Blind-Spot Email Exploitation
For a number of years people all around the world and across many different systems have noticed random important emails disappear into spam folders, and sometimes disappear altogether. Why?
Generally, the explanation we have all learned: The world has way too much spam, and all the sophisticated spam filter tech has side effects. If we complain about it we're given a list of possible technical causes. If it's none of those, we're told to "white-list" each address. However, it still happens. Important messages continue to get dropped.
That was a few years ago. Now something new is happening that changes this picture.
The above cycle of frustration has been experienced over and over by individuals and groups world-wide. Particularly certain organizations. Why those specifically? Is it because they do not fix all the technical problems or white-list all the addresses?
Due to a number of first-hand and second-hand clues we now see the whole problem as a cover for something else: it has become the thing technical support teams around the world (and from there everyone else) stays focused on and believes to be true: that all you have to do is fix the technical problems and white list the addresses, and problem solved. And while focused on those time-consuming steps to keep everyone quiet, it instead is a strategic block for anyone and everyone on a suppression list.
What we see (and have confirmed in several cases) happening is precisely the worst case scenario: they are exploiting all of the blind spots in messaging.
Basically, a blind spot is where you send your message to someone, not knowing if they intend to reply or not. So if you don't hear back you figure they weren't interested. Or vice versa.
A huge subset of this is promotional materials. Let's say you distribute a flyer that has your company's email address on it. If you're on the suppression list then it will silently establish two-way blocks for each first time email connection that is not face-to-face. If face-to-face then it is not a blind spot. If already on their contact-list (or vice versa) then it is not a blind spot.
However, if they take your flyer home to send their first message then that is a blind spot. Or, you hand someone a busines card at a lunch meeting, that is a blind spot.
They send their message and get no error, which gets them to believe the message went through. You never receive the message and believe they were not interested.
This is not the same as black listing. If you check all the black list services, your address is not on any of them. It is far more insidious because it is invisible, and leaves you with nothing you can do about it.
What actually happened? At some server between them and you a program reads the message header (which in the email protocol is never encrypted, even a secure email has vulnerable headers). Then from that header they can determine whether or not you or your organization is on their suppression list. If on the list they then setup a two-way block on all media that they have control over. For now we are aware of this affecting regular phone calls, voice mails, missed call reports, text messages, and email.
So, instead of your hard earned marketing money bringing in those leads, they instead use your money to setup lasting 2-way blocks on multiple media between you and demonstratably interested people. It does this without generating errors at either end. Neat trick. Ouch.
Then on top of that, they make use of AI to guess at which additional emails to drop, to muck up really important dialogues with people you've known for years.
The entire purpose of this exploit is to turn all your efforts into nothing, figuring you'll eventually just give up. You and/or your organization then fails. The more you spend to get off the ground, the faster it fails.
Unfortunately, it is impossible to fix what's wrong with the email protocol. It has this flaw (above), and the endless spam flaw, neither of which are fixable. The only solution is another protocol, and total abandonment of email. Phones have similar problems.
We are working on a solution right here.
|