end?

EDIT: After about 9 days, I suddenly stopped getting locked out and the ticket got closed. I guess they finished "testing" the new policies/systems and hit the rollback button?

I'm not happy that support insisted on so much troubleshooting at my end when the whole thing seems to have started after a security overhaul at their end, but that's how it always goes...

clemdia
  • 831
  • 1
  • 5
  • 7
  • 41
    Ask your email provider to make a change, that's the only options. In the meantime, open a new account and forward all emails to your new account so that you are still functional? – schroeder Apr 06 '19 at 15:04
  • 8
    Are you using one of the big email providers (Gmail, etc) or something smaller? – Anders Apr 06 '19 at 17:20
  • 31
    Get a better provider that isn't so vulnerable to this kind of trivial DoS? – Nate Eldredge Apr 06 '19 at 22:46
  • 23
    Maybe another account is under attack (Bank? Facebook? Income tax refund? Domain in your possession?), and they are taking out your email so you don't get notified. –  Apr 06 '19 at 23:57
  • 49
    I had a similar experience with my account: The culprit actually was my phone, that had an outdated password for the account and repeatedly tried to log into it unsuccessfully. – pat3d3r Apr 07 '19 at 09:30
  • 1
    Can you access the server's iptables file? maybe create some rules to block the malicious IP addresses at the firewall level before they hit the email server? – Jason Apr 08 '19 at 02:38

5 Answers5

55

A few thoughts:

  • Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.
  • If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.
  • If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)
  • Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.
  • Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.
Anders
  • 64,406
  • 24
  • 178
  • 215
  • 21
    Would 2FA really help? The second factor isn't usually attemped until after a correct password is entered, and the attacker will never get that far. – Barmar Apr 06 '19 at 18:35
  • 3
    What makes you think he's not already using IMAP? – Barmar Apr 06 '19 at 18:36
  • 1
    @Barmar I say "if you are lucky" for a reason. If the attacker, either a human or a bot, can detect that 2FA is on, it might give up. Or not. At least it don't hurt. – Anders Apr 06 '19 at 18:37
  • @Barmar As for IMAP: Sure, OP might be, then I guess you can just reverse it and try the webmail instead. The point is "use another method". – Anders Apr 06 '19 at 18:38
  • 2
    @Barmar If the attacker's script isn't written to try to enter anything on the second factor, it might prevent the lock out. Worth a try at least. – jpmc26 Apr 06 '19 at 20:27
  • 7
    I think most 2FA systems don't prompt for the second factor until after you successfully pass the first. – Barmar Apr 06 '19 at 21:21
  • 15
    @Barmar Yes, that is true, but my advice still stands. There is a non zero chance it helps, the effort is near zero, the risk is zero, and you should probably do it anyway. So even if it probably doesn't help, you should still do it. – Anders Apr 07 '19 at 07:09
  • 1
    I wouldn't recommend two factor authentication to get them to move on, but rather just to be an additional level of protection, in case they manage to figure out your password eventually. This is the main advantage of it either way, but it's especially relevant if someone's actively trying to get into your account. – NotThatGuy Apr 08 '19 at 10:56
35

No. That's pretty much the background noise of being on the internet.

From a random server I have with e-mail:

$ sudo grep -c "auth failed" /var/log/mail.log
1109

That's today. It's with fail2ban blocking more than five attempts from the same IP.

vidarlo
  • 12,850
  • 2
  • 35
  • 47
  • 34
    This is not the same thing. He is referring to one specific account, not the complete authentication log for a mailserver. This is attempts at one specific user. – John Keates Apr 06 '19 at 21:27
  • True it is my account specifically - but I think vidario has it right in a general sense. My hosting company recently updated their implementation of csf, and I wonder if it’s too strict - I’ve been wondering if the attacks are nothing new - just a new policy of locking account after “x failed attempts in y minutes”... – clemdia Apr 07 '19 at 03:53
  • 6
    I understood this answer to show that even for some random server online, failed authentication attempts are plentiful and should be expected (which is true), not trying to equate the example to OP's use-case. – aaaaaa Apr 08 '19 at 14:52
  • 2
    @clemdia yeah, you might want to contact them then, and let them know that their "security" is turning a run-of-the-mill brute force drive-by into a DoS by locking the legitmate user (you) out of the account. They should be blocking authentication attempts by IP, not by account, that's terrible practice. – Doktor J Apr 09 '19 at 13:57
26

tl/dr: This is your hosting company's problem, not yours. You'll have to contact them to get it fixed. Their security policies shouldn't lock you out of your own account. They need to do security better.

You already have some answers that I agree heartily with and which cover the technical aspects of this, but I'm throwing in another answer to cover a "business" item. Here you hit on the crux of the issue:

However as a result of the authentication failures, my hosting provider keeps locking the email account.

In otherwords, the problem isn't your problem. You have done everything you can to secure your account on someone else's mail server - you are using a strong password that can't be brute forced. The underlying issue here is that your hosting provider has implemented a bad security policy. As @vidarlo mentioned, this is just the background noise of the internet. Your hosting provider should know this. Unfortunately their chosen response has the side effect of locking you out of your account.

In essence the combination of your hosting company's choice of security policies and the standard password scanning that happens to every server on the internet has resulted in a denial of service (DoS) of your email. If your email went down because someone attempted an actual DoS of your hosting provider and filled their networks with useless bandwidth, the solution would be quite simple. You wouldn't be here asking what you can do to fix the problem - you'd be talking to your provider and asking them to fix it. After all, the whole point of using a third party email service provider is for them to provide you with a service. If you are not being provided with that service, either because their servers went down, or because their network is crippled by a DoS, or because their security policy is overly zealous and locks you out of your account, then the only real solution is for your hosting provider to fix it and provide you with the service that you are paying them to give you.

Many questions we get here are the result of people ignoring security all together.. However, there are plenty more examples of people trying to do security but just doing it wrong. This is one of the latter. Therefore, you definitely need talk to your hosting provider and get them to fix it. If they can't provide you with the service you are paying for, then you need to switch to a provider that will (although hopefully it won't be the kind of provider that simply doesn't do security at all).

Conor Mancone
  • 29,899
  • 13
  • 91
  • 96
  • 7
    Yes, +1 for this. I work for an email security company, and we have far more intelligent anti-bruteforce systems than the OP is experiencing. This sort of blunt-instrument protection is unnecessary - locking out the legitimate user because of a brute-force is just inviting denial-of-service. Consider changing your email provider if possible... – Steve Shipway Apr 07 '19 at 20:42
  • 3
    Turns out they reimplemented CSF (and maybe some other things) just before this started happening. I suspect they've implemented a policy that deflects/denies all authentication requests (regardless of source IP) after "x attempts in n minutes" - I can watch myself connect to the server, get refused, submit the same credentials a few more times, get refused a few more times, and then suddenly the credentials work. I do this with them live on the phone. They agree it's odd, and then email me log files that show "authentication failures" from my IP address. Yeah, no kidding... – clemdia Apr 08 '19 at 01:57
  • 2
    @clemdia hard to say with 100% certainty, but it definitely sounds like this is exclusively an issue on their end and (either way) can only be fixed on their end. To some extent they are also using you as a beta tester (intentionally or not). Just about all tech companies do that to some extent, so I give you props for your patience, but it also isn't something that you have to continue to do, especially if they continue to provide a broken service. – Conor Mancone Apr 08 '19 at 02:01
  • 2
    @clemdia An example of a simple bug that could explain this: "Authentication failure" is a very broad error message. It could be that their system uses that for any broad class of authentication failures including, "Automatically blocked because of too many failed attempts". Therefore, botnets trigger the block on your account, then you try to login and get Authentication Failure - not because your credentials were wrong, but because you were auto banned. They see "Authentication failure" and therefore conclude you typed your password wrong, missing the larger issue. – Conor Mancone Apr 08 '19 at 02:03
  • 1
    I'm not claiming for sure that that is what happened, but stuff like that is easy to have happen and easy to miss. As a programmer on the other end, it is easy to put bugs in the most obvious box and sometimes miss the root cause, causing issues to take longer to resolve than necessary... of course I've never done that myself... – Conor Mancone Apr 08 '19 at 02:04
  • I'm a developer and that's exactly why I'm trying to be patient (and help them solve their own problems, if I can). We've all been here... they're not having fun either. – clemdia Apr 08 '19 at 02:08
18

Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email address. That way mails go out like this. 

 From: account-I-always-had@oldserver.com
 Subject: Re: so-and-so
 In-Reply-To: <4735813474834434634@theirmail.com>
 Sender: burneraccount@newserver.com

Or something like that.

Anyway, that lets you keep your identity at the official email address. The attacks on the login server are irrelevant to receiving and forwarding email.

As is evident from the above, your new email address may be obvious from headers so don't set up an autoresponder. Only correspond with people you trust. If this burner email account comes under attack, trash this burner account, setup another one, and tell the official email server to forward to the new burner.

Then, research who you sent mail to in the last 2 days to the last burner account. One of them compromised it. Use one tactic or another to trick them into attacking this or another burner account, that lets you distinguish who exactly did it.

Harper - Reinstate Monica
  • 3,101
  • 10
  • 17
  • 2
    Or if possible, change username to be different from the address. This way you reply from the same address and have the same mailbox, but prevent account lockout. – Esa Jokinen Apr 07 '19 at 04:05
  • 4
    THIS (if only it were possible) - btw this experience has highlighted the lunacy of websites REQUIRING email address as username - just stupid. – clemdia Apr 07 '19 at 04:36
  • 1
    you might try using + to add a per domain suffix. then when you get spam it will (most likely) include who leaked your email. plus it becomes easy to block all emails that came from the domain – sudo rm -rf slash Apr 07 '19 at 07:31
  • @sudorm-rfslash - I think the the +suffix trick might be gmail specific. – Justin Apr 09 '19 at 15:08
  • @sudorm-rfslash yeah... I actually have my mail server configured to use `_` as the "decorator" or "suffix" character. Since many (especially business) domains use a first_last@example.com format, even sites that reject emails with `+` in them will still happily accept an email with `_` in it! – Doktor J Apr 09 '19 at 20:26
  • @Justin it's just mail server specific. Many servers -- *but not all* -- support it. It's not standards-defined, but has sort of become a de facto standard; GMail just popularized it. – Doktor J Apr 09 '19 at 20:27
0

This is dependent on your provider and what they are willing to do.

If you had a static IP you could ask them to whitelist your IP. Maybe even your CIDR, but if you do too many of those some of the bad traffic may start to come through.

After so many attempts your provider should temporarily ban the IP addresses attacking them. Now hackers have thousands even 10's of thousands of IP to choose from but eventually they might be able to block them all.

Obviously your provider needs better ddos protection.

cybernard
  • 518
  • 2
  • 10