Ask HN: How did Microsoft email services became the primary source for spam? | Hacker News Reader

Ask HN: How did Microsoft email services became the primary source for spam?

70 pointsbutz50 comments

Just did monthly spam folder sweep. Sometimes legit emails end up in spam, so I regularly make sure that something important was not lost amongst trash. Looking at sender details I noticed that 99% of spam emails are now coming from Microsoft email services, like Outlook and Hotmail. What happened? Did other email providers improve security? Is there some security hole in Microsoft services, that allows easy registration for throwaway email accounts? I'm interested from purely technical aspect what might shifted most spam to MS services?

And most important question: is Microsoft going to do something about it, as service abuse reports seem to make no difference.

View on HN

Heh, I received a spam email through my gmail which bypassed the spam filters and decided to investigate. It had DKIM signing as the sender was an Exchange 365 mailbox. The spam message originated from an Amazon SES which hooked through a compromised Exhange 365 mailbox. I contacted Microsoft Security Response with the Exchange mailbox in question to get this bullshit response.

The activity reported is associated with a customer account within the Microsoft Azure service. Microsoft Azure provides a cloud computing platform in which customers can deploy their own software applications. Customers, not Microsoft, control what applications are deployed on their account.

So why are even we using DKIM at all if bad actors can abuse an open cloud TOS.

So we can blacklist the key that facilitates this abuse.

The likely design fault here is the key is the same for every O365/exchange online client (if they are using MS as their outbound transport). It should be unique so every client could have their own reputation.

I had a similar experience where email messages that should trivially be detected as spam were getting through to a Gmail inbox, originating from Exchange 365 with proper DKIM authorization. It's incredibly frustrating - I was getting between 10-12 an hour. I had to write a Google Apps script to automatically move these trivially detectable spam messages from my inbox into spam.

I expect any sort of abuse report to Microsoft wouldn't result in any action on their part, just as reporting these messages as spam for about a month did nothing on the Gmail side.

> I expect any sort of abuse report to Microsoft wouldn't result in any action on their part, just as reporting these messages as spam for about a month did nothing on the Gmail side.

False positives are similarly annoying. I spent years reporting emails from Kijiji (while they were an eBay subsidiary) to gmail as "not spam". Set up a rule to redirect them from the spam folder to inbox, but they still get tagged as spam when I open them.

I think DKIM was a good idea at the time of its inception. It caught a lot of the low hanging fruit, which was spammers who spoofed domains.

But yeah, now anyone can buy a domain for dirt cheap, setup DKIM, and start spamming away.

At least with DKIM, you have a basis for blocking a domain outright. That is, until they buy up another domain and repeat their spamming activities again.

Email has really fallen apart in the past decade. When it's not spam, it's retailers and other companies sending me unsolicited, unwanted marketing emails, entirely without my consent. They are the bulk of the garbage in my inbox today.

It's amazing to think that companies still think this is a valid way to advertise products and services. At best, people get annoyed and dump you in the Junk folder. At worst, they view it as a form of begging by a desperate company looking for money, and those people definitely won't be interested in buying anything from you ever again. If there was a way to measure it, I would be that companies are losing more money from annoying spam marketing campaigns than from the .00001% that do convert.

Mailchimp, Constant Contact and their ilk are truly a scourge upon our inboxes. You know they're truly terrible companies because if they ever provided a global opt-out of all their email lists from all their clients, they'd go out of business.

One of these days I will just create another self-hosted email service of my own with a fresh domain and only whitelist it with recipients that I actually care to hear from.

allow list

You need to stop and ask yourself if this kind of comment adds any value to the discussion. It's not even offering a good reason for OP to make a change to their language; it's pure nagging.

One way to prevent is to make the cost of churning domains expensive. E.g. requiring registration with a $250 one time fee

That makes domains prohibitively expensive for people just wanting to host their own stuff.

3rd world country here.

$250 for a domain is prohibitively expensive.

If you think what an accomplished spammer doesn't have $250...

> Mailchimp, Constant Contact and their ilk are truly a scourge upon our inboxes. You know they're truly terrible companies because if they ever provided a global opt-out of all their email lists from all their clients, they'd go out of business.

I don't think the majority of internet users supports that view. I know many people who are subscribed to countless newsletters but don't want to unsubscribe, even if it's very easy. They like receiving offers from companies they bought from years ago. That's also why newsletters work so well for many companies.

So while many people here might dislike any email they didn't ask for, that's not necessarily the view of internet users as a whole.

It's just you. Mine are from owned domains and Gmail.

Google has a problem where if you pay for a workspace account (or maybe even trial?) you get a temporary trust, which you can abuse for spamming, that gmail.com users don't get. So people open farms of workspace accounts (with fake id/ stolen CC?) and go wild.

Just checked the 14 latest mails in my spam folder. Every single one from a different custom domain.

I have one from outlook.com, about 2/3 are custom domains (.com and .br), and the rest are from google domains.

Never bothered to look until now but the junk folder on my office 365 email is showing various messages from outlook.com and Gmail.

Not sure why they allow people to send from known spam accounts on their own system.

Lately that's the way it's been for me for technology or marketing services spam to my own custom gmail domain used for business.

My fastmail just gets spammed by gmail.

Like 99% of it is coming from a gmail account. And very formulaic. I wonder why gmail claims to have an excellent spam checker, but they don't check for outgoing spam from their platform.

It could only hurt their own users to filter outbound mail, and they gain nothing from it until people are willing to block gmail (not likely).

98% of spam I receive originates from Google Mail. Trying to forward such an email through many other providers instantly generates a SMTP reject message, so there’s really no way Google couldn’t do it as well. Reporting spam has also become way harder than it needs to be. And no ones dares block Google, not to mention that, like Microsoft, they use so many outgoing IPs, it’s plain ineffective. So both simply stopped caring because it’s cheaper and they will not suffer any consequences.

They also host known spam operations like Advids for years. They’ve basically become a bulletproof spam hoster.

I'm amazed at how much obvious spam I block from Google. A huge chunk of it is 419 stuff that's trivially caught by SpamAssassin rules that took 5-10 min to write[0].

My guess is that the Gmail team doesn't have any OKRs about spam prevention any more, or else they'd be able to pretty quickly put a stop to the top ~90% of the spam that's currently getting through.

I wish the anti-trust regulators were competent and paying attention. If so, they might be able to do something about the fact that Google—unlike pretty much every other large mail sender in existence—fights really, really hard to avoid taking abuse reports. Gmail is "too big to fail" so we can't just block them outright, like Google would do to us if we were the ones sending a bunch of spam and ignoring abuse reports.

[0] (edited to add) For those who are curious or wish to share the fruits of my labor:

  body            __DWP_BIZ_PROPOSAL        /\b(business|confidential|discrete|mutual|beneficial|profitable|investment|favou?rable)\s+(proposals?|opportunit(y|ies)|friendships?|director(y|ies)|intentions?|introductions?|relationships?|business(es)?|investments?|transactions?)\b/i
  body            __DWP_DECEASED            /\b((deceased|deposed|exiled|late)\s+(former\s+|ex[ -])?(ceo|husband|client|(vice[ -])?president|senator|[mb]illionaire|brother|sister|(great[ -])?((grand-?)?((fa|mo)ther|parent)|uncle|aunt)s?)|widow(er)?|beneficiar(y|ies)|inherit[ea]nce|last will and testament)\b/i
  meta            DWP_419                   __DWP_DECEASED && __DWP_BIZ_PROPOSAL  && (FREEMAIL_FROM || FREEMAIL_REPLY)

There are some other rules this works in conjunction with, but stopping the obvious spam is really not rocket science.

LOL that was a Procmail flashback from twenty years ago!

What happened to Bayesian detection and AI?

They work, too. But sometimes simpler solutions work better.

SpamAssassin assigns a score (positive = more spammy, negative = more hammy) to each rule. So the above-quoted rules work in conjunction with other rules, the Bayes filter, IP/ASN reputation data, etc. DWP_419 has a really high score in my setup right now because the false positive rate is currently zero, but it could theoretically be canceled out by other signals.

I am just guessing, but O365 I cant remember its new name has been used by many businesses and I would expect the spammers are counting on business IT folks being lazy and just whitelisting o365's domains rather than custom per-company domain endpoints from O365. Meaning, sending from popular providers such as O365 or gmail is more likely to be whitelisted than one-off email provider domains. But I am just guessing.

Another possibility could be that receivers of email from O365 may not see an easy way to report the spam to Microsoft or perhaps Microsoft do not have enough folks dedicated to dealing with UCE/malware reports. Just my own experience, but when talking to Microsoft about this topic they would refer me to a partner Proofpoint which a former company ended up using to front-end O365. That left me with the impression they did not want to be in the business of dealing with UCE/malware reports and wanted to either automate it or outsource to a partner.

What does UCE stand for?

Thanks!

unsolicited commercial email, aka spam, but less fraudulent than penis pull scams.

It must just be you. ~20,000 user org here and from my own statistical analysis, we get far more from Gmail than MSFT.

We also never get any response from Google when reporting spam campaigns or GApps compromises.

How? Probably the many millions of idle/stale accounts that had their passwords exposed on the hundreds of password database leaks.

Microsoft does seem to make it very easy to sign up for their accounts. I used to run a compute service that had a credit card -less free trial. It was peak crypto, so there were a lot of people creating outlook.com accounts, using that to create a Github account, and then logging into our service as a brand new user that way. They would then mine crypto for the duration of the free trial and then rinse and repeat.

I think at the time I went through Github's sign-up flow, and you didn't have to even verify your email address to be able to OAuth with your Github account. (I didn't try signing up for an outlook.com email address, so I'm not sure what that entails.) GMail, comparatively, appeared to be more paranoid. We eventually prevented outlook.com addresses from getting a free trial without talking to a human first, and the people looking for a free crypto-miner didn't come back. (They tried Proton as their second choice.) We never banned GMail, so I can only assume that people had a harder time signing up, which is pretty impressive on Google's part.

Outlook/Proton is easier because they don't ask for phone number while GMail does. (At least in my country).

There's also number of throwaway temp mail providers, and 33mail (If I recall correctly, gives a subdomain and all emails to that domain get forwarded to your original email.).

Lack of participation in DMARC by default certainly isn't helping. Not sending those reports makes all those exchange servers invisible during your DMARC deployment process, which makes deploying DMARC harder if you're on exchange, which makes it easier for people to impersonate your domain.

Microsoft has needed to fix this for years.

Truth? Inadequate spam control, even on E5 and most people are gullible and click-happy. It's equally astounding and frightening just how many compromised mail accounts are out there. Training is inadequate, with most security and IT orgs making excuses for their users.

What is E5?

It's the version of Office 365 that has Microsoft Defender included.

>Training is inadequate, with most security and IT orgs making excuses for their users

Training? Everytime a user has been phished their manager says "nono it cant be that they clicked something and logged in, they are very careful :)" Its never the users fault.

IT is not making excuses, the business is. No business wants to say "yea we have shit security and we hire numbnuts"

MFA + AAD risk users block + impossible travel block + turn off basic auth w conditional access helps a lot.

For the last month or so, I've been watching GMail fight a losing battle in my inbox against a lone spammer using Outlook.com accounts to push a Yeti Cooler from Dick's Sporting Goods.

Every time they think they've got the bastard, he changes Goods to G00ds, or changes the subject line to "Confirmation Email", and it slips through again and hits my Primary, easy as pie. This happens at least a couple times a week.

All the cheesy tricks we thought stopped working 20 years ago are back in play for this one intrepid spammer. GMail just can't seem to stop itself from completely trusting just about any email from Outlook.com.

Now I'm wondering why more people haven't figured this out.

See my comment above. For me, all of the Yeti images are hosted by Caring Bridge on AWS servers. Caring Bridge seems like a nice company, but they are unable to stop the spammer from abusing their free hosting.

From 10/18 - 𝘠𝘌𝘛𝘐 𝘏𝘰𝘱𝘱𝘦𝘳 𝘔20 𝘊𝘰𝘰𝘭𝘦𝘳 - 𝘠𝘰𝘶𝘳 𝘰𝘳𝘥𝘦𝘳 𝘩𝘢𝘴 𝘴𝘩𝘪𝘱𝘱𝘦𝘥!## https://ns(x)hn/WxXqK which redirects to https://yuzuapples(x)com/0/0/0/ecf39df03591d83ed90be8d40d962...

Yes. I know at least one way to create unlimited outlook accounts for 0$(no paid proxy needed, no phone number, just a captcha solver model that can run on any PC, you could get a million outlook accounts for 0$). I found this by accident, so there is probably dozens of ways to do this if you look hard enough.

There is also ways to get unlimited free premium exchange accounts.

Also most microsoft users are technically inept, so their accounts probably get hacked more often than other people.

These people coded Windows. No wonder nothing works as intended.

Cycled through several email providers to say confidently that rich widows, Nigerian princes & doctors selling OTC pain, antidepressants & penis enlargement meds still love Yahoomail & it Pro sibling with custom domain, the undisputed king of spam mail providers

We had a phishing email this week that Microsoft Defender let through. Its email body link was a Microsoft short URL like https://ncv.microsoft.com/ which then landed on another Microsoft URL that began with https://customervoice.microsoft.com/Pages/ResponsePage.aspx and showed a legitimate looking FAX/PDF download, which was the only link in the chain that was obviously some odd scam site.

The first link still works and it seems to redirect to a random scam page each time.

Most of my spam messages are attributed to gmail per Spamcop. However, for the past year, I get 1 or 2 a day that Spamcop says are from Microsoft.

Most of the ones from Microsoft servers are old Mailchimp messages (headers and body, hours to 10 years old) with 2 image links and 2 shortened links added.

Yahoo/AOL/Verizon does not detect them as spam.

I report to all involved and receive auto-responses and canned text. AWS is helpful, but Microsoft, Cloudflare and Zendesk are less than helpful.

The spam messages are useless without the images, so I concentrate on the image links. There seems to be an endless supply of free image hosting services.

I don't know about primary source, but it is absolutely impossible to get your own MXs whitelisted by Microsoft, eg if they are in OVH IP range.

Dunno if they still do this, but years ago when I created one email account per service I used (github/jobs/online orders), I didn't have to add a phone number or other 2fa to the Outlook addresses themselves inside Outlook, but I did have to do it for the Gmail addresses. That being said, after a certain period of time, I think Outlook eventually prompted me to add 2fa.

A big chunk of spam belongs to Google Workspace and Microsoft 365 nowdays. Worst being that Google shares servers for free and paid customers - we had a lots of email deliverability issues, because Workspace servers are constantly in spam lists! Filtering out *.onmicrosoft.com is a simple rule to delete tons of spam nowadays!

You've hit it with this phrase:

> "service abuse reports seem to make no difference"

Microsoft email services are being used to create these spam accounts as they are much more easier to setup and get running. And if a spammer is using a Windows based OS, setting up multiple mail accounts using the Mail app is almost a breeze (including managing those multiple email accounts).

Weird concidence, I had to troubleshoot why emails from my personal email were marked as spam by Outlook.

On the contrary, I mostly get spam from yahoo and gmail addresses.

Microsoft is pretty rare for me to see in spam.

Is all the other spam just getting completely dropped at the edge?

I got most of the spam from Google.

Reply on news.ycombinator.com