0

I was solving questions related to security and come across this questions:

  1. You receive an email message that purports to come from your bank. It asks you to click a link for some reasonable-sounding administrative purpose. How can you verify that the message actually did come from your bank?

  2. Now play the role of an attacker. How could you intercept the message described in part (1) and convert it to your purposes while still making both the bank and the customer think the message is authentic and trustworthy?

4
  • 1
    If you could add the answers you have for the first part (i.e. how to verify sender) then we could be more specific how these ways could by faked (or not) by an attacker. As it stands now you effectively ask us to answer both parts even if you came up with answers for the first one already. Nov 6, 2016 at 8:27
  • I read this on a website: The default level of authentication added to each email sent through Campaign Monitor proves that the email came from bank servers, however, to prove that the email comes from bank’s domain, bank need to authorize Campaign Monitor to send on bank’s behalf. Bank can do this by modifying the DNS records attached to a domain name they own, so that any email sent through Campaign Monitor is verified as coming from bank’s own domain.
    – Patt
    Nov 6, 2016 at 8:48
  • 1
    @Patt please edit your question with these details.
    – schroeder
    Nov 6, 2016 at 9:00
  • @Patt: like schroeder said please include this information in the question and not in a comment. And please don't just cite something but since you said you have an answer I would suggest to put it in your own words what you actually took from this article as the relevant part, i.e. how exactly this mail gets verified by the recipient and not what the provider does so that the mail can get somehow(??) be verified by the recipient. Nov 6, 2016 at 9:21

2 Answers 2

1

You receive an email message that purports to come from your bank. It asks you to click a link for some reasonable-sounding administrative purpose. How can you verify that the message actually did come from your bank?

In general, you cannot.

That's why, if I get a message from my bank, it doesn't contain any links. It either contains a self contained message that cannot compromise my security ("more than 300 euro has been withdrawn from your account") or it simply contains the message that I should look into my mailbox on the website. I don't think many banks will sign their content with e.g. PGP or protect the messages otherwise.

Banking apps of course have more possibilities in this regard: normally you can trust the app (make sure you do), and the app can trust the messages send to it using a signature scheme.

Now play the role of an attacker. How could you intercept the message described in part (1) and convert it to your purposes while still making both the bank and the customer think the message is authentic and trustworthy?

You would not have to intercept any messages. You can just spoof a message. Maybe you receive a message by having access to a bank account yourself, in some way or another. Or you just take the style of the banking site and use that to create a reasonably looking message.

There is no reason to make the bank trust your message; you're trying to trick the customer. The bank trusts the customer to create transactions for their behalf.

0

You receive an email message that purports to come from your bank. It asks you to click a link for some reasonable-sounding administrative purpose. How can you verify that the message actually did come from your bank?

To verify if the mail you got is from trusted source or not, you can just use the Show Original or a similar option (depends on your email service provider). On Gmail is located in right drop down.

enter image description here

This option shows the orginal message that Gmail gets from sender. Gmail now automatically verify many things like SPF, DKIM (trusted ones usually have it), etc. You can easily identify the original sender from here, without trusting the FROM field that shows an email ID from your bank.

Now play the role of an attacker. How could you intercept the message described in part (1) and convert it to your purposes while still making both the bank and the customer think the message is authentic and trustworthy?

With the above verification in place, the only option, I think, an attacker has is to break into your bank's email service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.