Security Verification and Offensive-Defensive Practice
Blue Team Manual ② [Email Edition]: In-Depth Analysis of Email Security & Mastering Social Engineering Prevention Techniques
In this era of rapid information technology development, email has become an important tool for business communication and information exchange. However, with its increasing popularity, email has also become one of the primary channels for phishing and social engineering attacks.
Social engineering attackers exploit human weaknesses to induce recipients to disclose sensitive information or perform dangerous actions through carefully designed email content. Therefore, mastering the practical skills of email defense against social engineering is crucial for protecting personal and corporate security.
01 Types of Email Security Threats
Phishing: This is a common method for corporate intranet intrusion. Hackers control employees' computers through email attacks and then further penetrate the enterprise's internal network. Attackers send forged emails, usually posing as legitimate correspondence from banks, government agencies, or well-known companies, to induce users to provide sensitive information or click on malicious links.
Spear Phishing: This is a more precise and targeted phishing attack, usually aimed at specific individuals or organizations. Attackers collect detailed information about the target to make the email content more persuasive and authentic.
Clone Phishing: Attackers copy the content of a legitimate email and modify it slightly, such as changing attachments or links, to guide users to visit malicious websites or download malware.
Malicious Attachments: Attackers send attachments containing malware via email. When victims download and open the attachments, the malware infects their computers.
02 Email Attack Process
1. Data Collection and Mail Server Localization
Attackers usually collect information about targets through various means, including:
Domain MX Record Analysis: By analyzing the domain's MX records, attackers can determine the address of the mail server.
Class C IP Address Scanning: Using Class C IP addresses to find WEB mail portals, common ports include 25, 109, 110, 143, 465, 995, 993, etc.
Social Media Information Collection: On platforms such as LinkedIn and recruitment websites, attackers can obtain a large number of email addresses for subsequent phishing attacks.
Collecting SPF and DMARC Policies: Understanding the target domain's security policies can help attackers bypass certain security mechanisms.
2. Legitimate Acquisition of Email Addresses
To increase the success rate of attacks, attackers may obtain email addresses through legitimate channels, including:
Social Engineering Methods: Using fake job recruitment advertisements or market surveys to obtain email addresses.
Password Recovery Function Vulnerabilities: Exploiting vulnerabilities in websites' password recovery functions to obtain email information.
Email Brute-Force Cracking: Attempting to log into email accounts through extensive trials of common password combinations.
3. User Information Collection and Analysis
Using tools like Maltego to collect user data and integrate user information from different platforms, such as social media, forums, and blogs, to build comprehensive user profiles. This helps design phishing attack scenarios targeted at specific user characteristics and behavioral patterns.
4. Creation and Transmission of Malicious Attachments
Attackers use various means to hide malicious attachments in emails, including:
Encrypted Attachments: Protecting attachment content with passwords to bypass email security filtering. Passwords are usually communicated to targets via separate emails or other means.
Shortcut (LNK) Files: Using the shortcut functionality of LNK files to execute hidden malicious commands.
Filename Spoofing: Using Unicode characters like RLO (Right-to-Left Override) to change the display order of filenames, making malicious files appear legitimate.
Separated Password Emails: Sending an email without attachments and embedding the password directly in the body of the text.
Text Obfuscation: Using Traditional Chinese characters or special symbols to obfuscate the password in the body text, increasing the difficulty of detection.
5. Execution of Malicious Activities
Once a victim opens a malicious attachment or clicks on a malicious link, the attacker can quickly penetrate the victim's network. Attack targets typically include:
Privilege Escalation: Obtaining administrator privileges to control more system resources.
Lateral Movement: Using controlled machines to further infect and control more devices.
Data Theft: Obtaining and transmitting sensitive data, such as financial information, trade secrets, etc.
Persistent Control: Maintaining long-term control over infected devices to achieve persistence, facilitating future attack campaigns.
03 Email Protocols and Security Technologies
SMTP Protocol: The core protocol for email transmission, supporting the transmission of non-text data through MIME (Multipurpose Internet Mail Extensions). The SMTP protocol defines the processes for sending and receiving emails, ensuring email transmission across the Internet.
POP3 and IMAP Protocols: Used for downloading and managing emails, with IMAP supporting online access and multi-device synchronization. POP3 is an offline protocol that allows users to download emails from the server to their local computers, while IMAP is an online protocol that allows users to manage emails directly on the server.
SPF (Sender Policy Framework): An email validation technology designed to prevent email spoofing by verifying the sender's IP address.
DKIM (DomainKeys Identified Mail): Ensures email integrity and sender authentication by adding a digital signature to the email header.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): Combines SPF and DKIM to provide more comprehensive email authentication, adding a reporting mechanism to help senders understand how their emails are handled by receivers.
04 Overall Email Security Operations Strategy
Email security is a systemic undertaking that requires comprehensive defense across multiple dimensions. The following are key defensive strategies:
Take a Series of Security Measures: Including forging SMTP-banner information to confuse attackers, reducing email access points to retain only necessary ports, enabling SMTP authentication and anti-brute force mechanisms, conducting email operations via VPN or mobile office applications, and managing DMARC validation to prevent intra-domain email spoofing to enhance the security of the email system.
Implement a Comprehensive Security Strategy: Including regular checks on password strength to prevent weak passwords, developing distributed models to monitor brute-force attempts, prompting users with login locations to alert them of potential risks, and utilizing traffic and log analysis to monitor account behavior for quick response to any anomalies.
Integrate Threat Intelligence: Labeling malicious senders and IPs in real time, employing AI semantic analysis technology to identify phishing emails, and simulating user access to URLs in emails to detect security risks, thereby constructing a comprehensive defense mechanism to enhance email security. This also involves implementing real-time linkage between employees' internet gateway security products (NGFW or secure web gateway) and threat intelligence to achieve real-time protection against malicious URLs.
Deploy Antivirus Engines: To detect and kill known viruses, while utilizing sandbox analysis technology to monitor attachment behavior, combined with static analysis to detect threat signatures in attachments, so as to create a multi-layered email security defense system.
Deploy Browser Isolation Solutions: Deploying browser isolation solutions on endpoints used by critical personnel, so that even if a malicious link is accidentally clicked and not blocked by the internet gateway security product, malicious downloaded content will not pose a threat to the endpoints.
Deploy Mobile Device Management and Isolation Solutions: Deploying mobile device management and isolation solutions on the smart devices of personnel who use them to send and receive emails, preventing risks associated with these personnel clicking on malicious links in emails outside the office environment.
Security Awareness Training and Drills: Regularly organizing phishing email drills combined with basic cybersecurity education, and simulating hacker behavior for real-world exercises to enhance all employees' security awareness and response capabilities.
Implement Email Attack Attribution Strategy: Building email threat intelligence to track attack behaviors, deeply analyzing IOC information in emails such as IPs, URLs, MD5s, etc.; applying email encryption technologies to protect email content security, and actively practicing email threat intelligence sharing to enhance the cyber defense capabilities of the entire organization.
05 Advanced Email Content Analysis Techniques
In-depth analysis of email content is a critical step in identifying and defending against security threats such as phishing attacks and malware distribution. The following are key methods for email content analysis:
1. Email Header and SMTP Protocol Analysis
Email header field analysis is the starting point for identifying phishing emails, involving the inspection of key fields such as Return-Path, Received, and From to trace the origin of the email. Although these fields can be forged, combined with in-depth analysis of SMTP protocol interactions, we can reveal the true transmission path and sender identity of the email. Parsing SMTP commands, such as auditing EHLO, AUTH, MAIL FROM, and RCPT TO, provides a detailed process of email delivery, helping to identify anomalous behavior.
2. Behavioral Analysis of Email Attachments
Email attachments are breeding grounds for malware dissemination. Through sandboxing technology, security experts can monitor the behavior of attachments in isolated environments to capture potential malicious activities. For complex documents, such as Office files with macros, special attention must be paid to potentially hidden scripts and remote execution codes to prevent malware implantation.
3. Email Attribution and IOC Extraction
Email attribution is a critical technology for tracking the origin of phishing attacks. By extracting IOCs from emails, such as IP addresses, URLs, email accounts, and file MD5 hashes, security teams can build profiles of attackers and track their activities.
Attribution methodology provides a systematic analysis framework, which, combined with in-depth analysis of email headers and source code review of email protocols, helps experts connect clues and construct attack stories. The accumulation of email attribution techniques and experience, such as analyzing mail server tags and user behavior patterns, further enhances the accuracy and efficiency of attribution.
06 Fortifying the Defense Line to Safeguard Information Security
Through the in-depth sharing of email social engineering defense practices detailed above, we aim to construct a comprehensive defense system to identify and resist increasingly complex phishing and social engineering attacks. We hope this knowledge and these tools will provide strong support for the Blue Team, strengthening cybersecurity defense capabilities and ensuring that organizational information security is not threatened.
We hope this series will become an effective assistant for the Blue Team on their cybersecurity protection journey. In the bloodless war of cybersecurity, prevention and preparation are the best defense.
