Email spoofing explained

Email spoofing is the creation of email messages with a forged sender address.^[1] The term applies to email purporting to be from an address which is not actually the sender's; mail sent in reply to that address may bounce or be delivered to an unrelated party whose identity has been faked. Disposable email address or "masked" email is a different topic, providing a masked email address that is not the user's normal address, which is not disclosed (for example, so that it cannot be harvested), but forwards mail sent to it to the user's real address.^[2]

The original transmission protocols used for email do not have built-in authentication methods: this deficiency allows spam and phishing emails to use spoofing in order to mislead the recipient. More recent countermeasures have made such spoofing from internet sources more difficult but they have not eliminated it completely; few internal networks have defences against a spoof email from a colleague's compromised computer on that network. Individuals and businesses deceived by spoof emails may suffer significant financial losses; in particular, spoofed emails are often used to infect computers with ransomware.

Technical details

When a Simple Mail Transfer Protocol (SMTP) email is sent, the initial connection provides two pieces of address information:

• MAIL FROM: generally presented to the recipient as the Return-path: header but not normally visible to the end user, and by default no checks are done that the sending system is authorized to send on behalf of that address.
• RCPT TO: specifies which email address the email is delivered to, is not normally visible to the end user but be present in the headers as part of the "Received:" header.

Together, these are sometimes referred to as the "envelope" addressing – an analogy to a traditional paper envelope.^[3] Unless the receiving mail server signals that it has problems with either of these items, the sending system sends the "DATA" command, and typically sends several header items, including:

• From: Joe Q Doe – the address visible to the recipient; but again, by default no checks are done that the sending system is authorized to send on behalf of that address.
• Reply-to: Jane Roe – similarly not checked
• Sender: Jin Jo – also not checked

The result is that the email recipient sees the email as having come from the address in the From: header. They may sometimes be able to find the MAIL FROM address, and if they reply to the email, it will go to either the address presented in the From: or Reply-to: header, but none of these addresses are typically reliable,^[4] so automated bounce messages may generate backscatter.

Although email spoofing is effective in forging the email address, the IP address of the computer sending the mail can generally be identified from the "Received:" lines in the email header.^[5] In malicious cases, however, this is likely to be the computer of an innocent third party infected by malware that is sending the email without the owner's knowledge.

Malicious use of spoofing

Phishing and business email compromise scams generally involve an element of email spoofing.

Email spoofing has been responsible for public incidents with serious business and financial consequences. This was the case in an October 2013 email to a news agency which was spoofed to look as if it was from the Swedish company Fingerprint Cards. The email stated that Samsung offered to purchase the company. The news spread and the stock exchange rate surged by 50%.^[6]

Malware such as Klez and Sober among many more modern examples often search for email addresses within the computer they have infected, and they use those addresses both as targets for email, and also to create credible forged From fields in the emails that they send. This is to ensure that the emails are more likely to be opened. For example:

1. Alice is sent an infected email which she opens, running the worm code.
2. The worm code searches Alice's email address book and finds the addresses of Bob and Charlie.
3. From Alice's computer, the worm sends an infected email to Bob, but is forged to appear as if it was sent by Charlie.

In this case, even if Bob's system detects the incoming mail as containing malware, he sees the source as being Charlie, even though it really came from Alice's computer. Meanwhile, Alice may remain unaware that her computer has been infected, and Charlie does not know anything about it at all, unless he receives an error message from Bob.

The effect on mail servers

Traditionally, mail servers could accept a mail item, then later send a Non-Delivery Report or "bounce" message if it could not be delivered or had been quarantined for any reason. These would be sent to the "MAIL FROM:" "Return Path" address. With the massive rise in forged addresses, best practice is now to generate NDRs for detected spam, viruses etc.^[7] but to reject the email during the SMTP transaction. When mail administrators fail to take this approach, their systems are guilty of sending "backscatter" emails to innocent parties – in itself a form of spam – or being used to perform "Joe job" attacks.

Countermeasures

The SSL/TLS system used to encrypt server-to-server email traffic can also be used to enforce authentication, but in practice it is seldom used,^[8] and a range of other potential solutions have also failed to gain traction.

A number of defensive systems have come into wide use, including:

• Sender Policy Framework (SPF) an email authentication method designed to detect forging sender addresses during the delivery of the email.^[9]

• DomainKeys Identified Mail (DKIM) an email authentication method designed to detect forged sender addresses in email (email spoofing), a technique often used in phishing and email spam.
• Domain-based Message Authentication, Reporting and Conformance (DMARC) an email authentication protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing. The purpose and primary outcome of implementing DMARC is to protect a domain from being used in business email compromise attacks, phishing emails, email scams and other cyber threat activities.

To effectively stop forged email being delivered, the sending domains, their mail servers, and the receiving system all need to be configured correctly for these higher standards of authentication. Although their use is increasing, estimates vary widely as to what percentage of emails have no form of domain authentication: from 8.6%^[10] to "almost half".^{[11] [12] [13]} For this reason, receiving mail systems typically have a range of settings to configure how they treat poorly-configured domains or email.^{[14] [15]}

While there has been research into improving email security, little emphasis has been placed on informing users whose email addresses have been used for spoofing. Currently, only the email recipient can identify a fake email, and users whose addresses are spoofed remain unaware unless the recipient manually scrutinizes the message.

Business email

Business email compromise attacks are a class of cyber crime which use email fraud to attack organizations. Examples include invoice scams and spear-phishing attacks which are designed to gather data for other criminal activities. A business deceived by an email spoof can suffer additional financial, business continuity and reputational damage. Fake emails can also be used to spread malware.

Typically, an attack targets specific employee roles within an organization by sending spoof emails which fraudulently represent a senior colleague, trusted customer, or supplier.^[16] (This type of attack is known as spear phishing). The email will issue instructions, such as approving payments or releasing client data. The emails often use social engineering to trick the victim into making money transfers to the bank account of the fraudster.^[17]

The United States' Federal Bureau of Investigation recorded $26billion of US and international losses associated with BEC attacks between June 2016 and July 2019.^[18] More recent figures estimate losses of over $50billion from 2013 to 2022.^[19]

Incidents

• Dublin Zoo lost €130,000 in such a scam in 2017 – a total of €500,000 was taken, though most was recovered.^[20]
• The Austrian aerospace firm FACC AG was defrauded of €42million ($47million) through an attack in February 2016 – and subsequently fired both the CFO and CEO.^[21]
• Te Wananga o Aotearoa in New Zealand was defrauded of $120,000 (NZD).^[22]
• The New Zealand Fire Service was scammed out of $52,000 in 2015.^[23]
• Ubiquiti Networks lost $46.7million through such a scam in 2015.^[24]
• Save the Children USA was the victim of a $1million cyberscam in 2017.^[25]
• Australian organisations that reported business email compromise attacks on the Australian Competition and Consumer Commission^[26] suffered approximately $2,800,000 (AUD) in financial losses for the 2018 year.^[27]
• In 2013, Evaldas Rimasauskas and his employees sent thousands of fraud emails to get access to companies' email systems.^[28]

See also

• • • • • • that may be compromised

External links

• Web site: 2002 Tech Tip: Spoofed/Forged Email . SEI Digital Library . Carnegie Mellon University . 2002-01-01 . 2019-12-19.

Notes and References

1. Varshney . Gaurav . Misra . Manoj . Atrey . Pradeep K. . 2016-10-26 . A survey and classification of web phishing detection schemes: Phishing is a fraudulent act that is used to deceive users . Security and Communication Networks . en . 9 . 18 . 6266–6284 . 10.1002/sec.1674.
2. News: What is masked email? This new spin on an old practice supercharges your security . Yee . Alaina . PCWorld . 6 June 2022 .
3. Web site: A quick overview of SMTP . Chris . Siebenmann . University of Toronto . 2019-04-08 . 2019-04-03 . https://web.archive.org/web/20190403055256/http://utcc.utoronto.ca/usg/technotes/smtp-intro.html . live .
4. E-Mail Impersonators . Bill . Barnes . Slate . 2002-03-12 . 2019-04-08 . 2019-04-13 . https://web.archive.org/web/20190413220636/https://slate.com/technology/2002/03/e-mail-impersonator.html . live .
5. Web site: e-mail impersonators: identifying "spoofed" e-mail . dead . https://web.archive.org/web/20170621024905/http://www.wwlegal.com/posts/e-mail-impersonators-identifying-spoofed-e-mail/ . 2017-06-21 . 2019-04-08.
6. News: Fraudsters' fingerprints on fake Samsung deal . Financial Times . 11 October 2013 . subscription . 2019-04-08 . 2019-02-10 . https://web.archive.org/web/20190210050645/https://www.ft.com/content/0b972892-3259-11e3-b3a7-00144feab7de . live . Mundy . Simon .
7. See RFC3834
8. Web site: Transport Layer Security for Inbound Mail . Google Postini Services . dead . https://web.archive.org/web/20161111201117/http://www.google.com/support/enterprise/static/postini/docs/admin/en/admin_ee_cu/ib_tls_overview.html . 2016-11-11 . 2019-04-08.
9. Web site: How To use an SPF Record to Prevent Spoofing & Improve E-mail Reliability . 2019-09-23 . Pablo . Carranza . 2013-07-16 . . A carefully tailored SPF record will reduce the likelihood of your domain name getting fraudulently spoofed and keep your messages from getting flagged as spam before they reach your recipients. Email spoofing is the creation of email messages with a forged sender address; something that is simple to do because many mail servers do not perform authentication. Spam and phishing emails typically use such spoofing to mislead the recipient about the origin of the message. . https://web.archive.org/web/20150420105102/https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability . 2015-04-20 . dmy-all .
10. Web site: Internet-wide efforts to fight email phishing are working . Google Security Blog . Elie . Bursztein . Vijay . Eranti . 2013-12-06 . 2019-04-08 . 2019-04-04 . https://web.archive.org/web/20190404174412/https://security.googleblog.com/2013/12/internet-wide-efforts-to-fight-email.html . live .
11. Web site: SPF Deployment Trends . Lars . Eggert . dead . https://web.archive.org/web/20160402102130/https://eggert.org/meter/spf . 2016-04-02 . 2019-04-08.
12. Web site: DKIM Deployment Trends . Lars . Eggert . dead . https://web.archive.org/web/20180822084116/https://eggert.org/meter/dkim . 2018-08-22 . 2019-04-08.
13. Web site: In First Year, DMARC Protects 60 Percent of Global Consumer Mailboxes . dmarc.org . 2013-02-06 . 2019-04-08 . 2018-09-20 . https://web.archive.org/web/20180920111806/https://dmarc.org/press/release-20130206/ . live .
14. Web site: Prevent spoofed messages with spoofed senders detection . 2019-04-08 . 2019-03-23 . https://web.archive.org/web/20190323034441/https://support.symantec.com/en_US/article.HOWTO119230.html . live .
15. Web site: Anti-spoofing protection in Office 365 . 2019-04-08 . 2019-04-09 . https://web.archive.org/web/20190409021925/https://docs.microsoft.com/en-us/office365/securitycompliance/anti-spoofing-protection . live .
16. Web site: How to Recognize a Business Email Compromise Attack. Joan Goodchild. 20 June 2018. Security Intelligence. 11 March 2019. 23 March 2019. https://web.archive.org/web/20190323094234/https://securityintelligence.com/how-to-recognize-a-business-email-compromise-attack/. live.
17. Web site: Tips to Avoid Phishing Attacks and Social Engineering. 2020-11-17. www.bankinfosecurity.com. en. 2020-12-02. https://web.archive.org/web/20201202110123/https://www.bankinfosecurity.com/tips-to-avoid-phishing-attacks-social-engineering-a-488. live.
18. Web site: Business Email Compromise Is Extremely Costly And Increasingly Preventable . Forbes Media . 15 April 2020 . 2 December 2020 . 23 October 2021 . https://web.archive.org/web/20211023175108/https://www.forbes.com/sites/forbestechcouncil/2020/04/15/business-email-compromise-is-extremely-costly-and-increasingly-preventable/?sh=74b6086c5d36 . live .
19. Web site: Business Email Compromise: The $50Billion Scam .
20. Web site: Dublin Zoo lost €500k after falling victim to cyber-scam. 22 December 2017. 23 October 2021. 8 August 2019. https://web.archive.org/web/20190808013739/https://www.irishexaminer.com/ireland/dublin-zoo-lost-500k-after-falling-victim-to-cyber-scam-464818.html. live.
21. News: Austria's FACC, hit by cyber fraud, fires CEO . 20 December 2018 . Reuters . 26 May 2016 . 21 March 2021 . https://web.archive.org/web/20210321122533/https://www.reuters.com/article/us-facc-ceo-idUSKCN0YG0ZF . live .
22. Web site: Te Wananga o Aotearoa caught up in $120k financial scam . NZ Herald . 20 December 2018 . 20 December 2018 . https://web.archive.org/web/20181220231009/https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11563918 . live .
23. News: Fire Service scammed out of $52,000 . 20 December 2018 . RNZ News . 23 December 2015 . 20 December 2018 . https://web.archive.org/web/20181220231104/https://www.radionz.co.nz/news/national/292881/fire-service-scammed-out-of-$52,000 . live .
24. News: Hackett . Robert . Fraudsters duped this company into handing over $40million . 20 December 2018 . Fortune magazine . August 10, 2015 . 20 December 2018 . https://web.archive.org/web/20181220230315/http://fortune.com/2015/08/10/ubiquiti-networks-email-scam-40-million/ . live .
25. News: Wallack . Todd . Hackers fooled Save the Children into sending $1million to a phony account . 20 December 2018 . The Boston Globe . 13 December 2018 . 20 December 2018 . https://web.archive.org/web/20181220230447/https://www.bostonglobe.com/business/2018/12/12/hackers-fooled-save-children-into-sending-million-phony-account/KPnRi8xIbPGuhGZaFmlhRP/story.html . live .
26. https://www.scamwatch.gov.au/ Australian Competition and Consumer Commission
27. News: Powell . Dominic . Business loses $300,000 to 'spoofed' email scam: How to protect yourself from being impersonated . 14 December 2018 . Smart Company . 27 November 2018 . 27 November 2018 . https://web.archive.org/web/20181127082348/https://www.smartcompany.com.au/technology/business-email-compromise-scam/ . live .
28. Web site: Sentence in BEC Scheme. Federal Bureau of Investigation. en-us. 2020-02-01. 2020-01-31. https://web.archive.org/web/20200131150108/https://www.fbi.gov/news/stories/ringleader-of-business-email-compromise-scheme-sentenced-012820. live.