1

There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some sensitive data was exchanged at the end and an outside email address was revealed for some reason at the end of the chain. Employee B never received and replied to employee A emails. Also, exchange server ended up being down after this incident. What could have happened? How can this be prevented?

2
  • Welcome to security.SE. I think that we could help you more if you could explain a bit more about the context of this problem. If it's a homework problem, please say so. If not, please give us more information. Apr 5, 2016 at 18:06
  • This is a real incident. What additional info do you need?
    – user106590
    Apr 5, 2016 at 18:46

1 Answer 1

1

Email was never designed to verify an email actually came from the person it says it came from. The model is largely one of snail mail, where it's trivial to print an address of President Of The United States as the origin.

The most likely scenario is the header address appeared as employee B, but the reply to: address was set to someone else like [email protected]. In this case, replies would go to [email protected] instead of employee B.

2
  • looks like you are correct. I only saw the entire email chain with the valid email address in the first few messages. But after I read your comment I checked employee A first incoming email from employee B and it already changed to the rogue email address. I assume IT changed exchange server settings so it displays the real address now. Also, there're probably exchange server and Barracuda settings to reject such emails in the future. I didn't look at this issue firsthand as it's not my job but I'd like to understand if we are doing enough to prevent this from happening again.
    – gr33ndude
    Apr 5, 2016 at 21:03
  • Email is particularly tricky to get right, and there's a wide variety of use cases where the from and reply to can legitimately be different. One is simply mailing lists. The "from" should really be from the person who created the message, but the reply-to really has to be the mailing list. So you could potentially break mailing lists by changing headers, or rejecting email where they don't match. Also, people don't really pay much attention to the address, but pay attention to the name. Phishing is just very hard to swat. Apr 6, 2016 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .