電子郵件服務VFEmail遭毀滅性攻擊，所有資料全被刪

美國的電子郵件服務供應商VFEmail在2月11日遭到駭客的毀滅性攻擊，駭客格式化了該公司所有伺服器的硬碟，破壞了所有的虛擬機器、檔案伺服器及備份伺服器，使得VFEmail用戶的郵件全都消失，連備份也不見了。

2001年成立的VFEmail是家小規模的電子郵件供應商，創辦人Rick Romero只是為了因應當時流行的iloveyou郵件病毒，而決定推出整合防毒機制的電子郵件系統，最初只靠一台FreeBSD伺服器在運作，隨後日益擴大，現提供免費及付費的電子郵件服務，且同時支援Web Mail、POP、IMAP及SMTP等介面，並具備SSL加密傳輸能力。

VFEmail先是在2月11日察覺所有系統都當機，再發現駭客格式化了所有伺服器上的硬碟，且駭客完全沒有向VFEmail勒索或要求贖金，認定這是一起毀滅性的攻擊行動，推測所有存放在美國的資料都已遺失。

資安媒體Threatpost引述Vectra安全分析師Chris Morales的看法指出，這類缺乏動機或要求的毀滅性攻擊並不常見，遺失所有客戶資料對企業而言是一場惡夢，很容易讓小型業者直接破產，也會對大型業者造成巨大的財務損失。

例如在2014年美國索尼影業（Sony Pictures）遭到駭客的全面性攻擊，駭客透過惡意程式刪除使用者電腦及伺服器上的硬碟資料，盜走索尼尚未出版的影片與內部機密資料，光是股價的下滑就讓索尼的市值在一周內蒸發逾600億元新台幣。

VFEmail既無透露該服務的用戶數量，也尚未公布補償措施，雖然使用者的帳號依然存在，但大多數的郵件信箱已然消失。目前VFEmail除了要求用戶重建信箱並努力恢復服務之外，也正與資料復原服務供應商討論各種可能的選項。

安全架構專家Fausto Oliveira則建議，企業或服務供應商應建立正確的災難復原策略，例如將備份資料存放至冷儲存，在此次的攻擊中，VFEmail讓駭客存取並刪除所有資料也意味著該站的系統並未受到有效的保護。

!!!ALERT!!!! Update Feb 11 2019
vfemail.net and mail.vfemail.net are currently unavailable in their prior form.
We have suffered catastrophic destruction at the hands of a hacker, last seen as aktv@94.155.49.9
This person has destroyed all data in the US, both primary and backup systems. We are working to recover what data we can.

Please see the Incident page for a timeline (last updated 2/13/19 7amCST)

Worried about your privacy? Use our Metadata Mitigator™ System! 

Use PGP to protect your email content!

View our new Privacy Q&A!

Since 2001, VFEmail has provided businesses and end-users a quick and convenient way to ensure their own security when it comes to email.

VFEmail scans each complete email, including attachments, for viruses and Spam before it gets to your INBOX. If a Virus is found, it is blocked at the gateway, and isn't even allowed onto our servers. VFEmail utilizes greylisting, public and private blacklists, and the award-winning SpamAssassin to detect spam, which is then discarded and will only appear in your Spam folder if it's potentially legitimate.

VFEmail provides standards compliant POP, IMAP, and SMTP interfaces with SSL encryption, and also provides an easy to use and convenient web interface. The flexibility of the 'Horde' webmail interface includes inline HTML, MS Word, and MS Excel document viewers. It will also recognize your mobile device and automatically display a 'mobile' version of webmail when you login. There is also a sharable calendar, addressbook, notes and a task list. VFEmail also supports individual Email forwarding, aliases, vacation messages, domain forwarding, ftp storage, Email search, and work with our clients to constantly increase the flexibility of our email offerings.

This site performs best with Firefox.

郵件全都消失，連備份也不見？這真是太好了！下次駭客要記得使用「安全性格式化」讓VFEmail絕對無法Undelete救回某些資料！