Nice grey life

Subscription Bombing • Email under Attack

---

One of the most important inputs when designing a security attack response strategy is good characterization. This article describes subscription bombing, a relatively new attack mode, hypothesizing on the motivations that can lie behind it and presenting some countermeasures that can be taken by different actors to reduce its impact.

At its core, suscription bombing is a classical reflection attack: it uses a third-party service so that the answer to a relatively simple request is amplified, resulting in a distributed denial-of-service (DDoS) attack for the victim. And, as with most DDoS attacks, its effectivity lies in that there is not much a person can do against traffic coming from seemingly random providers around the world.

The core differentiator for subscription bombing is that the attack’s victim is not a network port but an individual’s email address. The attacker builds a database of service providers that allows interested users to sign up for a newsletter or a mailing list, or even to just create a new account on a given web system. This action will generate a (seemingly legitimate) confirmation email sent to the victim. But the attacker scripts together hundreds of thousands of such requests, creating a deluge of confirmation emails sent to the unsuspecting victim.

The authors identify some possible motives for this kind of attack. The attacker–say, a disgruntled employee, a political adversary, or even a romantic ex-partner–may be motivated by harassment or wanting to inconvenience the victim. More worryingly, the attack can be used as a distraction: by sending a high volume of mails in a controlled timeframe, the attacker can reduce the probability of the victim noticing a legitimate warning about financial fraud, unwanted purchases, or break-in attempts on their accounts. Attacks targetting mailboxes at private email servers can also lead to overloading an account’s limit, causing it to reject emails after the attack is delivered and before the folder is cleaned. And it can also pave the way for follow-up targeted deception attacks: the attackers call the victim, pretending to be the company’s information technology (IT) department, and get them to install a remote desktop monitoring and management tool with which they can effectively seize control of the victim’s data.

To do this, the authors present their study of 24 cases of victims: 47,970 total emails were received between October and December of 2024, with individual attacks receiving between 81 and 3,387 emails per hour. They include several descriptive analyses. They also explore cybercriminal offers on underground websites, comparing flooding services and pricing schemes.

Finally, mitigation strategies are discussed. Mitigation is quite problematic as none of the email servers are acting in a hostile way or lacking permissions–in fact, they are performing just the task they should. The authors suggest four mitigation strategies for email server operators, to reduce the burden on users, although none of them is easily automatized: rate-limit the number of emails a given inbox can receive from previously unseen senders; educate users about this kind of attack; group similar newsletter or account reset emails during active attacks; and automatically unsubscribe or bounce newsletter messages when a surge is detected. They also recommend various other solutions: CAPTCHAs or requiring users to take several steps before requesting a subscription (although they recognize this adds friction to the process providers are most interested in providing); filtering and triaging known-good and known-bad domains (although this is hard to implement in a preemptive fashion); and adhering to easy unsubscribe standards, such as easily identifiable headers for mass unsubscription (instead of hunting for the right places to click, potentially even in emails written in an unknown language).

This is an interesting problem, and properly tackling it could be a game-changer for many users who would otherwise suffer from this kind of abuse. The article is easy to read and soundly supports its claims.

---