My company often sends orders to brokers and banks to execute certain actions (like buying x stock or y fund). In order to reduce bureaucracy we are considering send a list of emails that are allowed to send orders.
Is there big flaws in this procedure? Like, could someone pretend it is sending a email from someone else' mail(spoofing)? thanks!
It is as easy to spoof the sender of the email as you can lie about the sender on the envelope of snail mail. It is also not only easy but heavily used: the majority of spam and phishing mails use address spoofing. The only real way to be sure about the sender is if the sender signs the mail and the recipient verifies the signature. Common solutions for signing (and encrypting) are PGP and S/MIME.
There are other anti-spoofing techniques like DKIM or SPF but these work at most at the level of domains and thus can not detect if somebody inside a domain is spoofing another mail account inside the domain. If protection at the domain level is all you need then DKIM should be preferred to SPF because it signs outgoing mails using cryptography. This signature then can be checked inside supporting mail clients. With SPF instead the receiving mail server must check that the mail comes from the expected IP addresses and the end user can not verify this. But you could also use both DKIM and SPF at the same time.
If sending orders to brokers and banks in your company require authorization (only authorized employees can do that) then email address is not an authorization method.
Yes, it is very easy for someone else to pretend it is sending email from someone else. Using an SMTP client library you can very easily fake an email. See the following python code:
#!/usr/bin/python
import smtplib
from smtplib import SMTPException
sender = '[email protected]'
receivers = ['[email protected]']
message = """From: From Person <[email protected]>
To: To Person <[email protected]>
Subject: SMTP e-mail test
This is a test e-mail message.
"""
try:
smtpObj = smtplib.SMTP('localhost')
smtpObj.sendmail(sender, receivers, message)
print "Successfully sent email"
except SMTPException:
print "Error: unable to send email"
NOTE: You only need to install and run an SMTP server on you local machine. If you are not running an SMTP server on your local machine, you can use smtplib client to communicate with a remote SMTP server. Many remote SMTP server can be tricked into sending email messages from spoofed email.
There are some tools that can be used for detecting spoofed email address. But then these tools or detection techniques must be executed by the receivers which in your case I assume will be the brokers and banks. I do not think they will use these tools :).
