S3 Ep24: How not to get snooped, scammed or hoaxed [Podcast]

Ah, good old “mail undeliverable” spam :-( In this case, I suspect that the answer to your question “how does this benefit the hacker?” is a simple “it does not.” Having said that, it’s hard to know the motivation of someone you’ve never met and probably hope you never do.

In the past, crooks would use undeliverable emails as a trick to produce “backscatter” scam. Companies that faithfully rejected undeliverable emails and included the original email in an effort to be helpful would be spammed with thouands of emails from a laundry list of alleged senders, all directed at addresses that were known not to exist. These bouncebacks were often bounced right away, even before any spam scanning was done (why check a message you know you are not going to accept?), and so they provided a sneaky way for crooks to use innocent companies as spam relays. This doesn’t work very well any more, not least because [a] many companies bin rather than bounce undeliverable messages unless they think they can trust that it really came from the claimed sender and it doesn’t look like spam, and [b] many companies don’t bounce the whole message but just a tiny snippet of it so that if there were dodgy links or spammy content in the original message, they don’t survive the bounce process, making the backscattered emails useless to the spammers.

Of course, spam-by-bounce usually has a different *sender* each time (that’s where the bounceback will get delivered) and the same recipient (one that is know to provoke a bounce message). That doesn’t really match your pattern.

Secondly, some crooks have used bounces simply for harrassment and to cause frustration by flooding someone’s mailbox with a bunch of annoying garbage that isn’t easy to filter because it doesn’t really look like spam.

And lastly, you will sometimes simply get caught up in a spammer’s incompetence, where their automatic spambots go haywire and do things such as sending all spam in one batch to the same recipient instead of to a long list, leaving out the subject line, leaving out the content, or sending just a few words that don’t form any sort of message at all. (I went through a stage of getting 100s or 1000s of spams that just said, “Dear”. After a while they stopped coming. Perhaps that spammer was so incompetent they actually went bust?)

You can probably see from the headers which servers it came through the way to the company that bounced it to you (look for the Received: lines, starting at the bottom and moving upwards, given that new Received: headers are added at the top as the message makes its way to you). That’s not an awful lot of use if you want to trace the actual spammer, however. It identifies the sending *computer* but not the person/persons/gang who hacked/infected/tricked/subverted/paid their way into getting the message sent from that computer in the first place.

HtH.