Email Spoofing

Introduction

Email spoofing is a technique related to phishing email attacks where an attacker uses an email header to forge the email to target the victim. Emails are created with a forged or fake sender address. It is a method of breaching the receiver's trust as the receiver thinks the message or email has been sent from the known sender. Still, it's a hacker who masks their own identity and impersonates a legitimate sender.

“Email spoofing is one of the tool of the phishing attack use email as a weapon to take over user online account, stealing funds and sending malware for hacking purpose.” 

Email spoofing is a method of creating spam or phishing attack with email as a medium. This email header is spoofed to mislead the recipient about the email's sender.

Email spoofing is used in various activities like:

Spear phishing	Kind of social engineering attack done by an attacker by impersonating a trusted person to a targeted specific individual
CEO fraud	An attack in which the attacker impersonates himself as a high-level company executive is used to target an employee.
Business Email Compromise – BEC	A cyber-attack (phishing attack ) involves impersonated, spoofed or hacked corporate email address.
Spamming	A method of forging email and sending it to large numbers of people
Vendor Email Compromise – VEC	It is designed by an attacker who impersonates a vendor or another business in a company's supply chain.

Some of the examples of BEC

• Google and Facebook BEC scam
• Ubiquiti vendor fraud
• Toyota BEC attack 2019
• Obinwanne Okeke
• Scouler Co. acquisition scam
• Homeless charity, Treasure Island
• Government of Puerto Rico, where millions were transferred
• St. Ambrose Catholic Parish
• Guillermo Perez
• Save the Children
• Noel Chimezuru Agoha, Sessieu Ange Oulai and Kelechi Arthur Ntibunka
• Atlanta BEC scammer
• Gift card scam
• Snapchat payroll information breach

History of spoofing

The history of spoofing started at the beginning of the 1970s because the email protocol worked when spammers used it to get around email filters. In the 1990s, email spoofing became more common; in the 2000's it became a global cyber security issue. The solution to fight against email spoofing and phishing came in 2014 with the launch of security protocols. These security protocols work as a filter for the email in which many spoofed email messages are sent to the spam boxes directly or rejected. These spam emails are never sent to the recipient's inboxes.

Working on email spoofing

Email spoofing is based on the email because each mail is the same in many ways and not very different from regular mail. A general email consists of three elements: a message header, an envelope, and a message body.

A header: The head of the email contains all the metadata about the email. It includes the sender's name, email address, date of sending, subject of matter, and "reply-to" address.

An envelope: The envelope is not visible to the user as it works for the receiving server, which tells it about who has sent the email and who will receive it.

The body of the message: It includes all the relevant information of an email in proper wording.

An email spoofer not just customize the information or put whatever it wants in the message body but also can TO filed, and these fields are:

Mail from	abc@company.com
Reply to	Xyz.123@system.com
From	Hr@company.com
Subject	Regarding Leave
Date	DD/MM/YYYY

Reasons for Email spoofing

• Use to hide the user's identity.
  The main reason for using email spoofing by hackers is that in this, they can conceal who they are. It becomes easy for the attacker if the recipient trusts the alleged sender of the mail. In the first step, the hacker attains the user in the name of the company or the person. They make themselves familiar to targets like (a friend, business associate or someone within their social networks) and the name and identity of someone within the general business community (some on the reputed post of s respected company or organization).

• Part of the man-in-the-middle attack
  Cybercriminals use email spoofing as a part of sophisticated man-in-the-middle attacks to capture the organization's trade secrets and sensitive information as part of corporate espionage.

• Avoiding spam block lists
  Email provider provides a feature of creating a blocklist through which users can create a blocklist that filters out spam. All the spammers with their name or domain address are added to this filter to block them. By using this method, email slips past the filters undetected and into the recipient's inbox. If an email spoofer sends a forged email using the blocked email address or included in the filters, they are easily detected, or the email can't approach the user.

• Tarnishing the image of the assumed sender
  Spoofed emails contain false information, malicious links, outright lies, or subtle untruths created to make the sender a false entity who looks like someone with ill intent or uninformed. Sometimes spoofed images blur the image of the sender or organization that appears insecure or compromised by hackers or malware. This may abolish the supposed sender's reputation and hurt their business or social prospects.

• To make the personal damage.
  Sometimes the email spoofing is used to damage the victim; the intent may be personal. Well-spoofed email is designed to access the target's business contacts, computer data, social media accounts and many more. With this target image spoiled, the target looks bad, damaging their computer or harming their profile. The sender can hold over the recipient's computer by installing ransomware to introduce certain types of malware that affect or interrupt their digital life. 

• Used in committing identity theft
  By using the victim's email account, the attacker tries to access the personally identifiable information (PII), known as identity theft (attacking the name of someone's identity).

Protection against email spoofing

Rather it is impractical to stop email spoofing in this cyber world because today, more than half of personal and fully professional communication is done via email, and the foundation of sending emails, i.e. SMTP – Simple Mail Transfer Protocol, doesn’t require any authentication. It is also considered a vulnerability of technology.

1. By stopping the email spoofing by these methods
   • Sender policy framework (SPF)
     It consists of a list of authorized servers to send emails from a particular domain. When an email address is created associated with a domain, it is checked in the list on the SPF record. If it is not present, then it would not pass authentication.
   • Domain key identified mail (DKIM)
     This consist of pair of cryptographic keys (public or private) for authentication. The public key for authentication is stored in the DKIM record, whereas the private key digitally signs the DKIM header. Email authentication is failed when a spoofed email from a domain with a DKIM record will not sign with the correct cryptographic keys.
   • SSL/TLS
     This system enforces authentication and can be used to encrypt server-to-server email traffic. In real practice, it is seldom used.
   • Sender ID
     Sender ID must be anti-spoofed based on SPF (verify the message header and predict that the sender is original). It is proposed by the MARID IETF working group that tried to join Caller ID and SPF.
   • DMARC - Domain-based message authentication, reporting and conformance
     This method lets the receiver know that received mail is protected by SPF or DKIM and what to do when mail fails authentication. DMARC relies on DNS records with SPF & DKIM.
   • Secure/ Multipurpose Internet Mail Extensions (S/MIME)
2. By choosing a secure email provider and practising good cyber security hygiene
   This can be done by using throwaway accounts when registering on sites; when someone clicks on a link, the link header must be inspected, and the email password should be complex and strong enough.       
3. By inspecting email headers
   Users can easily inspect the email header by viewing it using Gmail services; the user can click "show original" on an individual email will reveal the email header. After viewing the header, the user looks for the received section. If the user found a different domain than the "sender address" or "From" address appears, the email is likely forged.
4. Use of anti-spam software
   Businesses, individuals or organizations must use anti-spam software that can filter spoofed messages by the requirement of authentication for incoming emails, thereby blocking spoofing attempts.
5. Be wary of messages encouraging action urgently or quickly
   Users must be aware of any unexpected or unprompted emails asking for payment, personal information or other immediate action. For example, a Sudden pop-up or notification that changes the login information for an application should be considered suspicious.
6. Verifying
   the real sender
   The user can conduct a reverse IP lookup or an email spoofing act to verify the real sender or where the email came from. An online reverse IP lookup tool can be used to identify the domain name associated with the IP address. An email spoofing attack is noticed when an IP address is founded, which is different from where the email supposedly came from.
7. Email signing certificates are used.
   In terms of protecting outgoing emails, an email signing certificate can be used to encrypt email. It can ensure that the original sender sends the message because it allows applying a digital signature instead of someone spoofing your email address. Due to this, only the intended recipient can access the content within the message.
   These certificates include and apply asymmetric encryption to the email that uses a public key to encrypt the email and send it to the recipients. For decrypting the message, the recipients have the private key, due to which the message is securely received. In this way, the message is protectively sent and received.
8. Use of anti-malware software
   Anti-malware software is designed to identify & then block suspicious websites and prevent spoofing attacks by detecting them. Anti-malware software can identify a suspicious email or sender; suddenly, it can stop the email from ever reaching the user's inbox. This can work like a force field to protect the system from spoofed emails even when they cannot be stopped at the source.
9. Technical precaution
   Some technical precautions can be taken to prevent email spoofing, like using a subdomain, which can make it harder to spoof the mail. For example, users can use @help.yourcompany.com instead of @yourcompany.com.
   A company can take technical precautions by having its own IT team, which can update the Domain Name System (DNS) by adding two mailbox exchange records and a sender policy framework. With these records, the company domain can allow a verified third party to send emails on behalf of its domain. After setting this, all the messages from the third party are routed by the mail server to the custom domain.
10. Other precaution
    Using software-based anti-spoofing measures, users can also opt to protect the organization from domain and email spoofing attacks. Some basic knowledge and training about attacks empower team members to protect themselves and the organization by keeping an eye out for things that raise suspicion.
11. Try to avoid strange or unfamiliar attachments & links.
    To prevent email spoofing, users must avoid suspicious attachments or links. Before clicking, it's mandatory to see the source of the link by tapping or right-clicking it. If you find anything suspicious about the link, this technique may help to reveal its source. Before opening the attachment or link, it should be carefully examined, including email content, subject line and file extension. The user must clear the data after finding any strange link extension on the attached file.
12. Cyber awareness training
    Awaking the employee about the various phishing and email spoofing techniques can help the organization achieve the best results. Employees should be provided regular training with educational programs specially designed to equip employees with the ability to spot and handle modern email spoofing tactics. Teaching methods and training materials should be updated to reflect new development in email spoofing. It includes the preventive measures and methods of handling a situation when an email spoofing attempt is discovered.