Don’t Get Hit by the Whaler’s Harpoon

What is Whaling?Harpoon-Whaling

Chances are you’re familiar with the term Phishing, where scammers use social engineering tactics to get users to give up personal information such as financial data, Social Security numbers, or other highly confidential and valuable information. That email you received from the “IRS” asking for your Social Security number? Don’t fall for it!

You may have also heard of spear-phishing, a more targeted form of phishing where specific individuals on any staff level may be targeted. But are you aware of the dangers of whaling? No, I’m not talking about the kind that keeps marine conservationists up at night. I’m talking about phishing attacks that are highly personalized to target high level executives.

While phishing emails are sent out to multiple recipients in the hopes that one or more will fall for the scam, whaling emails are usually only sent to select individuals who have a great deal of influence in a company. They are designed to masquerade as critical business communications sent to someone of importance, such as a CEO or other business authority, in an attempt to get the recipient to give up personal or financial information. Often, these messages contain spoofed addresses claiming to come from someone within the company. It is also common for a whaling email to claim to be from the Better Business Bureau or FBI.

Many whaling emails will contain a link that installs malware or leads the user to a familiar looking website that will likely ask for your login information. What happens next is when the problems begin. You submit your username and password, and are told that your credentials are incorrect and that you should try again. Sounds pretty harmless so far, right? Behind the scenes, however, your information has already been captured, and you are then redirected to the legitimate website, where you are able to successfully login on your next attempt – completely unaware that you just submitted valuable information to a scammer. This is why we always stress that you never click on links in an email message unless you’re 100% certain that the message is legitimate and from the purported sender.

How do “Whalers” get past Spam Filters?

Cybercriminals often use similar domain names or free email addresses, pretending to be business executives. They are able to bypass many security measures because their messages often don’t include malware links or attachments. And because they don’t typically contain links, and are often more well-written than the standard phishing attack, they are able to slip past spam filters more easily.

Do Executives Really Fall for These Scams? The Scary Statistics on Whaling

Whaling works because people often fall for these scams. The following high-level cases illustrate how lucrative the whaling business is for scammers:

In the 2008 US District Court subpoena whaling scheme, 20,000 CEOs were targeted. Approximately 2000 of them fell victim to this scheme & clicked on the malicious link in the email, which led to a key logger that secretly recorded the CEO’s passwords. It then led to further hacking attacks on the affected companies, resulting in significant financial loss or damage to company reputation.

Here is an example of the fake subpoena email. It looks official to the untrained eye, but notice the From address, which uses the domain of uscourts.com. The official domain of the US Court system is uscourts.gov, not uscourts.com. Also, it’s worth noting that official court business is never sent via email.

USCourtsWhaling

In 2015, Mattel lost $3 million in a whaling scheme in which a finance executive responded to a bogus funds transfer request claiming to come from the company’s new CEO.

In the first quarter of 2016, 41 companies were hit with phishing attacks targeting employee tax records.

More recently, the CEO of an Austrian aircraft parts manufacturer was let go after the company lost €40.9 million ($48 million USD) to a whaling attack.

And earlier this year, a 48 year-old Lithuanian man was charged with attacks on Facebook and Google. In his high-profile phishing attacks, he used forged invoices, contracts, and letters that looked like they had been signed by a company whose name he had mimicked by registering a company in Latvia with a name similar to that of a legitimate Asian-based vendor.

How do I recognize a whaling email?

So how do you know when you’re being targeted in a whaling attack? Here are some common whaling identifiers to look for in inbound email messages:

  • Is the name of the sender the same as one of my user names?
  • Is the sending domain similar to one of my domains?
  • Is the domain well-established, or is it a newly-created domain used specifically for attack purposes?
  • Does the email contain common whaling keywords, such as wire transfer, payment, etc.?

An email containing just one of these characteristics may not necessarily be a threat. For example, if the CEO’s name is John Smith, an email from another John Smith might not raise any red flags, especially considering how common this name is. But if you receive an email from John Smith that has one or more of the other characteristics listed above, such as one containing a request for payment, then you should treat it with extra scrutiny.

Avoiding whaling attacks is the responsibility of both management staff and employees alike. Follow these tips to help protect your business from falling victim.

Educate Senior Management Staff

One of the reasons spear phishing and whaling are so effective is that they target named individuals in executive or financial positions within an organization, and they often appear to come from someone known and trusted by the recipient, such as a colleague. Clever social engineering techniques are used to reel in these “big fish.” Senior management, financial staff and employees in other key roles should be educated on the effects of whaling attacks and how to spot them. They should learn to recognize common characteristics of phishing attacks like spoofed sender addresses, requests for funds transfer, unrecognized attachments, and spoofed hyperlinks. Let’s look at a few examples.

Example: Sender registered a domain similar to the company’s domain.

As you can see in this example, the sending domain looks similar to a legitimate domain, but if you look further, the domain is one digit off from the real domain.

SimilarDomain

Example: Display Name spoofing.

Does the display name in the From field match the email address?  In this example, I know my bank does not own the “fakedomain.com” domain. This is an example of display name spoofing, which is very common.

Spoofing

Example: FROM address spoofing.

Another common spoofing technique is From address spoofing. Any spammer can spoof any email address, making it look like the message came from a legitimate source. This works because email messages contain two sets of addresses – the envelope address and the message header address. I’ll explain further using U.S. postal mail as an example.

When sending a letter via US Mail, the sender needs an envelope, the address of the intended recipient, and the contents of the message (e.g. message body or letter). The sender places the address of the intended recipient on the envelope, but the recipient’s address usually appears inside the envelope as well, usually at the top of the letter. The address on the envelope is where the letter is sent, not the address on the letter itself. Thus, these addresses can be completely different.

Email works in a similar way. Like U.S. Mail, email messages also have two sets of addresses – the envelope addresses, where the message is actually from and who it is addressed to, and the address in the message header, which is what the user sees in the To: and From: fields in the message. These addresses do not have to match for the message to be delivered. Most spam messages contain spoofed From (header) addresses.

In the following example, the message appears to come from john.smith@example.com, but closer examination reveals that it actually came from frank.thomas@example.com. Most mail servers and email security products should have mechanisms in place to detect this kind of spoofing, such as reverse lookups, SPF, DKIM and DMARC, but users should be aware of this common technique used by spammers.

AddressSpoofing

Keep Personal Information Private

Scammers who want to steal your personal and financial information will look for publicly available information on social media and various other sites. Management staff should have as little personal information visible to the public as possible, including birthdays, interests, and friends and family. Social media users should review their privacy settings to ensure that this data remains hidden from the public.

Establish a Verification Process

If an employee receives an email requesting financial information, funds transfers, or other business-critical information that is not typically handled by email, verify the request from the sender via another channel such as a phone call. Companies should have documented processes on how these requests should be handled.

Protect against Data Leaks

Implement a software-based data loss prevention solution such as SecurityGateway that intercepts sensitive data and quarantines it before it has a chance to leave your network. Data Leak Prevention techniques scan email messages and attachments for highly sensitive information such as Social Security or Tax-ID numbers, bank account numbers, and passport numbers.

SecurityGateway for Email Servers

Questions or Comments?

Phishing and whaling scams have been going on for years, and they will continue as long as human nature dictates that people will fall for these scams. Don’t be the next victim. Arm yourself with the facts and your email infrastructure with the tools to avoid the whaler’s harpoons! If you have questions about our email safety recommendations, leave us a comment below!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

10 Ways to Reduce Spam in Your Inbox

SpamBefore the invention of email, mail that arrived in your physical mailbox often contained pamphlets, sales brochures, credit card offers, and product catalogs. Much of this waste was thrown away and ended up in a landfill somewhere. Today, the equivalent and often more annoying nuisance is spam. Spam comes in many forms. Some examples include dubious product claims, miracle supplements, conspiracy theories, and offers of easy money.

Spam statistics are staggering. More than 100 billion spam messages are sent every day, representing around 85 percent of global email traffic.

So what can be done about this spam epidemic? There are numerous spam fighting tools in MDaemon and other mail servers, but server-side tools are only half of the spam-fighting equation. The other half is user education. With this in mind, here are 10 things users can do to reduce the amount of spam they receive.

  1. Unsubscribe – How often have you been asked by a store clerk for your email address or placed an order online? In either of these situations, chances are you may have ended up on a company’s mailing list. When you receive email from these companies, take the time to open the message and click on the Unsubscribe link. But first, make sure the email is in fact coming from a reputable company. If you’re not completely sure where the email came from, then report the message as spam instead of unsubscribing.
  2. Create a secondary email account – While we’re on the topic of retailers having your email address, you might also consider having a second email address that’s used solely for the purpose of store records or placing orders. This allows you to keep solicitations from these vendors out of your primary inbox.
  3. Keep your email address private – If your email address is visible on social networking sites like Facebook or Twitter, then it’s also visible to spammers. Spammers have tools that can easily detect visible email addresses and add them to their mailing lists. This is why it’s often recommended that, if you MUST use your email address on one of these sites, you mask it by changing its format. For example, type out “at” instead of using the “@” symbol.
  4. Before you join a list, make sure the list owner cannot sell your email address – If the list you’re joining has a privacy policy, read it thoroughly and make sure your information cannot be sold to a third party.
  5. Don’t reply to ANY spam or unsolicited marketing messages – Most spam messages use forged sender (return-path) addresses, so replying to a spam message will almost never result in the spammer getting your message. Replying to legitimate marketing messages tells the sender that your email address is valid, and thus, they may continue to send you spam.
  6. Never click on links – Often, when you click on a link in a spam email, it specifically identifies you to the spammer as having received the message. Not only can clicking links in spam messages identify you to the spammer; you can also end up getting infected with malware.
  7. Block Images – Even if you don’t click any links, an image opening in your email can alert spammers to a valid address. Spammers often try to be stealthy by inserting images that are only one pixel wide. If your mail client is configured to automatically open images, spammers can be alerted that your email address is valid. We recommend configuring your email client to automatically block images to reduce spam. You can always choose to view images in specific emails if you are sure the sender and content are legitimate.
  8. Make your email address unique – Spammers often use common names to try to guess email addresses. If your email address is unique, it makes it harder for spammers to guess your email address.
  9. Don’t fall for scams – If you receive an anonymous email from someone who appears to be in dire need, who promises you large sums of money for your small up-front investment, you may be witnessing the familiar Nigerian email scam, or one of many other variants. What are the odds that someone you’ve never met, who’s in a desperate situation, would contact you for help? Don’t fall for this scam.
  10. Never forward email from someone you don’t know – I often see email messages with some type of public service announcement, petition, or other bit of advice, and often, there’s a request to forward the message to your friends. Don’t fall for this, as it’s a prime opportunity for spammers to harvest email addresses.

Blocking junk email is not just the job of the mail server administrator. A well-informed email user can mean the difference between spam that is manageable and spam that is out of control. These ten tips will help you reduce spam, and help prevent you from becoming a victim to phishing or malware.

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Get Aggressive at Fighting Spam by Re-training the Bayesian Learning Process in MDaemon

Fight spam with Bayesian Learning in MDaemon

In certain situations, it may be necessary to retrain your Bayesian Learning database. This can be necessary when spam messages are inadvertently placed in the Bayes non-spam folder, or when non-spam messages are placed in the Bayes spam folder.

To reset your Bayesian Learning and start training it again from scratch, you can perform the following steps:

1. Stop the MDaemon service.
2. Verify that the MDaemon executables (MDaemon.exe, CFEngine.exe, MDSpamD.exe, WorldClient.exe) have all exited memory using Windows task manager.
3. Rename the folder “/MDaemon/SpamAssassin/Bayes/” to”/MDaemon/SpamAssassin/Bayes.old/”
4. Re-launch MDaemon.
5. Go to Security | Spam Filter | Bayesian Classification, then click on the Learn button.

At this point, MDaemon recognizes that the Bayes folder isn’t there when the learn process is triggered, so it builds a new Bayes folder.

You will then need to feed Bayesian learning at least 200 spam and 200 non-spam messages (although the more the better) to start the Bayesian learning process again. Here is a knowledge base article on training the Bayesian learning process in MDaemon.

The Bayesian learning engine won’t process new messages until the administrator has taught it 200 spam and 200 non-spam messages. So even if an administrator were to manually press the Learn button OR have MDaemon learn automatically at midnight, the Bayesian engine  wouldn’t apply itself to new messages even though the new folder is created.

Once MDaemon recognizes that Bayesian learning has learned more than 200 spam and 200 non-spam messages, it will start applying what it has learned to new messages.

You can run a script to determine how many messages the Bayesian filter has learned from. This will come in handy for administrators who need to know how many more messages to feed the Bayesian filter. This process is explained in this knowledge base article.

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Beware of New Amazon.com Phishing Scam

Scam AlertThe holidays are upon us, and with all of the giving and sharing come scams aimed at exploiting human nature and stealing our personal information, such as names, addresses and credit card numbers. This year, the scammers are at it again, with a phishing scam designed to look like an email from Amazon.com claiming that there is a problem processing your order. The scam asks you to click on a link to verify your personal information. A good example of this scam email is described on the AARP blog.

As a reminder, here are a few tips to avoid falling victim to phishing scams.

  • Never click on unfamiliar or suspicious links. If a link claims to refer to a familiar website, then manually enter the web address in the address bar.
  • Hover your mouse over images & links to review the URL they refer to.
  • Beware of “Unsubscribe” links in phishing emails. When clicked, these links can let the spammer know that your address is valid, which often leads to more spam.
  • Never reply to spam or unsolicited messages.

For more tips on how to avoid these & other scams, click here to review our post on protecting your email privacy, and stay safe this holiday season!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Quarantine Management with WorldClient Private Email

WorldClient Private Email makes spam management easy by providing users with the email and collaboration features found in WorldClient, MDaemon’s webmail client, and the security and spam filtering features found in SecurityGateway. This tutorial video covers the following topics:

  • How to allow users to manage their own quarantines in SecurityGateway
  • Quarantine management via the Quarantine Summary Email, and how often this email is sent to users
  • When to whitelist or blacklist the sender, and when & how to release a message from quarantine
  • Quarantine management via the SecurityGateway interface
  • Feeding the Bayesian spam and non-spam database – to improve the spam filter’s accuracy

Spam doesn’t have to be an overwhelming nuisance. When these practices are followed, spam is kept under control so you can spend less time dealing with spam and more time focusing on your business.

If you are interested in our WorldClient Private Email hosted email service, click here for pricing and features, or click here to sign up!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Training the Bayesian Spam Learning Engine in WorldClient

MDaemon’s built-in spam filter includes a feature known as Bayesian Learning. Bayesian Learning allows MDaemon to “learn” what types of messages are spam and what types are not spam. This allows the spam filter to become more accurate over time.

It is important for users to properly train the Bayes system so that messages are correctly flagged as spam or non-spam. We do not recommend blacklisting the sender of spam messages because this does not help the Bayes engine learn from the message, and thus, has no effect on reducing spam. The easiest way to train the Bayes engine is for users to use the thumbs-up and thumbs-down icons in WorldClient (MDaemon’s webmail client) to feed the Bayes engine samples of spam and non-spam. The more spam and non-spam samples you feed to the Bayes engine, the more accurate the spam filter will become over time, thus, it is very important for users to use the thumbs-down icon on every spam message – whether it arrives in your Inbox or in your Junk Email folder. Likewise, for every false-positive (legitimate, non-spam message that is flagged as spam), you can use the thumbs-up icon to flag the message as non-spam.

This knowledge base article provides a more thorough explanation of Bayesian Learning and how to train the Bayesian Learning engine.

This video explains further.

If you are an end user and you do not see the thumbs-up and thumbs-down icons in WorldClient, the MDaemon administrator can take steps outlined in this video and blog post to make those icons appear.

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Backscatter Protection in SecurityGateway

As we discussed in an earlier post, messages that users may receive in response to messages they never actually sent (due to their email addressed having been forged in a spam message’s return-path) are known as backscatter. In that post, we discussed what backscatter is and explained how to enable Backscatter Protection in MDaemon.

In today’s video tutorial, I show you how to enable Backscatter Protection in SecurityGateway.

Do you have questions or comments? Let us know via the Comments section below, or if you need support or further assistance, several options are available for you via our Support page.

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Are You Receiving Replies to Messages you Never Sent?

Image "Return to Sender"

Have you ever logged into your email to find tons of bounce-back messages (out-of-office replies, NDR messages, invalid recipient messages) in response to messages you never sent? For many users, their first thought is that they need to change their email password. However, changing your email password will not prevent this. Why? Because what you are receiving is known as backscatter, and has nothing to do with your email account being hacked.

Spammers often forge the return-path in their outbound messages to cover up their true identity. If the forged address in these spam messages was your address, then you are likely to receive the bounce-back messages and auto-responders in response to these messages.

So how do you prevent this? MDaemon includes Backscatter Protection. Backscatter Protection works by adding a special key to the return-path of all outbound mail. When MDaemon receives an out-of-office reply or non-delivery message, it looks for that special key. If the key is missing, then we know the bounce-back message is not legitimate and can be discarded.

When Backscatter Protection is disabled, the return-path of a message looks like this:
X-Return-Path: frank.thomas@example.com

When Backscatter Protection is enabled, an extra series of characters beginning with prvs= is added to the return path – like this:
X-Return-Path: prvs=163898ff65=frank.thomas@example.com

It is this extra series of characters that the Backscatter Protection feature looks for in bounce-back messages.

Check out the following video to learn more about Backscatter Protection and how to enable it in MDaemon. If you have questions, please feel free to leave us a comment & let us know!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

MDaemon Spam Filter Deep-Dive Webinar

In addition to its built-in spam filter, MDaemon includes many other security features that can be used to fight spam. In this webinar, we take you through an in-depth explanation of MDaemon’s spam-fighting features, and discuss recommended settings for best results.

 

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Spam Fighting Techniques – An Article from AllSpammedUp

An article that discusses various spam filtering techniques was recently posted on AllSpammedUp, and I wanted to share it with you because it contains some valuable information on fighting spam.

There isn’t a single, “one size fits all” way to catch all spam. Spam filters use various techniques, such as backlists and whitelists, Bayesian analysis, trend analysis, heuristic analysis, word lists, and much more. These days, spammers are aware of many of the anti-spam techniques that are used, and they are constantly trying to find ways around these techniques by altering the spelling of keywords, forging headers and addresses, sprinkling words from literature throughout the message, and other techniques.

The article talks about using trend analysis, content filtering, word lists, blacklists, Sender Policy Framework (SPF), and Challenge-Response.

You can read the original article here:
http://www.allspammedup.com/anti-spam/

MDaemon includes many tools for fighting spam, including SPF & SenderID, heuristic analysis, Bayesian Learning, IP Shielding, spam filter blacklists, reverse lookups, and much more.

SPF & SenderID provide a way for a receiving server to determine if an incoming message came from a location that was authorized to send mail from the sender’s domain. You can learn more about SPF here:
http://www.altn.com/Support/KnowledgeBase/KnowledgeBaseResults/?Number=KBA-01560

And here is a short video on how SPF works, and how to enable it in MDaemon:
http://www.altn.com/Tutorials/Video-Post/?vid=mp4:eLearn-MD_SPF.f4v

DomainKeys Identified Mail (DKIM) is an anti-spoofing technique that uses an encrypted public key, published in DNS, and each message is signed with a private key. The private & public keys are compared for a match. This video will demonstrate how DKIM works:
http://www.altn.com/Tutorials/Video-Post/?vid=mp4:eLearn-MD_DKIMIntroVrf.f4v

Tarpitting and greylisting are other spam fighting techniques. Tarpitting will slow the connection down once a specified number of RCPT commands have been given. This is to discourage spammers from sending bulk mail through your server. You can learn how to set up tarpitting in this video:
http://www.altn.com/Tutorials/Video-Post/?vid=mp4:eLearn-MD_TarpitConfig.f4v

Greylisting is a technique that exploits the fact that SMTP servers retry delivery of a message that receives a temporary “Try again later” error. Using this technique, when a message arrives from a non-white listed or otherwise previously unknown sender, its sender, recipient, and sending server’s IP address will be logged and then the message will be refused by Greylisting during the SMTP session with a temporary error code. Then, for a designated period of time (say, 15 minutes) any future delivery attempts will also be temporarily refused. Because spammers do not typically make further delivery attempts when a message is refused, greylisting can significantly help to reduce the amount of spam your users receive. But, even if the spammers should attempt to retry delivery at a later time, it is possible that by that time the spammers will have been identified and other spam-fighting options (such as DNS blacklists) will successfully block them. This video explains how greylisting works & how to set it up in MDaemon:
http://www.altn.com/Tutorials/Video-Post/?vid=mp4:eLearn-MD_Greylisting.f4v

Be sure to feed your Bayesian Learning filters with examples of spam and non-spam messages. Here’s more information on training the Bayesian Learning process:
http://www.altn.com/Support/KnowledgeBase/KnowledgeBaseResults/?Number=KBA-01746

These are just a few of the many spam fighting tools in MDaemon. One single spam-fighting technique may not be good enough to thwart the spammers, but when all anti-spam tools are used together, your spam filter can be surprisingly effective.

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •