Threat actors have devoted a lot of time to perfecting the sophistication of their attacks. One of the most successful is email spoofing. In these cases they send an email that appears to have come from a correct email address that is known or trusted, so these phishing email Spoofs that LOOK Legit. They accomplish this via using SMTP (Simple Mail Transfer Protocol) that are compromised and allow connections without authentication. In this way they can indicate the specific “To” and “From” addresses. They rely on the recipients to trust them and in doing so, it allows the senders to access everything from personal financial accounts to passwords.
In the cases of protected domain names, the cyber hacker will create a look-alike domain name that can be easily confused with the real one. In all of these cases there is usually the communication of a state of “urgency” to click on a link to log into the recipient’s account due to some form of problem. It’s important to note that there are three types of spoofing via email: spoofing from legitimate domains, spoofing in the display name and lookalike domain spoofing.
What you can do
If the email that you received has been lazy and just used a random email address, you can click on “reply all” to view who sent it. As stated above, this is not always a good indicator as they may have used a few methods to appear legitimate. If not, the email address will appear as an unknown address. You can check the metadata, and this will depend on the service that you are using and only works on a desktop/laptop. If you are using Gmail, you can click on the vertical three dots next to the button labeled “reply” and select “Show Original” from the list that drops down. For other services that you may be using, you can check this list. In some cases, well-known organisations have been hacked to get a list of all employees and spoof emails were sent out requesting personal information relating to their employment information. Never trust this kind of email as companies don’t ask for that kind of data via email.
Professional cybersecurity organisations such as DaVinci Cybersecurity recommend that you never respond to or click on any of the links within an email that you may be suspicious of. Most of the organisations that you work with such as your bank, investments, online ordering, or even other services will rarely send you any “urgent” emails. The exception to that rule might be if your credit card number has been stolen and in that case, your provider will call and email you. In that case, always go to the website of your provider and login there. Phishing email Spoofs that LOOK Legit can catch even the most tech savvy person.
The best way to protect yourself from falling prey to any of these spoofing attempts is to simply close out the email, open a fresh browser and log into your account at their official website. If there is anything wrong you will have a notification. They may also provide you with an email address that you can forward the spoofing email to for reporting. Some providers will offer a phone number to call for reports of fraudulent emails.
Test your domain to see how secure YOUR email is.
“DaVinci Cybersecurity maintains a constant list of the various forms of attacks that threat actors develop. Our staff works closely to advise and counsel to ensure that everyone understands methods used by these hackers and the ways that everyone can protect themselves and their personal information.”
Sharon Knowles, CEO DaVinci Cybersecurity
Source: cybernews.com/secure-email-providers/email-spoofing/
greenmail.net
Image Source: Canva
