4 ms·
I'm an IT consultant in NYC, and no fewer than 5 of my clients have been targeted by such scams. Information on the structure of their company is gathered from
by ndespres 11y ago
I'm an IT consultant in NYC, and no fewer than 5 of my clients have been targeted by such scams. Information on the structure of their company is gathered from their website and an email will be fabricated appearing to be a conversation between company president, controller, CFO, etc all with their real names and email addresses, sent to a company accountant or something requesting a wire transfer.
The final email will be sent from a very similar email domain: the scammers register a domain with a simple letter/number substitution that is VERY difficult to visually detect if you aren't looking. Many were registered with VistaPrint, who offer free registration of domains on a trial plan, or something. You can see a list of their recently-registered domains here http://vistaprinta.tk/ http://vistaprinta.tk/, if you scan through it you'll see some misspellings and l/1 switcheroos. (I spoke with someone at Vistaprint who indicated that they are actively working on this problem, and they have taken quick action when requested).
When my clients ask me to take a technology approach on these matters, I encourage them to treat it as a process issue instead. Having adequate controls for issues like this (phone call required, second approver for large wire transfers, etc) is better than any futile spam-blocking action we could take.
- DenisM 11y agoAt Microsoft, when an email has an internal sender address it will not get delivered unless that email did in fact come from an internal Exchange server. In 1998 I was able to use SMTP to send an email "from Bill Gates" (only sent it to myself for my own personal amusement), but the trick stopped working later.
- bostonpete 11y agoThat doesn't seem like it would guard against an e-mail sent from "a very similar email domain" like ndespres described.
- DenisM 11y agoYes, but I could always double-click on the mail address in Outlook and see the internal address book entry if the email is spelt correctly. When verification is easy, people do more of it.
- Shog9 11y agoWhich brings it back to being a process issue: if folks are diligent about verifying (whether that's a phone call or clicking on a name), then this is harder to pull off.
- dexwiz 11y agoThere are a lot sent along with an email besides the To/From names. The name is pretty easy to spoof, but the SMTP request and timestamps is much harder. Also most reputable senders now use SPF, a type of DNS record, to verify email servers. But email usually trusts by default, unless your servers are very locked down. You can still send 'unverified' email, but its easier to trip spam filters if you send too much.
- protomyth 11y agoI ran into something like that when demonstrating our report delivery at a company. I remember saying "Now notice I change the header to say it comes from [person in room] which of course the e-mail server will reject... oh, my... well, I guess it doesn't...". I was 'encouraged' to have a talk with the e-mail team.
- thrownaway2424 11y agoDMARC makes this pretty trivial these days. A mail shouldn't be accepted by _any_ system unless it is authentic.
- siberianbear 11y agoIn 1993, I had a summer internship at Apple. After I returned to the university that fall, I sent a fake email from Andy Grove (the CEO of Intel at the time) to my new friend at Apple. I did this just by opening a telnet session to the SMTP port at apple.com and manually typing in SMTP commands and associated text. Apple's SMTP server happily delivered a fake email from agrove@intel.com from a system at ucdavis.edu. Lol, those were the days....
- HelloMcFly 11y agoThat's an interesting list. A few I liked: * thompsonenteprises.com * uberpromo.info * kinneyconstructiion.com * blackbeartactical.com (real domain: blackbeardtactical.com)
- Lazlo_Nibble 11y agoOh, the havoc you could wreak with control of the .corn TLD!
- aaronbrethorst 11y agoThe day that the .corn TLD is created, I'm buying keming.corn
- robwilliams 11y agoIt took me a long time to find the error in thompsonenteprises.com but half a second to recognize that kinneyconstructiion.com is wrong. I wonder if businesses are more at risk due to their name alone (some are more difficult to manipulate into hard-to-spot alternatives).
- zappo2938 11y agoInternationalized domain name homograph attack [1] This hack freaks me out. I would never know if it hit me. [1] https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack