2

Recently a business I'm working with had an email that was sent to some vendors of theirs using emails that were remarkably similar to their own emails. The attackers used letter substitution to mimic the business's domain (e.g. [email protected] — notice the use of "r" and "n" to imitate an "m").

Luckily, the vendors contacted by these people were diligent enough to catch the mismatched email addresses. However, I'm concerned that similar attacks will hit other vendors of theirs that might not have the same protocols in place.

Aside from contacting every one of vendors, is there anything the business can do on their end to mitigate these attacks? Or are they reliant on vendors being diligent with double-checking their contacts?

Improve this question
1
  • There's nothing you can do except warning the vendors. To avoid similar attacks in the future, you could register the most likely domain names, such as dornain.com, so they can't be used by the bad guys. But this is mostly hopeless because there are too many alternative names to consider.
    – Out of Band
    Commented Mar 13, 2017 at 18:13

1 Answer 1

Reset to default
4

The experience your organization has had is similar to what many organizations that deal with sensitive information deal with on a regular basis (ie banks, credit bureau's, revenue agencies, etc). Whale Phishing in particular is a nasty attack that takes advantage of these technical weaknesses.

This issue is one that mostly needs to be solved with procedures, as opposed to technical controls. Below are some examples, but these are obviously not completely fool proof nor do they apply to every situation.

  • First and foremost establish internal policies and procedures when dealing with any movement of money or sensitive information (Wire Transfers can only be initiated by in-person meetings, orders must be processed after sign off from two people that are in the office, etc) and ensure these are adhered to. This means ensuring that everyone affected internally is aware of these policies and adheres to them.
  • Issue communications to relevant stakeholders letting them know that specific communications (such as account breach in the case of banks) will never come from e-mail, or your organization will never request you provide information from links contained within emails.
  • You may choose to register domains that may slightly vary on what your domain is to prevent cyber squatting (ex d0main.com / doma1n.com).
  • Establish an email address or phone line that people can call to inquire about the authenticity of an email transmission (ie [email protected])
  • Put a statement on your website to let relevant parties know of your policies.

It's not exciting but the best way to mitigate these attacks is to establish a firm set of policies and communicating those policies to whoever would need to know them. Let your vendors know that that you'll only place orders through their secure portal (for example).

Improve this answer
5
  • 1
    My understanding of the question is not that the original mail address got spoofed but that the sender used a similar looking domain instead. This has nothing to do with how easy it is too spoof mails with SMTP since the attacker might own the similar looking domain and thus does not spoof anything.
    – Steffen Ullrich
    Commented Mar 13, 2017 at 18:42
  • @SteffenUllrich This is my understand as well, however I think domain squatting and domain spoofing require similar actions for mitigating damage
    – DKNUCKLES
    Commented Mar 13, 2017 at 18:49
  • 1
    You are right in that the both need a trust relationship outside of the email address because the email address alone can not be trusted. And the procedures you describe can be a good way to check that the other party is the expected one. I was only confused because you start your answer with SMTP and spoofing because the problem the OP describes is neither caused by SMTP nor by spoofing and could even be done in the analog way, i.e. snail mail, phone calls and similar.
    – Steffen Ullrich
    Commented Mar 13, 2017 at 18:53
  • 1
    @SteffenUllrich edited for clarity.
    – DKNUCKLES
    Commented Mar 13, 2017 at 19:15
  • I hadn't thought about using an inquiry email like you recommended in point four. This is a fledgling company, so policy questions hadn't come up until this happened, haha. Thanks for your feedback!
    – Micah Yeager
    Commented Mar 14, 2017 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .