Email spoofing is the creation of
email
Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic ( digital) version of, or counterpart to, mail, at a time when "mail" meant ...
messages with a
forged
Forging is a manufacturing process involving the shaping of metal using localized compressive forces. The blows are delivered with a hammer (often a power hammer) or a die. Forging is often classified according to the temperature at which it ...
sender address. The term applies to email purporting to be from an address which is not actually the sender's; mail sent in reply to that address may bounce or be delivered to an unrelated party whose identity has been faked.
Masked email
A mask is an object normally worn on the face, typically for protection, disguise, performance, or entertainment and often they have been employed for rituals and rights. Masks have been used since antiquity for both ceremony, ceremonial an ...
is a different topic, providing a "masked" email address that is not the user's normal address, which is not disclosed (for example, so that it cannot be
harvested), but forwards mail sent to it to the user's real address.
The original transmission protocols used for email do not have built-in authentication methods: this deficiency allows
spam
Spam may refer to:
* Spam (food), a canned pork meat product
* Spamming, unsolicited or undesired electronic messages
** Email spam, unsolicited, undesired, or illegal email messages
** Messaging spam, spam targeting users of instant messaging ( ...
and
phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
emails to use spoofing in order to mislead the recipient. More recent
countermeasures
A countermeasure is a measure or action taken to counter or offset another one. As a general concept, it implies precision and is any technological or tactical solution or system designed to prevent an undesirable outcome in the process. The fi ...
have made such spoofing from internet sources more difficult but not eliminated it; few internal networks have defenses against a spoof email from a colleague's
compromised computer on that network. Individuals and businesses deceived by spoof emails may suffer significant financial losses; in particular, spoofed emails are often used to infect computers with
ransomware
Ransomware is a type of malware from cryptovirology that threatens to publish the victim's personal data or permanently block access to it unless a ransom is paid off. While some simple ransomware may lock the system without damaging any files, ...
.
Technical details
When a
Simple Mail Transfer Protocol (SMTP) email is sent, the initial connection provides two pieces of address information:
* MAIL FROM: - generally presented to the recipient as the ''Return-path:'' header but not normally visible to the end user, and by default ''no checks'' are done that the sending system is authorized to send on behalf of that address.
* RCPT TO: - specifies which email address the email is delivered to, is not normally visible to the end user but ''may'' be present in the headers as part of the "Received:" header.
Together, these are sometimes referred to as the "envelope" addressing – an analogy to a traditional
paper envelope. Unless the receiving mail server signals that it has problems with either of these items, the sending system sends the "DATA" command, and typically sends several header items, including:
* From: Joe Q Doe
- the address visible to the recipient; but again, by default no checks are done that the sending system is authorized to send on behalf of that address.
* Reply-to: Jane Roe - similarly not checked
and sometimes:
* Sender: Jin Jo - also not checked
The result is that the email recipient sees the email as having come from the address in the ''From:'' header. They may sometimes be able to find the ''MAIL FROM'' address, and if they reply to the email, it will go to either the address presented in the ''From:'' or ''Reply-to:'' header, but none of these addresses are typically reliable, so automated bounce message
A bounce message or just "bounce" is an automated message from an email system, informing the sender of a previous message that the message has not been delivered (or some other delivery problem occurred). The original message is said to have "boun ...
s may generate backscatter
In physics, backscatter (or backscattering) is the reflection of waves, particles, or signals back to the direction from which they came. It is usually a diffuse reflection due to scattering, as opposed to specular reflection as from a mirror, a ...
.
Although email spoofing is effective in forging the email address, the IP address
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
of the computer sending the mail can generally be identified from the "Received:" lines in the email header. In malicious cases, however, this is likely to be the computer of an innocent third party infected by malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...
that is sending the email without the owner's knowledge.
Malicious use of spoofing
Phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
and business email compromise (see below) scams
A confidence trick is an attempt to defraud a person or group after first gaining their trust. Confidence tricks exploit victims using their credulity, naïveté, compassion, vanity, confidence, irresponsibility, and greed. Researchers have def ...
generally involve an element of email spoofing.
Email spoofing has been responsible for public incidents with serious business and financial consequences. This was the case in an October 2013 email to a news agency which was spoofed to look as if it was from the Swedish company Fingerprint Cards
Fingerprint Cards is a Swedish biometrics company that develops and produces biometric systems. Fingerprint Cards was founded in 1997 by Lennart Carlson.
Their products consist of fingerprint sensors, algorithms, packaging technologies and softw ...
. The email stated that Samsung
The Samsung Group (or simply Samsung) ( ko, 삼성 ) is a South Korean multinational manufacturing conglomerate headquartered in Samsung Town, Seoul, South Korea. It comprises numerous affiliated businesses, most of them united under the ...
offered to purchase the company. The news spread and the stock exchange rate surged by 50%.
Malware such as Klez and Sober
In cryptography, SOBER is a family of stream ciphers initially designed by Greg Rose of QUALCOMM Australia starting in 1997. The name is a contrived acronym for ''S''eventeen ''O''ctet ''B''yte ''E''nabled ''R''egister. Initially the cipher wa ...
among many more modern examples often search for email addresses within the computer they have infected, and they use those addresses both as targets for email, and also to create credible forged ''From'' fields in the emails that they send. This is to ensure that the emails are more likely to be opened. For example:
# Alice is sent an infected email which she opens, running the worm code.
# The worm code searches Alice's email address book and finds the addresses of Bob and Charlie.
# From Alice's computer, the worm sends an infected email to Bob, but is forged to appear as if it was sent by Charlie.
In this case, even if Bob's system detects the incoming mail as containing malware, he sees the source as being Charlie, even though it really came from Alice's computer. Meanwhile, Alice may remain unaware that her computer has been infected, and Charlie does not know anything about it at all, unless he receives an error message from Bob.
''How does email spoofing differ from spam and email phishing?''
The main difference between spam and a spoofed message is that spammers don't edit email headers to pretend the email was sent from someone else. Both phishing and spoofing emails aim to trick someone to believe the message was sent from a legitimate sender. However, the main phishers' intent is to compromise user personal and financial information, while spoofing emails is just one of the ways they use to do so.
The effect on mail servers
Traditionally, mail servers could accept a mail item, then later send a Non-Delivery Report or "bounce" message if it couldn't be delivered or had been quarantined for any reason. These would be sent to the "MAIL FROM:" aka "Return Path" address. With the massive rise in forged addresses, best practice is now to ''not'' generate NDRs for detected spam, viruses etc. but to reject the email during the SMTP transaction. When mail administrators fail to take this approach, their systems are guilty of sending "backscatter
In physics, backscatter (or backscattering) is the reflection of waves, particles, or signals back to the direction from which they came. It is usually a diffuse reflection due to scattering, as opposed to specular reflection as from a mirror, a ...
" emails to innocent parties - in itself a form of spam - or being used to perform "Joe job
A Joe job is a spamming technique that sends out unsolicited e-mails using spoofed sender data. Early Joe jobs aimed at tarnishing the reputation of the apparent sender or inducing the recipients to take action against them (see also email spoof ...
" attacks.
Countermeasures
The SSL/TLS
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securi ...
system used to encrypt server-to-server email traffic can also be used to enforce authentication, but in practice it is seldom used, and a range of other potential solutions have also failed to gain traction.
A number of defensive systems have come into wide used, including:
* Sender Policy Framework
Sender Policy Framework (SPF) is an email authentication method designed to detect forging sender addresses during the delivery of the email. SPF alone, though, is limited to detecting a forged sender claim in the envelope of the email, which is ...
(SPF) an email authentication Email authentication, or validation, is a collection of techniques aimed at providing verifiable information about the origin of email messages by validating the domain ownership of any message transfer agents (MTA) who participated in transferring ...
method designed to detect forging sender addresses during the delivery of the email.
* DomainKeys Identified Mail
DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect forged sender addresses in email (email spoofing), a technique often used in phishing and email spam.
DKIM allows the receiver to check that an email claimed ...
(DKIM) an email authentication Email authentication, or validation, is a collection of techniques aimed at providing verifiable information about the origin of email messages by validating the domain ownership of any message transfer agents (MTA) who participated in transferring ...
method designed to detect forged sender addresses in email (email spoofing), a technique often used in phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
and email spam
Email spam, also referred to as junk email, spam mail, or simply spam, is unsolicited messages sent in bulk by email (spamming).
The name comes from a Monty Python sketch in which the name of the canned pork product Spam is ubiquitous, unavoida ...
.
* Domain-based Message Authentication, Reporting and Conformance
Domain-based Message Authentication, Reporting and Conformance (DMARC) is an email authentication protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing. Th ...
(DMARC) an email authentication Email authentication, or validation, is a collection of techniques aimed at providing verifiable information about the origin of email messages by validating the domain ownership of any message transfer agents (MTA) who participated in transferring ...
protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing. The purpose and primary outcome of implementing DMARC is to protect a domain from being used in business email compromise attacks
Email spoofing is the creation of email messages with a forged sender address. The term applies to email purporting to be from an address which is not actually the sender's; mail sent in reply to that address may bounce or be delivered to an unre ...
, phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
emails, email scams and other cyber threat
In computer security, a threat is a potential negative action or event facilitated by a vulnerability that results in an unwanted impact to a computer system or application.
A threat can be either a negative "intentional" event (i.e. hacking: a ...
activities.
To effectively stop forged email being delivered, the sending domains, their mail servers, and the receiving system all need to be configured correctly for these higher standards of authentication. Although their use is increasing, estimates vary widely as to what percentage of emails have no form of domain authentication: from 8.6% to "almost half". For this reason, receiving mail systems typically have a range of settings to configure how they treat poorly-configured domains or email.
Business email
Business email compromise attacks are a class of cyber crime
A cybercrime is a crime that involves a computer or a computer network.Moore, R. (2005) "Cyber crime: Investigating High-Technology Computer Crime," Cleveland, Mississippi: Anderson Publishing. The computer may have been used in committing th ...
that use email fraud
Email fraud (or email scam) is intentional deception for either personal gain or to damage another individual by means of email. Almost as soon as email became widely used, it began to be used as a means to defraud people. Email fraud can take th ...
to attack commercial, government and non-profit
A nonprofit organization (NPO) or non-profit organisation, also known as a non-business entity, not-for-profit organization, or nonprofit institution, is a legal entity organized and operated for a collective, public or social benefit, in co ...
organizations to achieve a specific outcome which negatively impacts the target organization. Examples include invoice scams and spear phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
spoof attacks which are designed to gather data for other criminal activities. A business deceived by an email spoof can suffer additional financial, business continuity
Business continuity may be defined as "the capability of an organization to continue the delivery of products or services at pre-defined acceptable levels following a disruptive incident", and business continuity planning (or business continuity a ...
and reputational damage: fake emails are a favored route for ransomware that can stop operations unless a ransom is paid; consumer privacy breaches can also be enabled.
Typically, an attack targets specific employee roles within an organization by sending a spoof email (or series of spoof emails) which fraudulently represent a senior colleague (CEO or similar) or a trusted customer. (This type of attack is known as spear phishing
Phishing is a type of Social engineering (security), social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker ...
). The email will issue instructions, such as approving payments or releasing client data. The emails often use social engineering Social engineering may refer to:
* Social engineering (political science), a means of influencing particular attitudes and social behaviors on a large scale
* Social engineering (security), obtaining confidential information by manipulating and/or ...
to trick the victim into making money transfers to the bank account of the fraudster.
The worldwide financial impact is large. The United States' Federal Bureau of Investigation
The Federal Bureau of Investigation (FBI) is the domestic intelligence and security service of the United States and its principal federal law enforcement agency. Operating under the jurisdiction of the United States Department of Justice, ...
recorded $26 billion of US and international losses associated with BEC attacks between June 2016 and July 2019.
Incidents
* Dublin Zoo lost €130,000 in such a scam in 2017 - a total of €500,000 was taken, though most was recovered.
* The Austrian aerospace firm FACC AG was defrauded of 42 million euros ($47 million) through an attack in February 2016 - and subsequently fired both the CFO and CEO.
* Te Wananga o Aotearoa in New Zealand was defrauded of $120,000 (NZD).
* The New Zealand Fire Service
The New Zealand Fire Service ( mi, Whakaratonga Iwi, "Service to the People"; also known as the NZFS) was New Zealand's main firefighting body from 1 April 1976 until 1 July 2017 – at which point it was dissolved and incorporated into the new ...
was scammed out of $52,000 in 2015.
* Ubiquiti Networks lost $46.7 million through such a scam in 2015.
* Save the Children USA
Save the Children Federation, Inc., commonly known as Save the Children USA, is a non-profit organization working to improve the lives of children in the United States and around the world. Their headquarters is located in Fairfield, Connectic ...
was the victim of a $1 million cyberscam in 2017.
*Australian organisations that reported business email compromise attacks on th
Australian Competition and Consumer Commission
suffered approximately $2,800,000 (AUD) in financial losses for the 2018 year.
*In 2013, Evaldas Rimasauskas and his employees sent thousands of fraud emails to get access to companies email systems.
See also
*
*
*
*
*
* that may be compromised
*
*
*
*
*
*
*
*
References
External links
*
{{Authority control
Email
Internet terminology
Practical jokes
Spamming
Cybercrime
Confidence tricks
Organized crime activity
Social engineering (computer security)
Types of cyberattacks
Deception
Fraud