Introduction to Email Threats & Defense
By: John Gruber
Tags: Email Threats, Email, Information Security, Technology, Phishing

There’s a constant threat to your organization. Email is one of the most common ways hackers attempt to breach your organization’s security. Over half of the messages received are spam, phishing campaigns, and malicious. Staying up-to-date with the latest email related threats isn’t an easy task. It’s virtually every company uses third-party email hosting with built-in spam protection or opts for third-party spam protection in front of on-premise servers. Like its competitors, Office 365 comes with built-in protection for your environment, Microsoft’s Information Protection team is staying up-to-date and evolving the email security of Office 365 to protect Microsoft customers from threats. The default configuration isn’t always enough to keep your organization secure and compliant.

Why is Spam Still a Problem?

Despite years of combating spam, the campaigns are still relentless. To understand why there’s so much spam we have to ask, How successful is a spam campaign? Since spammers typically work in the shadows it’s a difficult question to answer. Fortunately, the International Computer Science Institute (ICSI) performed an interesting and surprising study. The ICSI hijacked an existing botnet to determine how successful these campaigns truly are. By redirecting the botnet to a fake pharmacy website and throwing an error instead of completing a purchase the ICSI was able to provide insight into the spam plague that has troubled us for so long.

By emailing 200 million email addresses the fake pharmacy site led to over 10,000 people visiting the site with 28 purchases. This would have led to almost $9500 a day in sales.

What’s Phishing?

“Phishing is a cybercrime in which a target or targets are contacted by email by someone posing as a legitimate institution to lure individuals into providing sensitive data such as credit card details and passwords. The information is then used to access important accounts and can result in identity theft and financial loss.” — phishing.org

30% of phishing messages get opened by targeted users and 12% of those users click on the malicious attachment or link. — verizon.com

How a Phishing Attack Affected U.S. Elections

In September of 2015, the FBI contacted the Democratic National Committee (DNC) to inform them that at least one of their computers has been compromised and sending information to Russian based computers. Six months later a campaign chairman receives a phishing email masked as a fake alert stating another user attempted to breach his account and he needs to change his password. The DNC chairman clicks the link that directs his browser to a fake website where he types in his password giving Russian hackers access to his account.

The average cost of a phishing attack for a mid-sized company is $1.6 million.

On July 22, 2016, WikiLeaks posts emails that were stolen through the phishing attack. For weeks, the emails consumed the media. No one can say for certain how much the phishing attack affected the election but the damage was done.

What is Malware?

Malware is any form of malicious code that is often distributed via email. It can be distributed using a direct attachment, stored in a Word or PDF document, or can be downloaded once a person clicks a link in an email.

The 1st Email Virus

In January 1999, a new threat emerged. Codenamed Happy99, it was one of the first known viruses spread through email. The malicious code would attach itself as an email attachment and send an email with fireworks saying Happy New Year. Unknown to the user, the code would install itself on the computer and begin spreading again.

Unlike today, the Happy99 virus wouldn’t do anything other than send itself to the next computer. Today, malicious code is used to steal identities, financial information, and other private corporate information.

How is Spam Detected in Office 365?

Office 365 uses a multi-layered spam protection system. Every email is scanned using a number of different algorithms to detect and block unwanted messages.

Content Filters

Content filters are used to detect words and phrases that are known to be related to spam. It’s a constant struggle because content continues to change. Microsoft handles the content filtering behind the scenes but you can create a transport rule in EOP to add words and phrases your company would like to block.

See the section “Custom Content Filtering in Office 365” below to customize your tenant.

Connection Filters

Screenshot of EAC Connection FIltering Customizations

Connection filters block emails from known bad IP addresses. Spammers will typically use botnets and hijack legitimate companies to send spam. Microsoft will detect an IP address that has an infected device and immediately blocks the bad email from your organization. Once the issue is resolved by the sender, Microsoft will remove the IP address from the block lists and allow email to reach the destination. Additionally, your organization can add IP addresses to a block list or allow list from the EAC.

See the section “Custom Connection Filtering” below to customize your tenant.

Domain Filtering

A domain is the second part of your email address, everything after the @ symbol. For example, the domain of john.gruber@gitbit.org is gitbit.org.

Domain filtering is a broad term used to determine the authenticity of the email senders. If a particular domain continues to send unwanted or malicious emails, the entire domain may be blocked. Microsoft uses a number of complex algorithms to determine the validity of a domain.

For example, many spammers will create a new domain and immediately start sending spam and malicious code. Since most organizations are established and have had an email system for years, Office 365 is more likely to block an email from a new domain.

At the same time, using ‘fuzzy-match’ technology Microsoft will review the sender’s domain for suspicious activity. If someone sends an email from micros0ft.com (a zero replaces the O) it will be blocked.

See the section “How to Whitelist and Blacklist Senders as Spam” below to customize your tenant.

SPF / Spoofing Protection

Technically, SPF filtering could be part of the domain or connection filtering based on how it works. In short, a hacker can send an email from their computer and set the from address to another. While the email will appear legitimate it can be sent from another location.

To put this in real-world terms, imagine receiving a letter with your mom’s name and address in the return address field. You would immediately assume the letter originated from your mom but in reality, anyone could have sent the letter.

An organization can and should configure an SPF record from each domain they own. For example, if I send email from the IP address 1.1.1.1 using my gitbit.org domain I should create a TXT record to inform the world that 1.1.1.1 is the only IP address that is allowed to send gitbit.org email.

// Example SPF record

v=spf1 ip4:1.1.1.1/32

Office 365 automatically reviews SPF records of anyone that sends you an email to keep your organization safe. You’ll need to configure the SPF record for your organization when migrating to Office 365 to help protect your outbound email as well. Microsoft will verify your SPF record after you add it to the Office 365 tenant.

I haven’t added a section on how to set up your SPF record. Microsoft provides some assistance to their customers but I recommend asking a professional if you haven’t managed SPF records before.

Reputation Filtering

Bulk emails are a bit different than spam. A bulk email is typically a newsletter or an offer from organizations that you know. They usually appear in your inbox after signing up for a new website.