[anti-abuse-wg] Is there any analysis on root causes of mail account break-ins?

Hi folks,

I'm trying to understand the root causes and vulnerabilities that lead to hacked mailboxes. Currently, we can handle 
dynamic IP ranges pretty well, and we have an extensive list of network ranges whose owner are spammers or knowingly 
accept spammers as customers.

So what mainly remains as spam sources are hacked servers/websites, hacked mail accounts, and freemail accounts 
registered with the purpose of spamming (I'm looking at you, Google).

Here I want to focus on hacked mail accounts. I can think of two major root causes but I have no idea about their 
relative significance:

  * Easily guessable passwords, with two subcauses for exploits:
      o Brute force authentication attempts - I'm seeing them regularly, and the most egregious networks (e.g.
        5.188.206.0/24) are fully blocked at our mailserver, but some mailops are less struct about blocking such abusers.
      o Hashed password data exfiltration and cracking (for example using JtR) these lists - this would work better with
        weaker password hashing, but with weak passwords and some CPU power it is probably possible even for strong hash
        algorithms.
  * Malware on client machines where passwords are either stored in a password vault, or entered manually.

My gut feeling is that some organizations are especially prone to hacked mail accounts. We're seeing lots of south 
american government agency users, and many accounts at educational institutions. The latter are often hosted using 
Microsoft O365 services, and I highly suspect that weak passwords for all the freshly created student accounts may be a 
major cause, although exfiltrated password data may be a possibility, too.

So does anyone have pointers to studies analyzing these (and probably more) causes of exploited mail accounts?

Cheers,
Hans-Martin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20211117/f7385e04/attachment.html>