There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some sensitive data was exchanged at the end and an outside email address was revealed for some reason at the end of the chain. Employee B never received and replied to employee A emails. Also, exchange server ended up being down after this incident. What could have happened? How can this be prevented?

  • Welcome to security.SE. I think that we could help you more if you could explain a bit more about the context of this problem. If it's a homework problem, please say so. If not, please give us more information. – Neil Smithline Apr 5 '16 at 18:06
  • This is a real incident. What additional info do you need? – user106590 Apr 5 '16 at 18:46

Email was never designed to verify an email actually came from the person it says it came from. The model is largely one of snail mail, where it's trivial to print an address of President Of The United States as the origin.

The most likely scenario is the header address appeared as employee B, but the reply to: address was set to someone else like attacker@evil.com. In this case, replies would go to attacker@evil.com instead of employee B.

  • looks like you are correct. I only saw the entire email chain with the valid email address in the first few messages. But after I read your comment I checked employee A first incoming email from employee B and it already changed to the rogue email address. I assume IT changed exchange server settings so it displays the real address now. Also, there're probably exchange server and Barracuda settings to reject such emails in the future. I didn't look at this issue firsthand as it's not my job but I'd like to understand if we are doing enough to prevent this from happening again. – gr33ndude Apr 5 '16 at 21:03
  • Email is particularly tricky to get right, and there's a wide variety of use cases where the from and reply to can legitimately be different. One is simply mailing lists. The "from" should really be from the person who created the message, but the reply-to really has to be the mailing list. So you could potentially break mailing lists by changing headers, or rejecting email where they don't match. Also, people don't really pay much attention to the address, but pay attention to the name. Phishing is just very hard to swat. – Steve Sether Apr 6 '16 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.