0

I (mostly) understand how a scammer can send an email from a spoofed account, all you need is an unsecured SMTP server.

But how is it possible, for a scammer to RESPOND and maintain an email conversation with the victim from the spoofed address? In this case, there was no "reply-to" and the domain is completely legitimate.

The only clue was that the mail address of the responder (scammer) was in some (not all) cases suffixed with a "1", i.e. events@legitdomain.com and events1@legitdomain.com.

My first thought was that the mail server at "legitdomain.com" was compromised, in which case pulling this off should be fairly simple since you can receive and respond to emails and create rules to redirect emails from target addresses so that the domain owner staff don't see them. You can also read incoming/outgoing emails to help with target selection, i.e. target a recently invoiced client that is about to make a payment and convince them that the banking details changed.

But is there a way to do this without having access to the mail server?

2
  • 1
    What makes you sure that the email is spoofed instead of the attacker controlling the used account? There is no need for this to control the mail server, it is sufficient to control the specific account. Jun 22 at 18:02
  • I think you are using the term "spoofed" incorrectly. "Spoofing" is a specific technical term. If you can determine what exactly happened with the account, you might find that the answer is obvious. events1@legitdomain.com is not necessarily "spoofed".
    – schroeder
    Jun 22 at 18:46
0

There are two ways that this might be "spoofed":

  1. The first way is that the adversary actually has control of the mailserver or a compromised account. It's not uncommon for adversaries to try and hijack a legit email address as a means to send phishing attacks. During my time as a SOC analyst (I worked for a large medical university) we would often get phishing emails coming from real .edu addresses. The adversary would initally compromise some random account from another university, and then send phishing messages from those accounts as a means to add credibility to their asks. Part of my job was to call these other schools and tell them that they had a compromised account.

  2. The second option could be that they registered a domain that looks just like the real one. A trivial example would be something like m1crosoft.com. Some of these are so close and well crafted that it takes a trained eye to catch them. It's even harder if it's not a well-known brand in which case you may not know what the actual URL is--so you wouldn't know that "mycompnay.com" is actually a 'spoofed' version of my-comapny.com

2
  • Thanks Tobin, given your response as well as the comments to the main post, it seems there is no glaringly obvious way for a scammer to "spoof" or "impersonate" an email address for both sending AND receiving of emails (without using reply-to). This leaves us with either a compromised server, compromised email account, or compromised individual. It's also not a case of a look-a-like domain. My reason for coming to this forum was to learn if there are other more advanced methods that I'm unaware of, manipulating MX records or something of that nature. Jun 23 at 6:48
  • It takes a knowledgeable inspection of the email headers to determine where an email actually originated. Anyone can easily send an email that reads as "From: joe@whitehouse.gov" and directs you to reply to some other address.
    – ddyer
    Jul 25 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.