There are two MAJOR problems at my company (as in several others also I presume).

  1. Users clicking on links in phishing emails.
  2. Users opening (and running) malware-infected attachments.

Yes, I should block attachments and I do. Everything but PDF, excel, word and ppt which I simply can't unless we want to go out of business. Everything else is blocked on server level.

Yes, I know that the users should be educated. They are. But they still click links and open attachments. More education? Sure, but I will never reach 100%. Not even 75%. So what is the solution? We run both IDS and IPS with 24/7 monitoring via a SOC. All emails are monitored and all attachments run in a sandbox before being delivered to end users. URLs in emails are also checked (via third party solution against a cloud-based blacklist). And on top of this, all clients run a multi-layered endpoint antivirus. End users are STILL being infected since attachments contain new strains of malware or 0-days and URLs have not yet been blacklisted. I believe that certain easy solutions are overlooked in general regarding phishing. Do you agree? (See below.)

We use Outlook as an email client and the questions I ask myself every single day is why Outlook doesn't have better phishing protection. For example:

  1. Why doesn't Outlook check if the link text contains a URL that is different from the <a href-URL>. Why should the user have to hoover every URL and make their own decision?

  2. Why doesn't Outlook check if the FROM field differs from the envelope email header? The oldest trick in the phishing handbook. Why should I let the users try to notice this themselves?

  3. Why can't I ask Outlook to scan all emails for certain "dangerous phishing words" like e.g. FedEx, Visa, Mastercard, password, bank account, reset password, confirm account etc etc. Yes, I know about DLP but now I am talking about a client-side solution for incoming emails.

  4. Why on earth is it not possible to turn off ALL links in ALL emails in Outlook? As far as I know it is only possible for plain text emails. This will not make it 100% secure, but at least it will prevent people from clicking links without thinking (i.e. copy-pasting).

  5. Why can't Outlook notify a user that the email they just received is from an unknown sender (i.e. not in their address book) and has an attachment? All in all, this is often highly suspicious.

The above is just very simple things that could be implemented within the email program on the client side and make life easier for end users and for sysadmins.

What is it that I am missing in this line of reasoning? It must be something since this is not implemented in any email software. Or is it? Any thoughts about this are greatly appreciated.

  • Feels pretty opinion-based to me. We certainly don't know why Microsoft chooses to make their email client the way they do. If you find their offering aren't up to your needs, you might consider looking for alternatives. If nothing else, you could develop your own Thunderbird extensions to add your desired features. – Alexander O'Mara Sep 13 '16 at 17:29
  • Do you know of any other email client options that have some (or all) of these functionalities? What to is your thoughts about the suggestions for improvement that I stated? Doable?? – user1298720 Sep 13 '16 at 18:06
  • 4
    The question you should be asking yourself is "why are we using Outlook"? Other mail clients have phishing protection. For example, Thunderbird does 1 and 2, its built in junk filtering can learn 3, and it can integrate with anti-virus to scan emails for more protection. – Schwern Sep 13 '16 at 18:14
  • 1
    I can say for sure that there are legitimate emails using 1 and 2, and clearly 3 (if you really do need to reset a password, you don't need it blocked) – pppp Sep 13 '16 at 19:05
  • Because this question is very Outlook-specific, you are asking why a particular software was designed a certain way. That places this in the "opinion" category. All the filtering you are asking for is possible on the email server. – schroeder Sep 13 '16 at 19:45

Wow, lots in that question to try and get through.

First, what might you be missing? I'd suggest two things from experience. Firstly, the client PC's should only run whitelisted applications, everything else should be blocked. This cancels out masses of malware.

Second, kill off access to all known advert servers, malware sources and command and control (C3) servers - at the Router/Firewall level. You can obtain lists to support this if you like but most people use a smart filtering server such as those from Sophos and others. I even have a script that does this for my home Ubiquiti router - brilliant. This kills off many malware risks and drive-by attacks from rogue adverts. It will also protect from some, at least, of those nasty links.

Next, the unwritten question: Why is Outlook rubbish and other clients not a lot better? This puzzles me as well. With all the advances in UX, information theory and our understanding of thought, you would think that we would have a vastly better core written communications system by now. All I can think of is that email and related comms technologies are seriously uncool to developers. So they get badly ignored.

Now the specifics:

  1. Do you mean something like <a href="//our-intranet.com">Intranet Home Page</a>? I think that you might find that cropping up a fair bit in legitimate HTML formatted emails. As found in enterprises large and small everywhere.

  2. Two issues here.

    Firstly, your email server should do that, don't leave it to the client.

    Secondly, there are cases where this is used (though whether legitimately is perhaps arguable). External systems sending email as a corporate email is the typical case. Some cloud based mailing lists used internally, scan to email systems sometimes. All of these are regularly seen spoofing from addresses. Not really good practice but still far too commonly used.

  3. Because a) the words you list are valid words for many organisations and b) because this too should be done by the server not the client. Check out the open source Spamassassin for example.

    This is not a simple task though and you have to try and be clever about combinations of words and other markers - this is a soft scoring thing not a definite identification - one persons junk is anothers legitimate email. Of course, the bad guys have access to the same tools and adapt accordingly.

    DLP is about data leakage rather than spam/maware discovery. There are client side tools that do this and Outlook's own junk discovery process makes a ham-fisted attempt. You will need 3rd party tools though to do it properly.

  4. Well this is certainly theoretically possible since that is what happens in Outlooks junk folder. No idea why this isn't an option for everywhere else though.

    However, Outlook is meant to be an enterprise email tool and actually most enterprises rightly make use of HTML emails in order to avoid people constantly sending one-page Word documents (AKA "memos") to each other like in the 19th C. So again, there has to be a balance - not saying the balance is right, just pointing it out.

  5. Once again, this is not the experience of many large enterprise users that are the mainstay of Outlook customers. I constantly get emails with attachments from people not in my immediate contact list.

    It wouldn't be that hard to adjust your server-based spam-checking service though to include this as a rule.

Trust me though, I hear your cry of despair. I find that the higher up the organisation chain you get, the more likely someone is to fall foul of malware/phishing links too!

We've had good results though with a constant drip feed of reminders and warnings. Making sure you always do a fairly intrusive extra "virus scan" using an engineer at the desk (or remotely) also helps drive the message home even if you know one isn't really needed. ;)

It is also good to do a deal with your senior execs then do some internal phishing exercises - after warning everyone that you are going to. If you can catch someone senior out, try to see if they are brave enough to be used as an example. In any case, publish some results and repeat a few months later.

  • (2) Absurd. How can an e-mail server see what URL is good and what's not ? Outlook should have an option to block URL automatically. No server spam filter can detect random links with custom generated text content. Not even the smart appliances like inteligent firewalls. Outlook hands down was, is and probably will be a disastrous client which epically fails at every important aspect of a now-days email client. – Overmind Sep 15 '16 at 7:53
  • @Overmind: 2? Sorry, you've confused me, what has the from/envelope got to do with the url? The server is best placed to analyse where things come from and whether the headers are valid. It will have the processing capacity to do it, not all clients in use will have that capacity (e.g. mobile). Outlook may be pants, I dislike it intensely, but it is used by millions of people across the larger portion of the enterprises of the world. It is by far the most used client of a dwindling set. It is also the best supported and has many commercially supported addins. Did you confuse 1 & 2? – Julian Knight Sep 15 '16 at 19:58
  • No server can analyze something like that. I can give you a practical example. All IPs are different, all domains are different and the text is auto-custom-made (like commercial department getting bill links, tech dept. getting tech news links, etc). Yes, it's largely used and that is totally stupid because it is totally unreliable. Just saying it at least suppose to support link-click prevention. – Overmind Sep 16 '16 at 6:32
  • @Overmind: You still seem to be referring to 1 not 2. I've already said that 1 is not practical. – Julian Knight Sep 16 '16 at 7:48
  • Perhaps I did not explain well. I state hands down that even a very well configured custom e-mail server would not be able to filter that type of e-mails. Antivirus will also not filter because it's just a link that can lead to any type of unknown-at-that-point script. So it either comes down to using a lot of RBLs but not even those will filter them in time (and will deny many legit senders), I guarantee that, or having an option in the e-mail client not to allow direct links click. – Overmind Sep 16 '16 at 9:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.