CoordMail: Exploiting SMTP Timeout and Command Interaction to Coordinate Email Middleware for Convergence Amplification Attack

CoordMail: Exploiting SMTP Timeout and Command Interaction to Coordinate Email Middleware for Convergence Amplification Attack

Speakers: Ruixuan Li

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=ip0Z71SIb84

Overview

CoordMail is a novel email amplification attack that coordinates thousands of email middleware (bounce servers, open relays, and email forwarders) to deliver reflected emails to a victim simultaneously, creating explosive traffic convergence. By exploiting two inherent features of SMTP -- client-controlled session state and long session timeouts (RFC-recommended 5 minutes, typically 10+ minutes in practice) -- an attacker can maintain thousands of long-lived SMTP connections and trigger them to release reflected emails in a coordinated burst.

The results are striking: in small-scale real-world experiments with just 20 email middleware, the attack achieved a bandwidth concentration efficiency (BCE) of over 3,000x. In controlled lab environments, it generated over 2 Gbps at the victim from just 76 Kbps of attacker bandwidth -- a BCE of 33,000x. The researchers identified approximately 20,000 email middleware suitable for constructing these attacks in the wild, and found that most existing security mechanisms (except DMARC) show limited effectiveness against the attack.

Background

▶ Watch: Traditional email amplification and the MRSI military strategy concept (0:00)

Traditional email amplification attacks reflect emails through middleware (bounce servers, email relays, subscription servers) to overwhelm victims. However, these attacks typically achieve only a few hundred times amplification because reflected emails arrive asynchronously over time, allowing the victim to handle them.

The CoordMail attack borrows from the military concept of Multiple Round Simultaneous Impact (MRSI) -- when a defense system can block individual shells, sending many shells along different paths to arrive simultaneously overwhelms the defense. This concept has already proven effective in SIP and DNS amplification attacks, causing severe impact through traffic convergence.

The key enablers for CoordMail are two fundamental properties of the SMTP protocol: (1) The client fully controls the session progression by sending commands step-by-step, with the server responding to each. (2) SMTP is a text-based protocol with high tolerance for delays -- RFC recommends 5-minute timeouts, and major email providers implement at least 10-minute session timeouts. Together, these properties allow an attacker to maintain and coordinate a large number of simultaneous SMTP sessions.

Key Findings

▶ Watch: Step-by-step CoordMail attack: connection establishment and maintenance (4:00)

~20,000 email middleware suitable for attacks identified in the wild. Through active scanning of 6+ million email domains and IP addresses with TCP port 25 open, the researchers identified bounce servers and open relays. Combined with passive email log analysis for email forwarders, they filtered for middleware meeting three criteria: sufficient amplification capability, SMTP session timeouts exceeding 10 minutes, and stable reflection intervals (average below 5 seconds, standard deviation below 500ms).

Bandwidth Concentration Efficiency of 33,000x in lab conditions. With 76 Kbps of attacker bandwidth and a 100-second attack cycle, CoordMail generated over 2 Gbps at the victim -- a concentration factor of 33,000x.

BCE of 3,000x in real-world experiments. Using just 20 email middleware with 5 reflected emails each and a 140-second attack cycle, the attack achieved over 3,000x concentration.

Bounce servers are most effective. Bounce servers produce larger reflected emails than other middleware types, making them the preferred component for CoordMail attacks.

Most security mechanisms are ineffective. While DMARC can effectively block reflected emails from constructed middleware, most other email security mechanisms show limited effectiveness. Many popular email providers accept reflected emails from a large fraction of the tested middleware.

Major email providers have 10+ minute SMTP timeouts. Measurement of major providers confirmed that SMTP session timeouts are at least 10 minutes, providing ample time for attack coordination.

Technical Deep Dive

▶ Watch: 20,000 suitable middleware identified from 6M+ endpoints scanned (8:00)

The CoordMail attack proceeds in four phases:

Phase 1 -- Middleware Selection: The attacker selects email middleware meeting three criteria: (1) amplification ability (packet size increase and number of reflected emails per original), (2) SMTP session timeout exceeding 10 minutes, and (3) stable email reflection interval (average <5s, std dev <500ms). Bounce servers, open relays, and email forwarders are evaluated.

Phase 2 -- Connection Establishment: The attacker slowly and sequentially establishes SMTP connections to selected middleware, creating only one or a few connections per middleware to avoid triggering rate limits or being blocked for connecting too frequently. All connections must be established before the planned attack time.

Phase 3 -- Connection Maintenance: The attacker keeps SMTP connections alive using carefully designed SMTP command sequences. Before each session timeout expires, the attacker sends a new SMTP command to refresh the timeout (e.g., transitioning between SMTP states). The timing is planned based on the attack time, network delay measurements, and email reflection delay for each middleware.

Phase 4 -- Coordinated Trigger: At the planned moment, the attacker sends a QUIT command to each middleware, which triggers the email reflection process. By carefully timing the QUIT commands (accounting for network delay and per-middleware reflection delay), all reflected emails arrive at the victim simultaneously, creating an explosive traffic burst.

For bounce servers, the mechanism exploits the fact that bounce emails use the original sender's MAIL FROM address as the destination. The attacker sets the MAIL FROM to the victim's address, and when the message bounces (due to an invalid recipient), the bounce is sent to the victim.

For detection of suitable middleware: active SMTP probing packets were sent to 6+ million endpoints, while email forwarding relationships were identified through passive email log analysis (since forwarders typically require manual account registration).

Demo / Proof of Concept

▶ Watch: Results: 33,000x amplification in lab, 3,000x in real-world tests (10:00)

Two experimental evaluations were conducted:

Real-world small-scale test: Two cloud servers (attacker and victim) were deployed. Using 20 email middleware, each configured to send 5 reflected emails, with a 140-second attack cycle, the attack achieved a BCE exceeding 3,000x. This was conducted ethically with controlled infrastructure.

Controlled lab environment: An attacker server, victim server, and multiple email middleware were deployed in an isolated lab. With 76 Kbps of attacker bandwidth and a 100-second attack cycle, CoordMail generated over 2 Gbps at the victim, achieving a BCE of 33,000x.

Defensive Implications

▶ Watch: Vulnerability disclosure: Proton plans rate limiting improvements (14:00)

The researchers propose mitigations at multiple levels:

For email middleware operators: Add random delays (0-30 seconds) when generating reflected emails. This simple measure reduces attack traffic by approximately 15x because it destroys the attacker's ability to coordinate simultaneous arrival. Limit both the number and size of reflected emails.

For email service providers: Disconnect SMTP sessions after receiving the RCPT TO command if the pattern matches reflection characteristics. This reduces BCE by approximately 20x. Quickly block reflected emails based on their distinctive features, especially under large traffic volumes.

DMARC deployment: DMARC is the most effective existing defense, capable of blocking reflected emails from constructed middleware. Organizations should ensure DMARC is properly configured with reject/quarantine policies.

Vulnerability disclosure results: 872 domain owners responded to reports. Among valid responses: 49 were awaiting further confirmation, 13 said their servers were managed by hosting providers, and 22 planned to fix the problem. 14 major email providers were notified, with some acknowledging the threat and Proton planning to improve rate limiting.

Key Takeaways

• CoordMail coordinates email middleware to deliver reflected emails simultaneously, achieving amplification factors of 33,000x in lab settings and 3,000x in real-world tests
• Two SMTP protocol features enable the attack: client-controlled session state and long timeouts (10+ minutes at major providers)
• Approximately 20,000 email middleware suitable for attacks were identified through scanning 6+ million endpoints
• Most existing email security mechanisms show limited effectiveness; DMARC is the primary effective defense
• Adding random delays (0-30s) to reflected email generation reduces attack effectiveness by ~15x
• Bounce servers are the most effective middleware type due to larger reflected email sizes
• The attack requires only low-bandwidth SMTP servers from the attacker, making it accessible and cost-effective

About the Speaker(s)

Ruixuan Li is a researcher at China University (likely Tsinghua University or another major Chinese institution). The research focuses on email protocol security, amplification attacks, and SMTP-based vulnerabilities, with expertise in large-scale internet measurement and protocol abuse analysis.