Why doesn't Outlook handle phishing URLs [closed]

Question

There are two MAJOR problems at my company (as in several others also I presume).

1. Users clicking on links in phishing emails.
2. Users opening (and running) malware-infected attachments.

Yes, I should block attachments and I do. Everything but PDF, excel, word and ppt which I simply can't unless we want to go out of business. Everything else is blocked on server level.

Yes, I know that the users should be educated. They are. But they still click links and open attachments. More education? Sure, but I will never reach 100%. Not even 75%. So what is the solution? We run both IDS and IPS with 24/7 monitoring via a SOC. All emails are monitored and all attachments run in a sandbox before being delivered to end users. URLs in emails are also checked (via third party solution against a cloud-based blacklist). And on top of this, all clients run a multi-layered endpoint antivirus. End users are STILL being infected since attachments contain new strains of malware or 0-days and URLs have not yet been blacklisted. I believe that certain easy solutions are overlooked in general regarding phishing. Do you agree? (See below.)

We use Outlook as an email client and the questions I ask myself every single day is why Outlook doesn't have better phishing protection. For example:

1. Why doesn't Outlook check if the link text contains a URL that is different from the <a href-URL>. Why should the user have to hoover every URL and make their own decision?

2. Why doesn't Outlook check if the FROM field differs from the envelope email header? The oldest trick in the phishing handbook. Why should I let the users try to notice this themselves?

3. Why can't I ask Outlook to scan all emails for certain "dangerous phishing words" like e.g. FedEx, Visa, Mastercard, password, bank account, reset password, confirm account etc etc. Yes, I know about DLP but now I am talking about a client-side solution for incoming emails.

4. Why on earth is it not possible to turn off ALL links in ALL emails in Outlook? As far as I know it is only possible for plain text emails. This will not make it 100% secure, but at least it will prevent people from clicking links without thinking (i.e. copy-pasting).

5. Why can't Outlook notify a user that the email they just received is from an unknown sender (i.e. not in their address book) and has an attachment? All in all, this is often highly suspicious.

The above is just very simple things that could be implemented within the email program on the client side and make life easier for end users and for sysadmins.

What is it that I am missing in this line of reasoning? It must be something since this is not implemented in any email software. Or is it? Any thoughts about this are greatly appreciated.

Answer 1

Wow, lots in that question to try and get through.

First, what might you be missing? I'd suggest two things from experience. Firstly, the client PC's should only run whitelisted applications, everything else should be blocked. This cancels out masses of malware.

Second, kill off access to all known advert servers, malware sources and command and control (C3) servers - at the Router/Firewall level. You can obtain lists to support this if you like but most people use a smart filtering server such as those from Sophos and others. I even have a script that does this for my home Ubiquiti router - brilliant. This kills off many malware risks and drive-by attacks from rogue adverts. It will also protect from some, at least, of those nasty links.

Next, the unwritten question: Why is Outlook rubbish and other clients not a lot better? This puzzles me as well. With all the advances in UX, information theory and our understanding of thought, you would think that we would have a vastly better core written communications system by now. All I can think of is that email and related comms technologies are seriously uncool to developers. So they get badly ignored.

Now the specifics:

1. Do you mean something like <a href="//our-intranet.com">Intranet Home Page</a>? I think that you might find that cropping up a fair bit in legitimate HTML formatted emails. As found in enterprises large and small everywhere.

2. Two issues here.

   Firstly, your email server should do that, don't leave it to the client.

   Secondly, there are cases where this is used (though whether legitimately is perhaps arguable). External systems sending email as a corporate email is the typical case. Some cloud based mailing lists used internally, scan to email systems sometimes. All of these are regularly seen spoofing from addresses. Not really good practice but still far too commonly used.

3. Because a) the words you list are valid words for many organisations and b) because this too should be done by the server not the client. Check out the open source Spamassassin for example.

   This is not a simple task though and you have to try and be clever about combinations of words and other markers - this is a soft scoring thing not a definite identification - one persons junk is anothers legitimate email. Of course, the bad guys have access to the same tools and adapt accordingly.

   DLP is about data leakage rather than spam/maware discovery. There are client side tools that do this and Outlook's own junk discovery process makes a ham-fisted attempt. You will need 3rd party tools though to do it properly.

4. Well this is certainly theoretically possible since that is what happens in Outlooks junk folder. No idea why this isn't an option for everywhere else though.

   However, Outlook is meant to be an enterprise email tool and actually most enterprises rightly make use of HTML emails in order to avoid people constantly sending one-page Word documents (AKA "memos") to each other like in the 19th C. So again, there has to be a balance - not saying the balance is right, just pointing it out.

5. Once again, this is not the experience of many large enterprise users that are the mainstay of Outlook customers. I constantly get emails with attachments from people not in my immediate contact list.

   It wouldn't be that hard to adjust your server-based spam-checking service though to include this as a rule.

Trust me though, I hear your cry of despair. I find that the higher up the organisation chain you get, the more likely someone is to fall foul of malware/phishing links too!

We've had good results though with a constant drip feed of reminders and warnings. Making sure you always do a fairly intrusive extra "virus scan" using an engineer at the desk (or remotely) also helps drive the message home even if you know one isn't really needed. ;)

It is also good to do a deal with your senior execs then do some internal phishing exercises - after warning everyone that you are going to. If you can catch someone senior out, try to see if they are brave enough to be used as an example. In any case, publish some results and repeat a few months later.