Aol Email Hacked

Most people don’t know that the to, cc, bcc, subject, and body are not the only fields you can change in an email. Many who run their own mail servers for the first time have an epiphany that they can change any field on an email, including the from field. So what’s to keep us from framing Roger Rabbit? It’s very easy to send an email from someone else without actually being logged in to their account. The server conversation for that scenario would go roughly like this…​

There might be a subtle something you missed in that conversation just now. The email is coming from super_sketchymail.info, but the letter itself says it’s from aol.com. The point here is that Gmail missed that it was a fraudulent email and now Frank has it in his inbox.

There are many methods to detect and respond to fraudulent emails. One of them (the topic of this post) is this great thing invented by the elders of the internet called SPF, or sender policy framework. In a scenario where SPF was implemented, the mail server conversation would go roughly like this…​

Effectively what SPF provides is a way for a mail server to verify that the server delivering the mail is approved to do so for the given email address (the from field). In the previous conversation, super_sketchymail.info was trying to deliver mail on behalf of Aol. Gmail then checked with Aol (their SPF records) and saw that their list of approved mail servers did not include super_sketchymail.info, and thus the email would not be delivered.

Isn’t that a great little bit of functionality?

Despite Aol’s DNS mis-configuration, there is one final issue that I can’t really speak much to. It goes back to the emails I’ve been receiving from my "dad’s" email account. Each of those is written to people from his contact list, which indicates that someone was able to get in to Aol (or their user data got out) and acquire user’s contact lists. If they got their contact lists though, who knows what else they were able to get.

How big was this breach? I can’t say. Aol confirmed the breach just two days ago. Hopefully Aol doesn’t play this out poorly and try to keep everyone in the dark. I’ll post back here as I learn more.

It’s actually been a while since the issue was "resolved", I just haven’t had a chance yet to post back on it. Now though, it’s snowing outside (in spring), I have a hot mug of coffee, and my cat is sleeping on the recliner instead of my keyboard. Let’s get started. First, let’s have a look at AOL’s DNS to see how they’ve done fixing it up.

It looks like they’ve certainly thoroughly updated their DNS. In application, their fix should prevent folks from being able to spoof legitemate AOL accounts, but that’s actually only because of their vendors having their DNS configured properly. To be extra clear, the reason the problem is fixed is not because AOL has actually implemented a solid fix. As mentioned earlier in the technical version section, there are four qualifiers for the trailing all bit, AOL chose to use the ~, a soft fail. This will still not disown non-AOL server sending mail as AOL. It will only "raise suspicion" for those emails. However, thanks to their vendors knowing what they’re doing (aspmx.sailthru.com and at least), their spf records actually end with a -all, or a hard fail.

To give a simple overview of how AOL’s DNS works now, they basically include all of their vendor’s spf records in their own spf record. That means that if any of their vendors break their own DNS to allow anyone to spoof the vendor, the "spoofers" can also apoof AOL users because AOL’s DNS is including the vendor’s bad DNS configuration. In this case though, one of AOL’s vendors (aspmx.sailthru.com), ends with a '-all, causing AOL’s DNS configuration to be secure becuase one of their vendors made an alright decision in their configuration. Dear AOL…​

One final thing to note regarding the remainder of the breach. AOL has confirmed that there was indeed a security breach wherein the attackers gained access to user’s complete address books (email address, names, physical mailing addresses, etc) as well as encrypted security questions/answers and encrypted passwords (gosh I hope they mean hashed instead of encrypted passwords). I hope that AOL comes out with a detailed report as to how the attackers gained access to their systems. Given their mishap with DNS (benefit of the doubt), I hope the hack on their servers wasn’t nearly as obvious. Also I’d like to know for my own edification. Due to this leak, I have begun receiving an increased amount of non-AOL spam as if my email address was released to more spammers. Thanks AOL. I guess though that it was bound to happen sometime by someone. Why not AOL.. At least I got to learn how to set up a spam filter for Exim.

This morning I got three more spam emails from my dad’s email address. Upon inspecting the headers, I found they were not from AOL (surprise surprise).

Per this post, I checked their SPF records as of today and look what they have set…​

They still have soft fails (note the ~all rather than -all at the end) on their SPF records, which allowed those emails to be sent and received with a measure of validity.

Good thing I have bogofilter scanning my email.