0

We have a spamfilter running that does a very good job at tackling common spammer issues.

From what it catches, I'm assuming it blocks mails based on a few things:

  • SPF checks
  • Certain attachment formats (.exe, .swf, ...)
  • Known spam servers (+ the companies 'private' spam lists)
  • A combination of the above by applying a form of AI.

We have some false positives that we manually allow through, but we're fine with that rather than letting too much pass through.

Today, however, one got through: A presumably hacked Gmail account sending a message that They were stuck in Turkey, with no money and the embassy will fly them back if we can transfer them 2K for a ticket.

  • There's no attachments as it's a social engineering attack.
  • There are some keywords, like Embassy or Turkey, these will stop this wave of spammers, but the next just changes a few lines and they're through again.
  • It's Gmail, which is relatively secure, but which is being exploited by attacking users through weak passwords, which we cannot detect on our side, and we can't globally block either.

Has anyone managed to interrupt this kind of Nigerian Prince Spam from reaching end users? Is it even possible to properly distinguish these mails from 'normal' mails?

As I'm Dutch, to me it's pretty easy to notice the Google-Translate English->Dutch that has been used. But of course, some end-users with financial-level access might not follow the same reasoning.

  • I'm unsure what you are looking for. Configuration tips? Product recommendation? Employee training advice? – Tom K. Aug 20 '18 at 16:58
  • Well, that's basically the question. Can I configure against this without taking measures like blocking Gmail? Has anyone managed to configure against this, and how? Or is this really the point where I have to start training my employees? – Nomad Aug 20 '18 at 17:07
  • 1
    I don't know about the configuration options on your filter but right now it seems like an on-off thing where emails either pass or don't. If possible, you could add a third state where an email will have a spam warning prefixed to the actual body but still be delivered. Then you could add mails including tokens such as "transfer" and "money" from unknown addresses to this state. This would help your employees identify social engineering attacks. – FMaz Aug 20 '18 at 17:11
  • I think there's two possibilities here. Your spam filtering software isn't too good, and you should find a different, better one. Your spam filtering software IS good, there really aren't any better ones, and you're are unlikely to improve it without learning everything the experts already know. Spam filtering is an entire discipline. Trying to tweak this stuff yourself sounds like going down a rabbit hole much deeper than you might realize. Is that really something that your company should be focusing time on? – Steve Sether Aug 20 '18 at 17:38
  • 1
    The experts designed the filtering interface with mechanism we can modify. We can white/black-list specific e-mails and the AI will learn from that. I didn't feel comfortable with blacklisting plain text emails from gmail because I didn't understand how the spamfilter could distinguish this from a regular email. Appearantly, this can be more or less done with techniques like Markov Chains and antispam developers are actively working on it. Now that I know it's Markov Chains, I figured out my spamfilter has such a feature, and I can blacklist without worries. I don't understand the discussion. – Nomad Aug 20 '18 at 18:45
3

It requires real language interpretation to determine if the context is reasonable. That's not an easy thing to do (fingers crossed for AI).

But in the meantime, there are Markov Chains. They would pick up on the terms "turkey" "embassy" and, more importantly, "transfer" and a currency symbol in the same sentence.

But, the science is far from perfect and scammers work to defeat them.

In terms more in line with what an email admin can do, I have seen great success when the server adds a banner to all externally sourced emails "This email came from an outside source." or somesuch. It does not stop the emails, but it equips the end user to be more alert.

  • Guess we're gonna get down to some user training combined with the Markov chains to add banners. Thanks for the complete answer! – Nomad Aug 20 '18 at 17:20
  • 1
    I want to add that if this email was really part of a social engineering attack, its whole purpose was to be so unique that it is not detected by spam filters that look for repeating patterns. If such an email is well crafted, an algorithm that is based on Markov Chains would probably not detect it as well. The presented mail does not look like a sophisticated attempt though. – Tom K. Aug 20 '18 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.