Why Zero-Trust Is So Imporant! Email Security Review
We get a lot of emails forwarded to our ticket board from clients asking us to verify if they are genuine. I like the process of analysing the emails to make sure they are clean, then ultimately helping the end user decide what to do with them.
I wanted to write a short summary of what I did for a particular example and hopefully that will share some ideas of what to look out for.
Overall, social engineers are very clever. They have multiple tricks of disguising emails or making them appear genuine, so it is crucial, that if you have doubts about an email sender — you trust your spidey senses.
For obvious reasons I will not share the user’s information or any personal information.
The Ticket Summary:
An end-user forwarded an email to our helpdesk, right off the bat, forwarding an email does not provide the original email headers so we could not analyse them directly, but there are many other ways to investigate.
This is what the email looked like:
From all we know, the user has not been in contact with CAI, so it is strange that they have received an email to access a portal.
My first idea was to test the links in a virtual machine. So, I did.
I clicked on the “Access your portal” link and it took me to the following page:
The URL does not appear suspicious but the prompt to change the password does! I had a closer look at the domain. It is “caisoft.com”, the website uses a secure HTTPS connection. I did a “Whois” search to learn more about this domain. That was my next idea.
Looks like this domain was registered a while ago and it does not appear to be a newly registered domain. It’s common for cyber criminals to register new domains to make it appear more genuine.
So far, I’ve learnt that the links take you to a caisoft.com website and there’s a change password prompt for the website. It does not look alarming. What would be sus is if it was a website asking you to enter a “Microsoft” account credential, and if the URL looked obviously fake. I would say I am like 50% sure this is clean so far.
Next thing I did is ran a message trace on Exchange Admin Centre.
From the message logs I found the original email, and I could see the message was delivered from Proofpoint (based on the IP address) so it passed all the authentication methods.
Finally, the client has “Spambrella” (an email security solution) in place, so I reviewed the logs. I was able to find out that DKIM, DMARC and SPF passed.
Which tells me that the email was genuinely sent from the cai.com domain.
Get Wiktoria’s stories in your inbox
Join Medium for free to get updates from this writer.
In conclusion:
- The website seemed genuine and did not trigger any alarm bells apart from the prompt to change the password to the CAI portal.
- The domain was registered in 1996, so points to a well-established domain rather than a fake domain impersonation.
- Message Trace on Exchange show that the email was sent from Proofpoint (based off the IP address) so it passed the spam filter clean.
- Spambrella logs suggest the SPF, DKIM and DMARC passed proving that the sender is from a genuine domain.
However, the client did not sound sure, so it points to them not being aware of prior communication with CAI. Also, just because the DNS records come back clean and the domain is genuine, it may also be a compromised email; meaning you cannot always be sure that the email is harmless.
Based on my investigation I responded to the client with:
Hi,
Hope all is well!
Thanks for forwarding this email to us. Based on initial review, we are not sure if this is genuine spam. The email appears to come from the caisoft.com domain, and the “Access your portal” link takes you to the following page: (image of website)
Overall, it appears to have passed email verification checks and has been delivered to other colleagues inboxes.
However, we cannot tell for sure if this is a genuine email from CAI as it could potentially be a compromised email.
Have you had any communication with CAI before, and are you expecting an email from them?
I would suggest not to interact with the email if you are not sure or raise internally if this is a new service being implemented.
Please let us know if you have any further queries, or feel free to give us a call back on ….
Kind regards,
Wiktoria
Key Takeaways for end-users:
- Implement the zero-trust policy
- Even if you receive emails from a trusted domain or person, if you are not sure or were not expecting their email DO NOT interact with links/attachments that look suspicious!
- Never enter your password when redirected to a link. A very common phishing attack is directing you to a website that looks genuine, in hopes to gain your trust, so you enter your password. DO NOT!
- Always forward any suspicious emails to your IT team even if it feels pointless. We can report the messages and review vulnerabilities in the email system, so it prevents it in the future!
- Just like the end-user did in this example, well done end-user! :-)
