EMOTET - Do not trust any email, even if it looks like sent by a legit address - Page 1
Forum section: electronics / general

author: Zucca
author_rank: Unknown
timestamp: September 26, 2019, 11:40:19 am
content: Do not trust any email, even if it looks like sent by a legit address:LINK REMOVEDEDIT:QuoteZ

author: Psi
author_rank: Super Contributor
timestamp: September 26, 2019, 11:43:11 am
content: Do not trust any forum thread that gives no detail except a statement to hook you in and a URL to click on.

author: Zucca
author_rank: Unknown
timestamp: September 26, 2019, 12:14:05 pm
content: I got the bad news from my corporate IT (my company has > 130'000 employes).Interesting would be to know if also yours IT departement is nervous about that.Next time I will not waste time to warn somebody here.

author: German_EE
author_rank: Super Contributor
timestamp: September 28, 2019, 10:00:51 am
content: OK, to save everyone from clicking on the link, it just tells you about one specific piece of malware that is spread through emails and javascript, that's all.One other thing, from the original thread title. If I "Do not trust any email, even if it looks like sent by a legit address" then I'll never be able to use email again. What does the original poster suggest as a replacement, two cans and a piece of string or smoke signals?

author: RoGeorge
author_rank: Super Contributor
timestamp: September 28, 2019, 12:06:11 pm
content: It's well known that the fields "From:" can be replaced with whatever, so there is no guarantee the sender is the one displayed by "From:". It was always like that.

author: drussell
author_rank: Super Contributor
timestamp: September 28, 2019, 01:15:38 pm
content: I always highly recommend using an e-mail client that makes it easy to see thefullheaders.Personally, I use PINE right on the mail server but that probably isn't the best option for most people.

author: RoGeorge
author_rank: Super Contributor
timestamp: September 28, 2019, 01:22:20 pm
content: What I am trying to say is that the FULL header can be falsified by a malicious sender, at the very first moment when an e-mail is sent.

author: SparkyFX
author_rank: Frequent Contributor
timestamp: September 28, 2019, 01:51:45 pm
content: Use text email... in a text mail reader and don't mindlessly run attachments (even watching them in their associated application bears security risks). Or switch to an OS that can be run from readonly media, like Knoppix or inside a virtual machine. So whatever happens stays contained and can be thrown away.@RoGeorgeThe receiving server could reject that, but most are not setup to do it as they would reject a lot of legitimate mails from "strange" configured servers. See EHLO/HELO in the SMTP protocol.

author: madires
author_rank: Super Contributor
timestamp: September 28, 2019, 01:53:24 pm
content: But the bad guy can't modify what my MTAs add to the header when receiving his email.Back to Emotet. If you receive a MS office document don't activate macros.

author: drussell
author_rank: Super Contributor
timestamp: September 28, 2019, 07:09:19 pm
content: Quote from: RoGeorge on September 28, 2019, 01:22:20 pmNo, it cannot.The originating message can (and always has been able to) have whatever it wants put in fields like theFrom:orSubject:and the originating MTA that first sends that message could theoretically put whatever it wants in the headers during the first connection out to the internet, it can spoof whatever it wants to into the header (other than the destination if you expect the message to actually be delivered) as it passes through. What weactuallycare about, though, is any MTAsin between. Where did this messageactuallycome from?If you're expecting something to come from Billy next door, from their gmail account, and the message was actually transferred outwards from some machine in Russia, routed out through some server in China, though another relay in Indonesia, then to your server, you can be pretty sure it didn't actually come from "BillyBob@gmail.com", no matter what someone filled into the "From:" field on the original message.Just like a physical envelope can arrive in the mail for you with any return address stamped on it, if it comes in a funny shaped envelope with postal marks from some unintelligible foreign country, it probably isn't actually from Billy next door either, even though his address is on the envelope.

author: Monkeh
author_rank: Super Contributor
timestamp: September 28, 2019, 07:34:55 pm
content: Quote from: drussell on September 28, 2019, 07:09:19 pmAnd we have SPF, DKIM, and DMARC to help, too.Yeah, emails can't be really trusted, but if you hire competent people to manage your infrastructure, things can be a little better.