Email spoofing is a technique to trick users into thinking a message came from a trustworthy source.
Email spoofing is made possible by the message structure and lack of verification of control headers in the dominant mail protocol — SMTP.
An email message consists of the following structural elements:
- SMTP envelope. This element contains the real sender and recipient addresses. It is not displayed in mail clients.
- Headers. These give information about the sender, recipient, date and subject of the message, and are displayed in mail clients. There are two main headers that can contain the sender’s address:
- From — this field contains the sender’s name and the address from which the message was sent. Some mail clients show only the name by default, which must be clicked to see the address.
- Reply-to — this field contains the address to which replies will be sent. It may differ from the sender’s address. Most mail clients do not show this address by default, but do allow you to customize its display.
- Message body. This is the content of the message: text, attachments, etc.
Ways to spoof the sender’s address
There are several kinds of email spoofing.
Lookalike domain. The headers display the real sender’s address, which is similar to the address of the organization that the cybercriminals are imitating. To mimic another’s address (for example, email@example.com), attackers can use:
- A top-level domain with a spelling similar to the original. For example, firstname.lastname@example.org.
- A .com second-level domain with a country-code top-level domain. For example, email@example.com.
- A second-level domain that differs from the organization’s real domain by one or two characters. For example, info@exampIe.com with an uppercase i instead of a lowercase L.
- A second-level domain that evokes associations with the company being imitated. For example, firstname.lastname@example.org.
- The name of the company being imitated as the mailbox name. The mailbox itself is located in a public domain. For example, email@example.com.
Spoofing the sender’s name. In this case, the From and Reply-to headers contain the real address of the attackers, while the sender’s name is faked. This type of spoofing is effective in mail clients that display only the name by default, such as mobile ones.
As the sender’s name attackers can specify:
- Only a fake name (title, position). In this case, the From field will look something like Bob <firstname.lastname@example.org>.
- A fake name with a fake email address. This technique is known as ghost spoofing. In this case, the From field will look something like Bob <email@example.com> <firstname.lastname@example.org>.
Changing the From and Reply-to fields. Since SMTP does not verify the content of headers in any way, an attacker can spoof not only the sender’s name, but also the email addresses in the From and Reply-to fields. In this case, it is almost impossible for the recipient to distinguish a fake email from a genuine one.
Email spoofing in practice
Email spoofing has both legitimate and malicious applications. Legitimate spoofing is used:
- When a company hires external contractors for certain tasks, but their emails must appear to clients as if from the company’s address.
- When a company does not want to disclose the addresses of specific employees who correspond with clients through an alias, such as email@example.com.
With legitimate email spoofing, the From and Reply-to headers are changed completely.
Malicious purposes include:
- Spam. Cybercriminals send messages in the name of well-known companies or contacts of the recipient.
- Phishing. Attackers fake the email addresses of services to lure the victim to visit a phishing site and enter their account credentials.
- Business email compromise (BEC). Cybercriminals pretend to be employees, clients, partners, or contractors of the company to get real employees to transfer money to them or give out confidential information.
- Extortion. Fraudsters send the victim an email seemingly from the latter’s own address, claiming to have hacked their mail account, and demand a ransom to restore access or blackmail them with private information allegedly stolen as a result of the hack.
Protection against email spoofing
To protect against corporate-level email spoofing, a set of technologies that cover vulnerabilities in the SMTP protocol exist:
- Sender Police Framework (SPF) checks the authenticity of the mail server from which the message arrived.
- DomainKeys Identified Mail (DKIM) uses a digital signature to protect messages from forgery.
- Domain-based Message Authentication, Reporting and Conformance (DMARC) is used to manage and enhance SPF and DKIM.
The downside of these security technologies is that they are not used by all companies. To guarantee authentication, the technology must be supported by both the sender and the recipient. Nevertheless, a company that has implemented SPF, DKIM, and/or DMARC can at least protect internal correspondence from spoofing.
Spoofing ya barua pepe ni mbinu ya kudanganya watumiaji kufikiri ujumbe ulitoka kwa chanzo cha kuaminika. Spoofing barua pepe ni kufanywa inawezekana na ujumbe muundo na ukosefu wa uthibitisho wa vichwa vya udhibiti katika protocol mail kutawala <unk> SMTP. Ujumbe wa barua pepe inajumuisha vipengele vifuatavyo vya muundo: - SMTP bahasha. Kipengele hiki ina sender halisi na mpokeaji anwani. Ni si kuonyeshwa katika wateja wa barua pepe. - Vichwa vya habari. Hizi kutoa habari kuhusu mtumaji, mpokeaji, tarehe na mada ya ujumbe, na ni kuonyeshwa katika wateja wa barua. Kuna vichwa viwili kuu ambayo inaweza kuwa na anwani ya mtumaji: - Kutoka <unk> uwanja huu ina jina la mtumaji na anwani ambayo ujumbe ulitumwa. Baadhi ya wateja wa barua kuonyesha tu jina kwa default, ambayo lazima bonyeza kuona anwani. - Jibu-kwa <unk> uwanja huu ina anwani ambayo majibu itakuwa kutumwa. Inaweza kutofautiana na anwani ya mtumaji. Wengi barua wateja si kuonyesha anwani hii kwa default, lakini kufanya kuruhusu wewe kubadili maonyesho yake. - Mwili wa ujumbe. Hii ni maudhui ya ujumbe: maandishi, viambatisho, nk. Njia za kuigiza anwani ya mtumaji Kuna aina kadhaa za kuigiza barua pepe. Eneo la kufanana. Vichwa vya habari huonyesha anwani halisi ya mtumaji, ambayo ni sawa na anwani ya shirika ambalo wahalifu wa mtandao wanaiga. Kuiga anwani ya mwingine (kwa mfano, email@example.com), washambuliaji wanaweza kutumia: - Domain ya ngazi ya juu na spelling sawa na ya awali. Kwa mfano, jina la kwanza. jina la mwisho@example.org. - A.com uwanja wa ngazi ya pili na nchi-nambari ya ngazi ya juu ya uwanja. Kwa mfano, email@example.com. - Domain ya ngazi ya pili ambayo inatofautiana na shirika la kweli domain na moja au herufi mbili. Kwa mfano, info@example.com na i kubwa badala ya L ndogo - Domain ya ngazi ya pili ambayo inatoa ushirika na kampuni inayoigwa. Kwa mfano, jina la kwanza. jina la mwisho@example.org. - Jina la kampuni kuwa kuigwa kama jina sanduku la barua. Sanduku la barua lenyewe liko katika uwanja wa umma. Kwa mfano, email@example.com. Kupotosha jina la mtumaji. Katika kesi hii, kutoka na kujibu-kwa vichwa vyenye anwani halisi ya washambuliaji, wakati jina la mtumaji ni bandia. Aina hii ya spoofing ni ufanisi katika wateja wa barua ambayo kuonyesha tu jina kwa default, kama vile wale simu. Kama jina la mtumaji washambuliaji wanaweza kutaja: - Tu jina bandia (cheo, nafasi). Katika kesi hii, kutoka uwanja itakuwa kuangalia kitu kama Bob <firstname.lastname@example.org>. - Jina bandia na anwani bandia ya barua pepe. Mbinu hiyo inaitwa kuigiza roho. Katika kesi hii, kutoka uwanja itakuwa kuangalia kitu kama Bob <email@example.com> <firstname.lastname@example.org>. Kubadilisha kutoka na kujibu-kwa mashamba. Kwa kuwa SMTP haithibitishi yaliyomo ya vichwa kwa njia yoyote, mshambuliaji anaweza kudanganya sio tu jina la mtumaji, lakini pia anwani za barua pepe katika mashamba ya Kutoka na Jibu-kwa. Katika hali hii, ni vigumu kwa mpokeaji kutofautisha barua pepe bandia na moja halisi. Spoofing ya barua pepe katika mazoezi Spoofing ya barua pepe ina matumizi halali na mabaya. Spoofing halali hutumiwa: - Wakati kampuni inaajiri wakandarasi wa nje kwa kazi fulani, lakini barua pepe zao lazima zionekane kwa wateja kama kutoka kwa anwani ya kampuni. Kampuni ya barua pepe inaweza kuwa na haki ya kutoa anwani za wafanyikazi wa kampuni inayohusiana na wateja kupitia jina bandia kama vile email@example.com. Pamoja na halali barua pepe spoofing, kutoka na kujibu-kwa vichwa ni iliyopita kabisa. Malice madhumuni ni pamoja na: - Spam. Wahalifu wa kompyuta hutuma ujumbe kwa jina la makampuni yanayojulikana au mawasiliano ya mpokeaji. - Ulaghai. Washambuliaji huigiza anwani za barua pepe za huduma ili kumshawishi mhasiriwa kutembelea tovuti ya udanganyifu na kuingia sifa za akaunti yao. - Uharibifu wa barua pepe ya biashara (BEC). Wahalifu wa mtandao hujifanya kuwa wafanyikazi, wateja, washirika, au wakandarasi wa kampuni ili kupata wafanyikazi halisi kuhamisha pesa kwao au kutoa habari za siri. - Unyanyasaji. Watapeli hutuma barua pepe kwa mhasiriwa, inaonekana kutoka kwa anwani yake mwenyewe, wakidai kuwa wamevunja akaunti yao ya barua pepe, na kudai fidia ili kurudisha ufikiaji au kuwatisha kwa habari za kibinafsi zinazodaiwa kuibiwa kama matokeo ya hack. Ulinzi dhidi ya spoofing ya barua pepe: Ili kulinda dhidi ya spoofing ya barua pepe ya kiwango cha ushirika, seti ya teknolojia zinazofunika udhaifu katika itifaki ya SMTP zipo: Sender Police Framework (SPF) inachunguza uhalali wa seva ya barua pepe ambayo ujumbe ulifika. DomainKeys Identified Mail (DKIM) hutumia saini ya dijiti kulinda ujumbe kutoka kwa udanganyifu. Domain-msingi Uhakika Ujumbe, Ripoti na Upatano (DMARC) ni kutumika kwa kusimamia na kuboresha SPF na DKIM. Hasara ya teknolojia hizi za usalama ni kwamba hazitumiwi na makampuni yote. Ili kuhakikisha uthibitisho, teknolojia lazima kuungwa mkono na wote mtumaji na mpokeaji. Hata hivyo, kampuni ambayo imetekeleza SPF, DKIM, na au DMARC inaweza angalau kulinda mawasiliano ya ndani kutoka spoofing.