23

A colleague recieved an unsolicited email along the lines below:

Dear Ms. Smith

please click on the following link to recieve Document X regarding Project Y.

Yours,

Eve Nobody
[email protected]

I suggested my colleague to reply to Eve Nobody, and ask whether the email is legitimate. Note, that we typed-in the address of Eve Nobody, since one could tamper with the reply-to header.

I assume three possible scenarios:

  1. Eve Nobody exists and she did send the email
  2. Eve Nobody exists, but she didn't send the email
  3. Eve Nobody does not exist, and the email-server of company.com will reply with an error message

In all possible scenarios, we only interact with company.com, and not with any potential spoofer. Thus, I consider this course of action safe.

Was my advice sound, or are there other aspects to consider?

For context:

  • We are a firm which does research with academia and industry, hence we have plenty of information on our current projects along with the corresponding researchers. Thus, the information contained in the initial email (a reasonable title for Document X and the title of Project Y) can be gather from our homepage.
  • company.com is a legitimate company, and is involved in some research of ours.
Improve this question
13
  • 3
    One very easy piece of information you did not pay attention to was the link itself - where did it link to? Don't click on it, obviously, but you can inspect it to see where it goes. This can be a huge clue when trying to determine if an email is legitimate or not.
    – J...
    Commented Aug 18, 2020 at 12:37
  • 1
    Why bother with this?
    – user91988
    Commented Aug 18, 2020 at 19:26
  • 9
    @STF_ZBR: Nоt nесеssаrily. This соmmеnt соntаins оnly оnе wоrd withоut аny nоn-Lаtin lеttеrs. Саn yоu tеll whiсh оnе?
    – Ilmari Karonen
    Commented Aug 19, 2020 at 8:18
  • 1
    @IlmariKaronen yes, but only with a hex editor :) Rot-13: Gur nyy-Yngva jbeq vf guvf. That is actually alarmingly convincing!
    – Vicky
    Commented Aug 19, 2020 at 12:51
  • 1
    Also if you paste it into Word you get nice red wavy underlines on every word except the all-Latin word.
    – Vicky
    Commented Aug 19, 2020 at 12:52

3 Answers 3

Reset to default
61

You are focused on the person existing and not the account. Consider that Eve exists, did not send the email, but someone with access to her account did, and has entered an email rule to prevent your emails from hitting the inbox. You could carry on a conversation with that account but not Eve herself.

So I would add:

  1. Account exists, email was sent from the account, but Eve did not send the email (compromised account)
  2. Account exists, email was sent from the account, but Eve does not exist (dummy account)

In both cases, if you reply, you could be replying with the malicious actor and not Eve.

The best response is to contact Eve through some means other than email (call, other contact info, etc.)

Improve this answer
9
  • 2
    In that case, company.com has a serious problem. I imagined a spoofer outside of company.com simply using the name of the company and possibly the name of an employee to craft a phishing email.
    – Dohn Joe
    Commented Aug 17, 2020 at 12:59
  • 43
    Compromised accounts are quite common. They are a common way to compromise 3rd parties who trust them.
    – schroeder ♦
    Commented Aug 17, 2020 at 13:00
  • 9
    @DohnJoe this exact scenario of malicious actor controlling a user account of a legitimate company, or even legitimate company's mail server is a reasonably common pattern for invoice redirect fraud, for example.
    – Peteris
    Commented Aug 17, 2020 at 22:08
  • 12
    @Peteris This has been a big problem in the real estate industry. A hacker will compromise a real estate agent's account and tell the home buyer to release the escrow funds and wire them to the fraudster's account. Often the accounts are overseas and funds are unrecoverable. People are losing tens of thousands in a single transaction.
    – Booga Roo
    Commented Aug 17, 2020 at 23:37
  • 2
    I would look at the full headers of the e-mail. If the e-mail has gone through the same servers as various past legit e-mails, then it's either legit also, or a compromised account. If the Received: headers show a trail of unfamiliar servers, that almost certainly confirms it as a forgery.
    – Kaz
    Commented Aug 18, 2020 at 6:19
27

If you don't know Eve, I see no reason to follow up.

If you do business with the company she claims to represent, you could reach out to a regular contact you use at that business. Don't try to engage that account directly because it may not be what it seems (e.g. a compromised account or a spoofing trick that fools your email client).

You can also vet the DMARC, SPF, and/or DKIM on the message to see if it is legitimate. First, check that the From domain is correct. Then look for an Authentication-Results header in the message. Only trust it if it is surrounded by headers added by your email infrastructure (the systems your company uses to receive your mail). It will tell you what of DMARC, SPF, and DKIM passed. You're looking for DMARC alignment (a DKIM header whose d= value matches the From header's domain or an SPF approval, which means finding the SPF record for the From domain and verifying that the IP of the system connecting to your MX record is approved). There are tools like G Suite Toolbox Messageheader that can look this up for you (but it'll be Google-centric). If SPF or DKIM pass with alignment, the message is probably legitimately sent by that domain's infrastructure (but you don't know if it was sent by a compromised account).

Improve this answer
2
  • 2
    The first sentence feels like a blanket statement that doesnt always work. I have worked on projects where ignoring emails from individuals from certain organisations could get you in a lot of trouble. Of course never opening any email is the safest option, but it is not a very useful one.
    – Anders
    Commented Aug 20, 2020 at 7:28
  • 1
    When failing to provide context and popping out of the blue without a prior organizational relationship, there's reason to be suspicious and I stand by that statement. If there's a relationship in place, as I said in paragraph two, it may be worth reaching out to a colleague of the supposed message-sender.
    – Adam Katz
    Commented Aug 20, 2020 at 13:48
9

A long time ago when I was just out of short trousers and working my first gig as a system administrator I replied to a spam email asking them to stop spamming me.

It turned out the FROM address was actually the spam distribution list and thousands of people received an email from me asking them to stop sending me spam. They then emailed me back to say they weren't sending spam - how could I think such a thing.

Since then I just pass them off to my bayesian filters.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .