Have contents of email have been changed in transit?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
A colleague of mine received some bank details in an unsecured email from a company. He used the details in the email to pay a sum of money into an account.
The company that sent him the email to him didn't receive the money. The bank account details in the email that he received were different to the ones sent by the company.
Does this sound plausible? Is this the sort of thing that happens? If this has actually happened as described then where would the point of attack be?
- Has my colleague's PC been hacked?
- Has the companies network been hacked?
- Has somebody intercepted the email and changed the details en-route?
What's the most likely scenario?
email security man-in-the-middle
add a comment |
A colleague of mine received some bank details in an unsecured email from a company. He used the details in the email to pay a sum of money into an account.
The company that sent him the email to him didn't receive the money. The bank account details in the email that he received were different to the ones sent by the company.
Does this sound plausible? Is this the sort of thing that happens? If this has actually happened as described then where would the point of attack be?
- Has my colleague's PC been hacked?
- Has the companies network been hacked?
- Has somebody intercepted the email and changed the details en-route?
What's the most likely scenario?
email security man-in-the-middle
add a comment |
A colleague of mine received some bank details in an unsecured email from a company. He used the details in the email to pay a sum of money into an account.
The company that sent him the email to him didn't receive the money. The bank account details in the email that he received were different to the ones sent by the company.
Does this sound plausible? Is this the sort of thing that happens? If this has actually happened as described then where would the point of attack be?
- Has my colleague's PC been hacked?
- Has the companies network been hacked?
- Has somebody intercepted the email and changed the details en-route?
What's the most likely scenario?
email security man-in-the-middle
A colleague of mine received some bank details in an unsecured email from a company. He used the details in the email to pay a sum of money into an account.
The company that sent him the email to him didn't receive the money. The bank account details in the email that he received were different to the ones sent by the company.
Does this sound plausible? Is this the sort of thing that happens? If this has actually happened as described then where would the point of attack be?
- Has my colleague's PC been hacked?
- Has the companies network been hacked?
- Has somebody intercepted the email and changed the details en-route?
What's the most likely scenario?
email security man-in-the-middle
email security man-in-the-middle
asked Feb 5 at 8:41
DavePDaveP
63
63
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
This is plausible.
This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.
It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.
I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.
Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.
add a comment |
This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.
However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.
The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).
Steps to take:
- Contact the bank to stop any payments
- Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).
- Report the infringement / fraud (he will need to check who to report this to in his country).
- Check the email headers and black list the originator if possible.
Aside
If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email
Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...
– DaveP
Feb 5 at 9:16
Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.
– Clinton
Feb 5 at 9:20
@clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.
– davidgo
Feb 5 at 10:16
Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.
– Clinton
Feb 5 at 11:40
1
@clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.
– davidgo
Feb 5 at 18:47
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1402159%2fhave-contents-of-email-have-been-changed-in-transit%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
This is plausible.
This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.
It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.
I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.
Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.
add a comment |
This is plausible.
This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.
It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.
I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.
Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.
add a comment |
This is plausible.
This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.
It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.
I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.
Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.
This is plausible.
This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.
It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.
I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.
Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.
answered Feb 5 at 8:59
SlartibartfastSlartibartfast
6,46621724
6,46621724
add a comment |
add a comment |
This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.
However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.
The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).
Steps to take:
- Contact the bank to stop any payments
- Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).
- Report the infringement / fraud (he will need to check who to report this to in his country).
- Check the email headers and black list the originator if possible.
Aside
If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email
Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...
– DaveP
Feb 5 at 9:16
Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.
– Clinton
Feb 5 at 9:20
@clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.
– davidgo
Feb 5 at 10:16
Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.
– Clinton
Feb 5 at 11:40
1
@clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.
– davidgo
Feb 5 at 18:47
add a comment |
This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.
However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.
The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).
Steps to take:
- Contact the bank to stop any payments
- Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).
- Report the infringement / fraud (he will need to check who to report this to in his country).
- Check the email headers and black list the originator if possible.
Aside
If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email
Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...
– DaveP
Feb 5 at 9:16
Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.
– Clinton
Feb 5 at 9:20
@clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.
– davidgo
Feb 5 at 10:16
Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.
– Clinton
Feb 5 at 11:40
1
@clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.
– davidgo
Feb 5 at 18:47
add a comment |
This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.
However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.
The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).
Steps to take:
- Contact the bank to stop any payments
- Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).
- Report the infringement / fraud (he will need to check who to report this to in his country).
- Check the email headers and black list the originator if possible.
Aside
If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email
This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.
However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.
The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).
Steps to take:
- Contact the bank to stop any payments
- Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).
- Report the infringement / fraud (he will need to check who to report this to in his country).
- Check the email headers and black list the originator if possible.
Aside
If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email
edited Feb 5 at 9:16
answered Feb 5 at 9:09
ClintonClinton
7171211
7171211
Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...
– DaveP
Feb 5 at 9:16
Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.
– Clinton
Feb 5 at 9:20
@clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.
– davidgo
Feb 5 at 10:16
Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.
– Clinton
Feb 5 at 11:40
1
@clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.
– davidgo
Feb 5 at 18:47
add a comment |
Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...
– DaveP
Feb 5 at 9:16
Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.
– Clinton
Feb 5 at 9:20
@clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.
– davidgo
Feb 5 at 10:16
Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.
– Clinton
Feb 5 at 11:40
1
@clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.
– davidgo
Feb 5 at 18:47
Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...
– DaveP
Feb 5 at 9:16
Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...
– DaveP
Feb 5 at 9:16
Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.
– Clinton
Feb 5 at 9:20
Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.
– Clinton
Feb 5 at 9:20
@clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.
– davidgo
Feb 5 at 10:16
@clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.
– davidgo
Feb 5 at 10:16
Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.
– Clinton
Feb 5 at 11:40
Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.
– Clinton
Feb 5 at 11:40
1
1
@clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.
– davidgo
Feb 5 at 18:47
@clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.
– davidgo
Feb 5 at 18:47
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1402159%2fhave-contents-of-email-have-been-changed-in-transit%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown