Instructor: Email indicators of compromise. 2 2
Now, email issues are on the rise year after year. 3 3
Spam and phishing are common social engineering attacks 4 4
that use email as their delivery vector. 5 5
And you've already learned about them 6 6
in your previous A+, Network+, and Security+ studies. 7 7
As a quick review, though, the definition of spam 8 8
is the unsolicited and unwanted junk email sent out in bulk 9 9
to an indiscriminate recipient list. 10 10
Now, the reason why they send things out 11 11
in this spam manner is because if you send out a wide net, 12 12
you'll catch some people, and that's the idea behind spam. 13 13
Now, this goes a step further 14 14
when you start talking about phishing. 15 15
Phishing is the fraudulent practice 16 16
of sending out emails purporting to be 17 17
from a reputable company in order to induce individuals 18 18
to reveal personal information, 19 19
such as passwords or credit card numbers. 20 20
This happens a lot as part of spam, 21 21
but with this more malicious intent, it becomes phishing. 22 22
Now, one of the big things inside of phishing 23 23
is you have to have a pretext. 24 24
Now, a pretext is a form of social engineering 25 25
in which the individual lies and provides false motive 26 26
to obtain privileged data. 27 27
You've probably seen phishing emails 28 28
that use a pretext like this one. 29 29
For instance, I am from PayPal. 30 30
Your account has been compromised. 31 31
You need to click this link to set up something 32 32
or fix something. 33 33
Or there's been this big charge that's happening. 34 34
You need to click here to verify it. 35 35
Those type of things happen. 36 36
And this is just a way of doing spam and phishing 37 37
using a pretext that is somewhat believable. 38 38
Now, if we take it a step further, 39 39
we can move into spear phishing. 40 40
Now, with spear phishing, 41 41
we're dealing with an email spoofing attack 42 42
that targets a specific organization or individual 43 43
by seeking unauthorized access to sensitive information. 44 44
For example, let's say your bank has been compromised 45 45
in the past. 46 46
Now the attackers have a list 47 47
of all the people who use that bank, 48 48
so now they can specifically target people 49 49
who are users of that bank because they know who they are. 50 50
And so they can use the pretext of being from that bank 51 51
and targeting a specific list of people 52 52
who are customers of that bank. 53 53
For instance, if you get a spear phishing email 54 54
saying there's something wrong 55 55
with your Bank of America account 56 56
and click here to log into the website to fix it, 57 57
you're more likely to do that 58 58
if you're a Bank of America customer. 59 59
I don't bank with Bank of America, 60 60
so if I got that through a generic phishing campaign, 61 61
I would just ignore it because I know it's not my bank. 62 62
That's the idea of dealing with spear phishing. 63 63
It's a little bit more targeted 64 64
than a regular phishing attack. 65 65
Now, this all relies on the concept of impersonation. 66 66
The idea with a lot of these attacks is 67 67
to try to trick you into giving us some information. 68 68
If we can get some information about you 69 69
like your name, your email, password, your login, 70 70
things like that, we can then use it to impersonate you. 71 71
And when we deal with impersonation, this is an attack 72 72
in which an adversary successfully assumes the identity 73 73
of one of the legitimate parties in a system 74 74
or in a communications protocol. 75 75
So for example, if I have figured out a particular person 76 76
who works at your company 77 77
and I can send out emails pretending to be them, 78 78
I can impersonate them and get you to do things for me. 79 79
When an attacker does this, 80 80
it's usually part of a business email compromise, or a BEC. 81 81
Now, when you're dealing with a business email compromise, 82 82
this is an impersonation attack 83 83
in which the attacker gains control of an employee's account 84 84
and then uses it to convince other employees 85 85
to perform fraudulent actions. 86 86
For example, if somebody used a phishing 87 87
or a spear phishing campaign to trick one of my employees 88 88
to click the link and take over their account, 89 89
now they can send emails as if they're one of my employees. 90 90
And if they send me an email 91 91
as if they're one of my employees 92 92
from that employee's account saying, 93 93
"Hey, you need to release funds to pay XYZ vendor," 94 94
if I'm not careful, I could say, "Okay," 95 95
and I can send the money to that vendor. 96 96
Well, that vendor isn't really a vendor. 97 97
It's one of their friends who we've now sent that money to. 98 98
And this is the whole idea with a business email compromise. 99 99
Now, another way this is done is by using email spoofing. 100 100
Now, with email spoofing, 101 101
you can actually send out the message 102 102
and make it look like it's coming from a particular person. 103 103
So again, if I was able to use social engineering 104 104
and gather information 105 105
and I know who your chief financial officer is, 106 106
I know what their email address is, 107 107
I know what their name is, 108 108
I might even have some of their emails in the past 109 109
so I can mimic their writing style, 110 110
I can then spoof you and make you think 111 111
that I am your chief financial officer as an attacker 112 112
and tell you you need to send a payment 113 113
from one place to another 114 114
and give you the routing information. 115 115
And you would fall for it, right? 116 116
Especially if you're not careful in verifying 117 117
whether or not that email really came from them. 118 118
Now, there's a couple of ways 119 119
that this email spoofing can occur. 120 120
One of the most common, though, 121 121
is what's known as forwarding. 122 122
When you're dealing with forwarding, 123 123
a phishing email is going to be formatted 124 124
so it appears to have come as part of a reply or a chain. 125 125
So for example, if I know somebody who works in your office 126 126
who may not be the CFO. 127 127
Let's say it's not the head person, 128 128
but instead it's their assistant. 129 129
I can then forward the email saying, from the CFO, 130 130
they said transfer money from X account to Y account. 131 131
Regards, this assistant. 132 132
And then have the forward chain below that 133 133
that looks like it came from the CFO. 134 134
Well, whether it did or not, if it looked like it, 135 135
you may fall for that. 136 136
And that's the idea of forwarding, 137 137
where you basically can compromise a lower-level employee 138 138
and then forward the email 139 139
of what is supposedly a higher-level employee 140 140
to get people to do what you want. 141 141
Now, many spoofing attempts can be detected 142 142
by a close examination of the internet headers 143 143
that are attached to a message. 144 144
When you open up an email, 145 145
there is this hidden header that you really don't see. 146 146
If you use Gmail, for example, 147 147
at the top you'll see the to line, 148 148
the CC line, the from line, and the subject line, 149 149
but there is a lot more to it than that, 150 150
and this is all what we call 151 151
the email message internet header. 152 152
And we're going to talk about that in the next lesson 153 153
and how to analyze those.