3

I use Gmail and I started getting malicious-sounding emails from people I know intimately. The people I spoke to said they did not send those emails. In order for the attacker to carry this off, are they attacking my email servers or my contacts' servers? Or is this us an mitm attack?

Improve this question
2

4 Answers 4

Reset to default
4

You will need to analyse message headers to determine what is going on.

Google's Message Header Analyser is here.

Using the tool, check the from servers to find out if the emails pass through your contacts' servers or only your own.

Also check whether SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) pass - if they do pass, it is more likely to be a compromise on your contacts' servers or accounts.

Improve this answer
3

It does not have to be even this. On the Internet, there are lots of so called fake mailers. One of it is for example Emkei's Fake Mailer https://emkei.cz/

So you will have to be careful until your contact persons will (or their admins will) set up SPF record which will prevent this type of the attack.

Improve this answer
1
  • 3
    I have to say that this response probably solved a major crisis in my online security problem. Not only does this fake emailer send out spoofed emails, it was creates headers that appear to come from the original sender. The only thing I did pick up was that the Received By tag showed Emkei, which would be a big give away that it was a spoof. However, if the receiver didn't know about this fake emailer, they would have no idea.
    – user7149
    Jun 28, 2015 at 3:06
2

Probably one of your friends' email account got compromised and the list of contacts (which contains people that you know intimately) is now being used by scammers. This kind of scam involves the scammer impersonating your friend and pretending she's stranded in some foreign country and in distress (passport lost/stolen, etc) so she begs you to wire her some money. This kind of scam is easy to spot because of big red flags (unforeseen travels, friend writing to you in a different language than usual, etc).

Improve this answer
1

  1. By checking URL you can find malicious email in email before clicking on any link, check the link address. Mostly, hackers are using URL shortener for hiding the real URL.

  2. Check sender email ID

Improve this answer
2
  • I'm not sure how to check the email URL. When I go through webmail, all I see are-- mail.google.com/mail/u/0/?pli=1#inbox/19e3ca586fa7251c. Also how can I check the email ID?
    – user7149
    Jun 28, 2015 at 17:00
  • 1
    if you hover your cursor on any link in email then you can see the URl of That speific link. In Browser's URL field is differebt,don't get confuse with Browser URl and In Mail URL.
    – Swapnil Patil
    Jun 30, 2015 at 4:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .