6 ms·
not really that wouldn't have worked if they didn't hack the email first
by vaksel 16y ago
not really that wouldn't have worked if they didn't hack the email first
- steveklabnik 16y agoIt was simply spoofed, from what I understand.
- elliottcarlson 16y agoSpoofing would be hiding the senders address, but something, either a hacked account or MITM attack, would need to happen to get the responses from the IT person.
- steveklabnik 16y agoAh, good catch.
- mikeryan 16y agoCouldn't you display the one email and use a separate Reply-To addy to get responses? (and hope no one notices) This is not my forte I'm likely off.
- thaumaturgy 16y agoYes, and depending on the email client on the other end, the other person wouldn't even notice. The only guard against something like this is SPF on the sender's domain and for the recipient's mail server to check (and enforce) SPF rules.
- deno 16y agoYou could also use DKIM, you can see if message has been DKIM signed in Gmail by clicking "show more info" in webapp interface. But seeing as this is security company why didn't they at least sign their messages using PKI/PGP certificates? And why would they keep their entire email on their webserver?
- webXL 16y agowhois 65.74.181.132 shows that they ssh'd into the webserver from another machine on hbgary's network, perhaps the mailserver. I believe it's really easy to do email MITM when you have a login to the mailserver or own a machine on the same subnet and put its NIC into promiscuous mode.
- deleted 16y ago[deleted]