21

In the past day or so, I've received two emails from different .gov addresses that purport to be from Intuit and encourage me to click on a link to "restore access to your QuickBooks account." They aren't pretending to be government addresses. If I click reply, the mail-to field says [email protected], just as the email states in the From section.

I have forwarded these emails to the FTC's recommended address for phishing scams, but I'd like to let the agencies involved know that they have compromised accounts. Is there an easy way to do that? I looked on the website of one agency, but there wasn't any contact that seemed right (Texas agriculture.gov).

Would emailing that person (at the compromised address) directly be useful? I don't want to spend all day on this, since I'm working. I just want to give someone a heads up. I was hoping there was a "report misused government email" contact box somewhere, but I can't find anything like that.

Improve this question
6
  • 29
    The email showing up in the from field when you hit reply does not mean that the address is not spoofed. So I would not be so sure that the account is actually compromised.
    – Anders
    Commented Jul 20, 2016 at 12:45
  • 22
    "If I click reply, the mail-to field says [email protected], just as the email states in the From section." That you think this is significant means you have some gaps in your understanding of how email works. The reply button relies on the headers (there are several other headers other than From that it may use, but none of them are any more protected from being faked.)
    – Random832
    Commented Jul 20, 2016 at 19:20
  • “Would emailing that person (at the compromised address) directly be useful?” The whole premise of this assumption is wrong. You are assuming an email with a legitimate sounding email address is legitimate. What’s more likely is your own emails SPAM filter didn’t detect these emails as such. Contacting the email address you believe these messages were sent from will only confuse the person on the other side, waste their time and not stop—or discourage—whoever is sending these fake emails from sending them.
    – Giacomo1968
    Commented Jul 22, 2016 at 15:28
  • The only way to deal with .gov spam is to prank call your local congressman.
    – blankip
    Commented Jul 22, 2016 at 15:31
  • It is all about payload , the malicious link that come together with the email.
    – mootmoot
    Commented Jul 22, 2016 at 16:59

5 Answers 5

Reset to default
47

It is likely that the from header has been forged. I get emails from fake .govs quite often, mostly they end up in my spam filter. The hyperlink within is either unique, allowing tracking, or just delivers malware. Most of the time I just ignore these.

If you believe that the header is not forged then you can typically contact the agency by Googling their name and Webmaster or Contact Us or other such things. Do not use the phishing email, it is almost certainly fake.

Improve this answer
3
  • if they're spoofing the from field anyway, any idea why they would spoof personal accounts rather than [email protected] or something related to the content of the phishing attempt?
    – Woodrow Barlow
    Commented Jul 22, 2016 at 17:36
  • @WoodrowBarlow Often times they do. They use something official sounding from a business to try to establish identity. But emails coming from .gov and similar sites can scare people. They think that the government is protected from fake emails and that they need to respond (Try googling IRS scams). Even ransomware often masquerades as government issue.
    – AstroDan
    Commented Jul 22, 2016 at 17:45
  • @WoodrowBarlow Sometimes spammers try to appear to be normal people at various companies/ govs. They prey on the "We are both worker bees", "Cant you help me out" or "I want to help you" mentality. Because these emails are fake they mostly end up in the spam filter but if they get through they carry both the fear, appearance of officiousness and the social component making them particularly dangerous. As seen from OPs post.
    – AstroDan
    Commented Jul 22, 2016 at 17:46
24

You should respond to phishing from .gov addresses the same way you respond to any other sort of phishing - you don't.

Don't reply to the e-mail, don't click links, don't open attachments, don't do anything the e-mail asks you to do.

If you really want to be generous, check the WHOIS records for the domain the message claims to come from. That may have information on where to send abuse reports. You can also check the government agency's homepage for a technical contact address.

If those don't help, and you don't mind taking a shot in the dark, you could throw a message to abuse@ or spam@ on the domain the mail claims to be from. These are common accounts used by incident response teams in many organizations for exactly this purpose.

If you do find a point of contact, remember to forward the message as an attachment - not just inline. This allows the response team to see the message headers and gather additional metadata that wouldn't otherwise be available.

Be careful in what you claim though. As others have mentioned, it's very possible the message did not even originate from the domain in which you think it did. Simply state that you received the suspicious e-mail, and it appears that it came from their domain. Let them work out whether it actually did, and to what level (if any) their accounts/systems are actually compromised.

Improve this answer
12

I'd like to let the agencies involved know that they have compromised accounts

This is not likely to be true.

Unencrypted, unsigned email is not a secure system; it's based on data that the mail client provides. That data is assumed to be accurate. This design allows an attacker to forge the header data (in this case the From header), and the recipient's email client will assume that data is authoritative.

Therefore, it is less likely that the agencies have compromised accounts, and more likely that the person who sent those phishing emails set the From header to a government mail address and hoped the recipient was gullible enough to believe it.

Improve this answer
5

While the From: header in an e-mail can be spoofed, depending on your own mail client's security settings, spoofed headers will usually land in your junk e-mail folder or not be received at all.

Depending on your own mail server, you are also able to check what server the e-mail came from. SPF Validation works by checking this against the domain records, and if no match is found, it will land in the junk folder.

Government organisations would also likely be using DKIM validation for their e-mail server (though extremely unlikely to be S/MIME or PGP.) If there's a valid DKIM header in the e-mail, it almost definitely originated from the correct mail server, which means that the spam e-mailer obtained the original users credentials somehow, but still could have compromised the account without getting into the victims computer.

Depending on the severity of the attack, I believe the security staff of the organisation would like to know of the breach, but only if there actually was one. Like others have said, it could just be a spoofed header, but there are ways you can check for these things depending on the setup of the originating server(s).

Improve this answer
-1

If you want to be an email crusader save the email, forward it to the agency address and main address, and let them go after the phisher. With the email there is enough information to figure out where it was sent from and they can shut down that service, if they have any control over it. If not they can complain to the country of origin and see if they have laws to help.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .