{"id":6738,"date":"2018-07-16T12:27:30","date_gmt":"2018-07-16T16:27:30","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=6738"},"modified":"2023-05-17T12:08:49","modified_gmt":"2023-05-17T16:08:49","slug":"email-security-part-2-phishing-and-other-falseness","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/email-security-part-2-phishing-and-other-falseness\/","title":{"rendered":"Email Security \u2013 Part 2: Phishing and Other Falseness"},"content":{"rendered":"

Ask yourself, would PayPal really be asking me to update my password with an unbranded email originating from a strange domain?<\/h2>\n

Throughout history, people have preyed on one another’s ignorance and good nature for some sort of gain — whether monetary, power, or any other reason using lies and deception. Confidence Men are as old as time itself. Most scams can be evaded by simply recognizing the intent. Does that sound easier than it is? It does. As insight into these scams has become noted, the scam pitches became more convincing. Nothing makes recognizing career liars more difficult than having no physical interface with them. After all, human senses and intuition are useful tools when it comes to spotting scammers.<\/p>\n

In all my experience and education regarding security in technology, one truth sticks out and has been proven time and time again:\u00a0 the weakest link in any line of security is the user<\/a>. That, coupled with the sheer volume of possibilities, makes email a superior venue to hustle unsuspecting and trusting people.<\/span><\/p>\n

*Sigh* Yes, Jump Through the Hoops<\/h2>\n

Comedian, John Mulaney, has a good bit in his Netflix special Kid Gorgeous about the constant scrutinization that everyone faces to prove that we are not robots (warning: profanity in Facebook video link).<\/a> In it, he infers that we spend more time deciphering letters and pictures without stop signs than actually accessing our own content. It feels that way sometimes. And, we can expect that the evolution of hoop jumping will take some new twists and turns as robot programmers find a way to beat these Turing Tests (Here\u2019s Google\u2019s new AI having a go with success).<\/a> For now, these tests bolster security and really are worth it despite the pain that we all go through when executing those lines of security.<\/p>\n

\"EmailOther hoops, such as a MFA (Multi-factored Authentication), work well for authentication recovery\/reset but are time consuming. We have had our own pains using the AWS MFA hardware that appears to lose its syncing due to lack of NTP (Network Time Protocol). However, knowing that nearly everyone else is going through similar pains is a sure sign that people are who they say or propose they are.<\/p>\n

Despite all the hoop jumping, more than likely, everyone has had some sort of account compromised. I frequently get emails from \u201cmy brother\u201d that start with \u201cHi!\u201d There! Right there, I know that is not him. It is usually followed with something like, \u201cCheck this link out,\u201d and is, of course, followed by some shady link. The important takeaway here: I tell him. Every. Bloody. Time. He needs to know. I need to jump through that hoop. He needs to step up his password\/security but he needs to know. That\u2019s a hoop he needs to jump through not only for his sake but for the sake of all his contacts.\u00a0 Sadly, because of this, that email account has made my list of shadiness and I will take the extra measure of verifying with him.<\/p>\n<\/span><\/span>\n

Teach Me to Scrutinize Like You<\/h2>\n

Certain emails come through and they are clearly as advertised. You know your grandmother\u2019s written tone. You know your sales vendor\u2019s marketing template. But when you receive an email from your brother\u2019s account with a shady looking link? Well, that warrants some suspicion and the obvious stuff is just that: obvious. Certain cues may not be obvious, but they can certainly be spotted out. After all, spammers are not going for obvious.<\/p>\n

\"EmailOne thing to consider is that a lot, if not most, spam is generated by some sort of automated process (code or bot). That\u2019s not to say that wording is generated by a bot, but the bot would receive instruction from the perpetrator of what the email template should say (static context), how to propagate (spread the email out), and how the dynamically generated context is sourced and placed, e.g., a spreadsheet from compromised data containing things like names, email addresses, account IDs, etc. Most of these emails do contain a link that will attempt to run malicious scripts, capture certain system\/application data or trick the user into providing sensitive information to gain access to whatever they are phishing for.<\/p>\n

Unsure about an email received? Good. You should almost always be unsure. A good rule of thumb is to scrutinize everything by default and let the sender deal with the burden of proof that they are whom they say are. That\u2019s not to say that they need utter the secret password (\u2018Swordfish\u2019) every time there is communication, but they should strive to pass the eye test however that needs to be executed. We know that this verification can come from many places, as I briefly outlined in my first blog<\/a> and as I will \u201cdetail\u201d in the subsequent blog posts for this email security series.<\/p>\n

\"spam<\/p>\n

Coincidentally, while writing this post, I received this email (an image, not the email). Notice a few things about it? Let\u2019s confirm:<\/p>\n