Email and Phishing Attack

Email phishing and impersonation attacks:

Email phishing and impersonation attacks trick you into thinking an email is from someone you trust, often using stolen information to make it seem real. Be careful and look for clues that might reveal the email is fake.

Impersonation:

• Account Hijacking (BEC): Attackers gain access to a user’s email account (e.g., through compromised devices or cloud services). This allows them to impersonate the user and request sensitive information.

  • Example: An employee receives an email from their manager requesting confidential information. The email has poor grammar and spelling, but it’s from the manager’s actual account, making it more believable and potentially more dangerous.

• Email Address/Domain Spoofing: Attackers forge the sender’s email address or domain. This is common for targeting high-level individuals.

  • Detection: Carefully examining the email headers can often reveal spoofing attempts.

Forwarding:

• Phishing emails may appear to be part of a reply or forward chain.

  • Bulk Phishing: This tactic is often unconvincing in mass campaigns.

  • Spear Phishing: More effective in targeted attacks where the attacker has access to genuine email content.

  • Detection: Analyzing email headers can help identify the true sender.

Email Message Internet Header Analysis:

Email headers are like a behind-the-scenes record of an email’s journey. They contain information about who sent the email, who it’s going to, and the path it took through different servers on the internet.

When you send an email, your email software (MUA) creates a basic header. Then, your email server (MDA) checks if you’re allowed to send emails from that account and adds its own information to the header. The email then travels through other servers (MTAs) on its way to the recipient, and each server adds its own information to the header. By analyzing the header, you can see the email’s complete journey and identify any potential issues or signs of tampering.

Email Malicious Content Analysis

Attackers use spoofing and impersonation techniques to trick victims into responding to emails. To complete the attack, they often include a harmful component called a malicious payload.

Emails use a system called Multipurpose Internet Mail Extensions (MIME) to include different formats like HTML, Rich Text Format (RTF), and file attachments, which can be used to deliver these payloads.

Types of Malicious Payloads

1. Exploit

   • The email contains scripts or objects that take advantage of weaknesses in the email client (like how it handles RTF, HTML messages, image files, or S/MIME signatures).

   • Sometimes these can activate just by previewing the email.

   • To prevent this, it’s important to keep email software updated with the latest security patches.

2. Attachment

   • The email includes a file attachment designed to trick the user into opening or running it.

   • Attackers often disguise harmful attachments using file formatting tricks to make them appear harmless.

To trick you into clicking or opening something harmful, emails can contain hidden code or dangerous files.

• Hidden Code (Exploits): This code can be cleverly disguised within the email itself (like in the text or images). It might try to take advantage of weaknesses in your email software to infect your computer.

  • Danger: Even just previewing the email can sometimes activate this hidden code.

  • Protection: Keep your email software and computer updated with the latest security patches.

• Dangerous Files (Attachments): These are files attached to the email. They might look harmless (like a document or image), but they could actually contain viruses or other malware.

Email Signature Blocks

• A missing or weird signature: If an email you receive from someone you know lacks a signature or has a strange signature, it could be a fake email.

• Sophisticated fakes: In some cases, attackers might steal a company’s signature style to make fake emails look more believable. These fake signatures might contain harmful links or incorrect contact information.

Email Server Security

• Stopping fake senders: To prevent fake emails, many email servers use special records on the internet (called DNS records) to verify that the sender is actually allowed to send emails for that company.

In simpler terms:

Think of an email signature like your digital business card. It tells people who you are and how to contact you. If an email from someone you know is missing a signature or has a strange one, it might be a fake.

To help stop fake emails, many companies use special security measures to make sure only authorized servers can send emails from their domain. This helps prevent attackers from sending fake emails that appear to be from the company.

SPF (Sender Policy Framework):

SPF (Sender Policy Framework) is like a digital gatekeeper for emails. It’s a system that helps prevent fake emails (spoofing) by verifying that the email actually came from the sender it claims to be.

Here’s how it works:

• A company creates an SPF record: This record lists all the servers that are allowed to send emails on behalf of their domain. Think of it like a list of approved senders.

• The record is published: This list is publicly available on the internet through the Domain Name System (DNS).

• Receiving servers check the record: When you receive an email, your email server checks the SPF record of the sender’s domain. If the email came from one of the approved servers listed in the record, it’s likely legitimate. If not, the server can take action, such as rejecting the email or marking it as suspicious.

DomainKeys Identified Mail (DKIM):

Imagine you want to send a secure message to a friend. With DKIM, you:

1. Create a secret code (private key): Only you know this code.

2. Share a public version of the code (public key): You publish this publicly so your friend can verify your messages.

3. Sign your message: You use your secret code to create a unique digital signature for your message. This signature is like a special seal that proves you sent the message.

4. Send the message: You include your signature with the message.

5. Your friend verifies the signature: Your friend uses your public code to check if your signature is valid. If it matches, they know the message truly came from you.

DKIM in email:

• Email servers use this system to verify the authenticity of emails.

• Companies publish their public keys in a special online directory (DNS).

• When you send an email, your email server signs it with its secret key.

• Receiving email servers check the signature using the company’s public key.

• If the signature matches, the receiving server knows the email likely came from the company it claims to be from.

Benefits of DKIM:

• Helps prevent spam and phishing: By verifying the sender’s identity, DKIM makes it harder for attackers to send fake emails.

• Improves email deliverability: Emails with valid DKIM signatures are more likely to reach their intended recipients.

In essence, DKIM adds a layer of trust to emails, making them more secure and reliable.

DMARC (Domain-Based Message Authentication, Reporting, and Conformance):

DMARC (Domain-Based Message Authentication, Reporting, and Conformance) is like a security guard for your email domain. It helps prevent attackers from sending fake emails that appear to be from you or your company.

Here’s how it works:

• Building on existing security: DMARC works together with two other email authentication protocols:

  • SPF (Sender Policy Framework): Verifies that emails claiming to be from your domain were actually sent by servers authorized to do so.

  • DKIM (DomainKeys Identified Mail): Digitally signs emails to prove their authenticity.

• Setting the rules: You create a DMARC record for your domain, which is like a set of instructions for how to handle emails that fail authentication checks.

  • You can choose to:

    • Flag: Mark suspicious emails.

    • Quarantine: Move suspicious emails to your spam folder.

    • Reject: Block suspicious emails completely.

• Getting reports: DMARC allows you to receive reports from other email providers about emails that failed authentication checks. This helps you identify and address any issues with your email setup.

In simpler terms:

Imagine you’re a business owner. DMARC is like installing a security system for your company’s email. It helps prevent scammers from sending fake emails that appear to be from your company, which can protect your customers and your brand reputation.

By implementing DMARC, you can significantly reduce the risk of phishing attacks, improve your email deliverability, and enhance your overall email security posture.

Cousin Domains

Cousin domains are look-alike domain names that closely resemble an organization’s real domain. These domains are often used in phishing attacks to trick recipients into thinking the email is legitimate.

Even though email authentication protocols like SPF, DKIM, and DMARC can protect against spoofing, they cannot prevent attacks using cousin domains. For example:

• A real email might come from support@realcompany.serviceprovider.com.

• A phishing email might use a similar address like support@reelcompany.serviceprovider.com or support@realcompany.srviceprovider.com to deceive recipients.

Phishers often exploit hosted email services commonly used for marketing, customer service, or support, making these attacks harder to detect.

SMTP Log Analysis

When investigating email abuse, analyzing SMTP logs can provide valuable insights. These logs record the communication between email servers. Key details include:

• Time of Request/Response: The time when the local SMTP server communicates with the remote SMTP server.

• Recipient Address: The email address the message is being sent to.

• Message Size: The size of the email being sent.

Additionally, status codes in the logs show whether the remote server accepted or rejected a request:

• Example: A 220 status code means the remote server is ready to communicate.

By carefully reviewing these logs, administrators can identify suspicious activity and investigate potential email abuse.

Email Message Security and Digital Signatures

While server security and email authentication help prevent account compromises and email spoofing, message authentication and confidentiality are still essential in many cases. One way to achieve this is through Secure/Multipurpose Internet Mail Extensions (S/MIME).

What is S/MIME?

S/MIME is a technology used to:

• Add digital signatures to emails for authentication.

• Encrypt email contents for confidentiality (optional).

How Does S/MIME Work?

1. Digital Certificate:

   • Each user receives a digital certificate containing their public key.

   • This certificate is signed by a Certificate Authority (CA) to prove its validity.

2. Key Pair:

   • The public key is paired with a private key.

   • The private key must be kept secret by the user.

3. Secure Email Exchange:

   • Both users must enable S/MIME.

   • They exchange their certificates to establish a secure communication channel.