Jason: Email Content Analysis. 2 2
Now, for an attacker to send something malicious, 3 3
they first have to do some things. 4 4
And the first thing they have to do is they have to craft 5 5
some sort of payload to complete the exploit 6 6
when the victim actually opens that message. 7 7
Now, how do they do that? 8 8
Well, they use something called MIME. 9 9
MIME is the Multipurpose Internet Mail Extensions. 10 10
And this is not something malicious in its own right. 11 11
This is actually something that allows a body of an email 12 12
to support different formats, such as HTML, 13 13
rich text format, binary data encoded 14 14
as Base64 ASCII characters, and attachments. 15 15
All of these are not things that are bad by themselves, 16 16
but they could be made bad 17 17
and turned into a malicious payload. 18 18
For example, when you send me an email 19 19
and you want to bold something or italicize something 20 20
or add a picture to it, 21 21
that's all done using MIME 22 22
and there's nothing wrong with that. 23 23
But if you add a malicious payload, 24 24
which is an exploit or an attachment 25 25
that contains some sort of malicious code implemented 26 26
within the message body, 27 27
then you have now turned MIME into something bad. 28 28
Now, notice here, there are two different types 29 29
of malicious payloads. 30 30
It can be an exploit or it can be an attachment. 31 31
Let's take a look at each of these. 32 32
First, we have an exploit. 33 33
Now, an exploit is any kind of message data 34 34
that contains scripts or objects 35 35
that target some vulnerability inside the message client. 36 36
Now, in this case, 37 37
you can actually have when the email program opens up 38 38
the client preview, it executes some kind of code. 39 39
Like I said, MIME does support HTML, 40 40
which means it also supports JavaScript 41 41
and other things like that. 42 42
And so you can write an exploit in one of those languages 43 43
that would then get read by the client 44 44
when it goes to preview it inside the browser 45 45
and then exploit your machine. 46 46
Now, alternatively, you can use an attachment. 47 47
Now, an attachment is a little bit more 48 48
of your standard type of malware, right? 49 49
This is going to be a message that contains a file attachment 50 50
in the hope that the user will actually open 51 51
or execute that file. 52 52
And that file might be a virus, a worm, or something else. 53 53
It's some kind of malware that's been attached 54 54
to this email. 55 55
Now, as users have gotten smarter over the years, 56 56
they're less likely to open attachments 57 57
from people they don't know. 58 58
But a lot of people will still click links they don't know. 59 59
And that's why people start using embedded links. 60 60
Embedded links are any links that can be comprised 61 61
of a friendly string plus the URL 62 62
or a shortened URL to hide the identity of the real target. 63 63
For example, if you see a link in your email, 64 64
you should never click that link directly. 65 65
Instead, you should copy that link, 66 66
paste it into a web browser, 67 67
and then, based on that, 68 68
you can determine once you've read the whole thing 69 69
whether or not you should hit Enter 70 70
and go into that thing. 71 71
Because, for instance, here in my signature block, 72 72
you can see I have www.DionTraining.com. 73 73
Now, that's what the display text is showing you, 74 74
but the link underneath it may or may not actually go there. 75 75
I could actually have the link underneath it going to 76 76
badguysite.malware or whatever I want it to. 77 77
You don't really know 'cause all you're seeing 78 78
is what is displayed. 79 79
So if you wanted to click on that link, 80 80
it would be better for you to go to DionTraining.com 81 81
and hit Enter in your web browser 82 82
or copying the text of that and not the link 83 83
and then being able to go there. 84 84
Now, another thing I want to talk about 85 85
as you're looking at my signature block here 86 86
is the concept of email signature blocks. 87 87
When you see the email signature block, 88 88
you can actually use this as a clue 89 89
as to whether or not that message is valid, 90 90
if it's phishing, or if it's something malicious. 91 91
Now, how do you do that? 92 92
Well, if you see a missing or poorly formatted 93 93
email signature block, 94 94
this could be an indicator of a phishing message. 95 95
If everybody in your company uses the exact same format 96 96
on their signature block, 97 97
and then somebody sends you something 98 98
that looks like it's from your company 99 99
but it doesn't have that signature block, 100 100
that's an indicator that that is not coming 101 101
from within your company. 102 102
These are just some of the hints and tricks 103 103
that you can look at as you're doing some 104 104
of the basic analysis on the content of your emails.