public:emai:malware

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
Next revisionBoth sides next revision
public:emai:malware [2023-03-09 09:41] – veselypublic:emai:malware [2023-03-09 12:11] – vesely
Line 12: Line 12:
  
 **The generously opened and heterogeneous nature of the academic and research institution is extremely vulnerable to such kind of threat.** Regular enterprises and other profit-making businesses are usually much more homogenous with much simpler rules and measures against the third parties (no IMAP, no access to emails from non-business devices, strict mobile device management, blocked or limited traffic etc.). **The generously opened and heterogeneous nature of the academic and research institution is extremely vulnerable to such kind of threat.** Regular enterprises and other profit-making businesses are usually much more homogenous with much simpler rules and measures against the third parties (no IMAP, no access to emails from non-business devices, strict mobile device management, blocked or limited traffic etc.).
- + <font inherit/inherit;;#f39c12;;inherit>**Both areas**</font>  of 
-Both areas of malicious or potentially problematic emails and regular emails are overlapping; it is not easy to distinguish between them sometimes.+ <font inherit/inherit;;#c0392b;;inherit>**malicious or potentially problematic emails**</font>  and 
 + <font inherit/inherit;;#339933;;inherit>**regular emails**</font>  ** <font inherit/inherit;;#f39c12;;inherit>are overlapping</font> **; it is not easy to distinguish between them sometimes.
  
 **The most dangerous threats are usually those of the "zero day attack" nature**; they usually take advantage of badly protected or misprotected email servers and domains so they can mimic the regular sender.\\ **The most dangerous threats are usually those of the "zero day attack" nature**; they usually take advantage of badly protected or misprotected email servers and domains so they can mimic the regular sender.\\
Line 43: Line 44:
   * [[:public:emai:malware#bad_dmarc|Bad DMARC]] -   * [[:public:emai:malware#bad_dmarc|Bad DMARC]] -
  <font inherit/inherit;;#f39c12;;inherit>[Bad DMARC]</font>  - the sender's domain does not have DMARC record and SPF set properly.  <font inherit/inherit;;#f39c12;;inherit>[Bad DMARC]</font>  - the sender's domain does not have DMARC record and SPF set properly.
-  * [[:public:emai:malware#bad_dmarc|Bad ARC]] -+  * [[:public:emai:malware#arc|Bad ARC]] -
  <font inherit/inherit;;#f39c12;;inherit>[Suspicious - bad ARC]</font>  - the sender's email has ARC Seal but it's validation did not succed (e.g. invalid calculated email hash).  <font inherit/inherit;;#f39c12;;inherit>[Suspicious - bad ARC]</font>  - the sender's email has ARC Seal but it's validation did not succed (e.g. invalid calculated email hash).
   * [[:public:emai:malware#ip_reputation_database_-_dnsbl|DNSBL listed]] -   * [[:public:emai:malware#ip_reputation_database_-_dnsbl|DNSBL listed]] -
Line 77: Line 78:
 **Example of spoof email:** **Example of spoof email:**
  
-MAIL FROM: **johndoe2 <font inherit/inherit;;#2980b9;;inherit>@gmail.com</font> ** \\ +MAIL FROM: **johndoe2 
-From: **john.doe <font inherit/inherit;;#d35400;;inherit>@cerge-ei.cz</font> ** \\ + <font inherit/inherit;;#2980b9;;inherit>@gmail.com</font> ** \\ 
-To: **jane.dow <font inherit/inherit;;#d35400;;inherit>@cerge-ei.cz</font> **+From: **john.doe 
 + <font inherit/inherit;;#d35400;;inherit>@cerge-ei.cz</font> ** \\ 
 +To: **jane.dow 
 + <font inherit/inherit;;#d35400;;inherit>@cerge-ei.cz</font> **
  
 Such email is suspicious. Some user with an account at Gmail (johndoe2@gmail.com) set his profile to use institutional email address (john.doe@cerge-ei.cz). \\ Such email is suspicious. Some user with an account at Gmail (johndoe2@gmail.com) set his profile to use institutional email address (john.doe@cerge-ei.cz). \\
Line 195: Line 199:
 </code> </code>
  
-https://en.wikipedia.org/wiki/Authenticated_Received_Chain+[[https://en.wikipedia.org/wiki/Authenticated_Received_Chain|https://en.wikipedia.org/wiki/Authenticated_Received_Chain]]
  
-https://dmarc.org/presentations/ARC-Overview-2016Q3-v01.pdf+[[https://dmarc.org/presentations/ARC-Overview-2016Q3-v01.pdf|https://dmarc.org/presentations/ARC-Overview-2016Q3-v01.pdf]]
  
 ===== Reputation databases - Blacklists ===== ===== Reputation databases - Blacklists =====
Line 259: Line 263:
 Certain sort of newsletter senders wants to track recipients clicks (to monetize and/or monitor recipient behavior) so they conceal the target URL behind their own hash. It is then undecidable whether the redirected URL is OK or not (phishing). Certain sort of newsletter senders wants to track recipients clicks (to monetize and/or monitor recipient behavior) so they conceal the target URL behind their own hash. It is then undecidable whether the redirected URL is OK or not (phishing).
  
-**Example** +**Example** <font inherit/inherit;;#c0392b;;inherit>**Obfuscated/unresolvable link**:</font>  If you get the newsletter from **bostonglobe.com**  with links in the form [[https://bostonglobe.us11|https://bostonglobe.us11]].**list-manage.com/track/click?u=90f9e490a86&id=0c98f5&e=e8fef**  , it cannot be said what is the targeting URL. Hence the ** <font inherit/inherit;;#c0392b;;inherit>warning about uncertain content is added</font> **.
- <font inherit/inherit;;#c0392b;;inherit>**Obfuscated/unresolvable link**:</font> If you get the newsletter from **bostonglobe.com**  with links in the form [[https://bostonglobe.us11|https://bostonglobe.us11]].**list-manage.com/track/click?u=90f9e490a86&id=0c98f5&e=e8fef**  , it cannot be said what is the targeting URL. Hence the ** <font inherit/inherit;;#c0392b;;inherit>warning about uncertain content is added</font> **.+
  
 ** <font inherit/inherit;;#27ae60;;inherit>Regular/direct link</font> **: If the newsletter from **newyorker.com**  contains links in the form [[https://link|https://link]].**newyorker.com/view/5dc1b3fc91f4/03075c2d**  , it may be tracked down to the target URL and **is considered safe**. ** <font inherit/inherit;;#27ae60;;inherit>Regular/direct link</font> **: If the newsletter from **newyorker.com**  contains links in the form [[https://link|https://link]].**newyorker.com/view/5dc1b3fc91f4/03075c2d**  , it may be tracked down to the target URL and **is considered safe**.
Line 310: Line 313:
 //Added subject tag: [Suspicious - header analysis]// //Added subject tag: [Suspicious - header analysis]//
  
-//Added warning text: "Deepheader analysis examines header for spam characteristics. Don't click any link unless you are certain it's legitimate.////"// +//Added warning text: "Deepheader analysis examines header for spam characteristics. Don't click any link unless you are certain it's legitimate.////"// <font inherit/inherit;;#c0392b;;inherit>Tool to examine message header (displays human-readable content):</font> [[https://mha.azurewebsites.net/|https://mha.azurewebsites.net/]]
- <font inherit/inherit;;#c0392b;;inherit>Tool to examine message header (displays human-readable content):</font> [[https://mha.azurewebsites.net/|https://mha.azurewebsites.net/]]+
  
 Deepheader analysis examines the entire message header for spam characteristics. Deepheader analysis examines the entire message header for spam characteristics.
  • /var/www/html/dokuwiki/data/pages/public/emai/malware.txt
  • Last modified: 2023-03-09 12:13
  • by vesely