1 1 00:00:00,540 --> 00:00:02,850 Email Content Analysis. 2 2 00:00:02,850 --> 00:00:05,040 Now, for an attacker to send something malicious, 3 3 00:00:05,040 --> 00:00:06,750 they first have to do some things. 4 4 00:00:06,750 --> 00:00:09,030 And the first thing they have to do is they have to craft 5 5 00:00:09,030 --> 00:00:11,790 some sort of payload to complete the exploit 6 6 00:00:11,790 --> 00:00:14,280 when the victim actually opens that message. 7 7 00:00:14,280 --> 00:00:15,750 Now, how do they do that? 8 8 00:00:15,750 --> 00:00:17,940 Well, they use something called MIME. 9 9 00:00:17,940 --> 00:00:21,180 MIME is the Multipurpose Internet Mail Extensions. 10 10 00:00:21,180 --> 00:00:23,400 And this is not something malicious in its own right. 11 11 00:00:23,400 --> 00:00:25,740 This is actually something that allows a body of an email 12 12 00:00:25,740 --> 00:00:28,710 to support different formats, such as HTML, 13 13 00:00:28,710 --> 00:00:31,260 rich text format, binary data encoded 14 14 00:00:31,260 --> 00:00:34,470 as Base64 ASCII characters, and attachments. 15 15 00:00:34,470 --> 00:00:37,380 All of these are not things that are bad by themselves, 16 16 00:00:37,380 --> 00:00:39,210 but they could be made bad 17 17 00:00:39,210 --> 00:00:41,160 and turned into a malicious payload. 18 18 00:00:41,160 --> 00:00:43,350 For example, when you send me an email 19 19 00:00:43,350 --> 00:00:45,870 and you want to bold something or italicize something 20 20 00:00:45,870 --> 00:00:47,400 or add a picture to it, 21 21 00:00:47,400 --> 00:00:48,990 that's all done using MIME 22 22 00:00:48,990 --> 00:00:50,340 and there's nothing wrong with that. 23 23 00:00:50,340 --> 00:00:52,230 But if you add a malicious payload, 24 24 00:00:52,230 --> 00:00:53,850 which is an exploit or an attachment 25 25 00:00:53,850 --> 00:00:56,340 that contains some sort of malicious code implemented 26 26 00:00:56,340 --> 00:00:57,900 within the message body, 27 27 00:00:57,900 --> 00:01:00,630 then you have now turned MIME into something bad. 28 28 00:01:00,630 --> 00:01:02,580 Now, notice here, there are two different types 29 29 00:01:02,580 --> 00:01:03,840 of malicious payloads. 30 30 00:01:03,840 --> 00:01:06,210 It can be an exploit or it can be an attachment. 31 31 00:01:06,210 --> 00:01:07,740 Let's take a look at each of these. 32 32 00:01:07,740 --> 00:01:09,390 First, we have an exploit. 33 33 00:01:09,390 --> 00:01:11,460 Now, an exploit is any kind of message data 34 34 00:01:11,460 --> 00:01:13,140 that contains scripts or objects 35 35 00:01:13,140 --> 00:01:16,500 that target some vulnerability inside the message client. 36 36 00:01:16,500 --> 00:01:17,640 Now, in this case, 37 37 00:01:17,640 --> 00:01:20,130 you can actually have when the email program opens up 38 38 00:01:20,130 --> 00:01:23,220 the client preview, it executes some kind of code. 39 39 00:01:23,220 --> 00:01:25,470 Like I said, MIME does support HTML, 40 40 00:01:25,470 --> 00:01:27,270 which means it also supports JavaScript 41 41 00:01:27,270 --> 00:01:28,650 and other things like that. 42 42 00:01:28,650 --> 00:01:31,020 And so you can write an exploit in one of those languages 43 43 00:01:31,020 --> 00:01:32,370 that would then get read by the client 44 44 00:01:32,370 --> 00:01:34,620 when it goes to preview it inside the browser 45 45 00:01:34,620 --> 00:01:36,570 and then exploit your machine. 46 46 00:01:36,570 --> 00:01:38,880 Now, alternatively, you can use an attachment. 47 47 00:01:38,880 --> 00:01:40,260 Now, an attachment is a little bit more 48 48 00:01:40,260 --> 00:01:42,420 of your standard type of malware, right? 49 49 00:01:42,420 --> 00:01:45,210 This is going to be a message that contains a file attachment 50 50 00:01:45,210 --> 00:01:46,890 in the hope that the user will actually open 51 51 00:01:46,890 --> 00:01:48,360 or execute that file. 52 52 00:01:48,360 --> 00:01:51,510 And that file might be a virus, a worm, or something else. 53 53 00:01:51,510 --> 00:01:53,520 It's some kind of malware that's been attached 54 54 00:01:53,520 --> 00:01:54,750 to this email. 55 55 00:01:54,750 --> 00:01:56,970 Now, as users have gotten smarter over the years, 56 56 00:01:56,970 --> 00:01:58,530 they're less likely to open attachments 57 57 00:01:58,530 --> 00:01:59,850 from people they don't know. 58 58 00:01:59,850 --> 00:02:02,220 But a lot of people will still click links they don't know. 59 59 00:02:02,220 --> 00:02:04,770 And that's why people start using embedded links. 60 60 00:02:04,770 --> 00:02:07,530 Embedded links are any links that can be comprised 61 61 00:02:07,530 --> 00:02:09,870 of a friendly string plus the URL 62 62 00:02:09,870 --> 00:02:13,380 or a shortened URL to hide the identity of the real target. 63 63 00:02:13,380 --> 00:02:16,230 For example, if you see a link in your email, 64 64 00:02:16,230 --> 00:02:18,570 you should never click that link directly. 65 65 00:02:18,570 --> 00:02:20,970 Instead, you should copy that link, 66 66 00:02:20,970 --> 00:02:22,680 paste it into a web browser, 67 67 00:02:22,680 --> 00:02:24,270 and then, based on that, 68 68 00:02:24,270 --> 00:02:26,490 you can determine once you've read the whole thing 69 69 00:02:26,490 --> 00:02:28,110 whether or not you should hit Enter 70 70 00:02:28,110 --> 00:02:29,340 and go into that thing. 71 71 00:02:29,340 --> 00:02:31,920 Because, for instance, here in my signature block, 72 72 00:02:31,920 --> 00:02:35,520 you can see I have www.DionTraining.com. 73 73 00:02:35,520 --> 00:02:37,950 Now, that's what the display text is showing you, 74 74 00:02:37,950 --> 00:02:41,670 but the link underneath it may or may not actually go there. 75 75 00:02:41,670 --> 00:02:43,576 I could actually have the link underneath it going to 76 76 00:02:43,576 --> 00:02:46,830 badguysite.malware or whatever I want it to. 77 77 00:02:46,830 --> 00:02:48,180 You don't really know 'cause all you're seeing 78 78 00:02:48,180 --> 00:02:49,290 is what is displayed. 79 79 00:02:49,290 --> 00:02:50,700 So if you wanted to click on that link, 80 80 00:02:50,700 --> 00:02:53,130 it would be better for you to go to DionTraining.com 81 81 00:02:53,130 --> 00:02:54,870 and hit Enter in your web browser 82 82 00:02:54,870 --> 00:02:57,570 or copying the text of that and not the link 83 83 00:02:57,570 --> 00:02:59,220 and then being able to go there. 84 84 00:02:59,220 --> 00:03:00,300 Now, another thing I want to talk about 85 85 00:03:00,300 --> 00:03:01,710 as you're looking at my signature block here 86 86 00:03:01,710 --> 00:03:04,290 is the concept of email signature blocks. 87 87 00:03:04,290 --> 00:03:05,880 When you see the email signature block, 88 88 00:03:05,880 --> 00:03:07,200 you can actually use this as a clue 89 89 00:03:07,200 --> 00:03:09,480 as to whether or not that message is valid, 90 90 00:03:09,480 --> 00:03:12,000 if it's phishing, or if it's something malicious. 91 91 00:03:12,000 --> 00:03:13,200 Now, how do you do that? 92 92 00:03:13,200 --> 00:03:15,720 Well, if you see a missing or poorly formatted 93 93 00:03:15,720 --> 00:03:16,860 email signature block, 94 94 00:03:16,860 --> 00:03:19,410 this could be an indicator of a phishing message. 95 95 00:03:19,410 --> 00:03:21,840 If everybody in your company uses the exact same format 96 96 00:03:21,840 --> 00:03:23,010 on their signature block, 97 97 00:03:23,010 --> 00:03:24,060 and then somebody sends you something 98 98 00:03:24,060 --> 00:03:25,290 that looks like it's from your company 99 99 00:03:25,290 --> 00:03:27,060 but it doesn't have that signature block, 100 100 00:03:27,060 --> 00:03:28,800 that's an indicator that that is not coming 101 101 00:03:28,800 --> 00:03:30,090 from within your company. 102 102 00:03:30,090 --> 00:03:31,590 These are just some of the hints and tricks 103 103 00:03:31,590 --> 00:03:33,000 that you can look at as you're doing some 104 104 00:03:33,000 --> 00:03:35,823 of the basic analysis on the content of your emails.