[Music]
okay
oh
well welcome everybody i'm i'm thrilled
to see faces here i wasn't really sure
you know who was going to show up at
this hour because it is kind of crazy so
i thank you for coming back after a
little break and sticking around so long
to hear what i have to say
i'm normally i don't have a microphone
i'd be walking around so you know feel
free to move up if you want but i'm
gonna i'm gonna try to kind of talk to
you as a group and
i really do want to hear hear your
thoughts
um so this
talk is uh e flow and we'll talk about
what that is
and is that you
so this is a little bit about me
um i've done security for a fairly long
time i've been with the university at
buffalo um in my current role since
about 2009
but i've been with the university 22
years
so i started out in a tech support sort
of role um doing server and workstation
support and then started part-time doing
forensic stuff
and then moved full-time
into security so that's kind of where i
come from i do a lot of things i'm
involved in a lot of places
um so and i just like to just show off
my adopted sloth who's the little guy
you see there
his name is flash and he is at the local
buffalo zoo um i i adopt him and help
pay for his food and whatnot every year
so this is what we're going to cover um
and as i was telling a couple folks who
came up earlier
i give this talk because a lot of folks
are involved in security and may never
have heard anything about the history of
email and don't realize why it's kind of
a mess that it is right we all know
that email is problematic
you know any time you hear about things
like
apg we hear the scary ept right
most of the time attackers are starting
out with a phishing message
i mean that's just the nature of it
right so
you know especially in my role i do a
little bit of a lot of things dfir is my
specialty
um but i do tons of other stuff i do
awareness training and part of this talk
actually comes from awareness training
that i give to end users because
they don't understand the nature of
email any more than tech folks do so um
so these are the sort of overall topics
we're going to cover so we'll talk a
little bit about the history we're going
to talk about something called the
envelope versus the header
you never see the envelope people think
you see the envelope but unless you're a
command line you never actually see that
and they confuse it with the header all
the time and we're going to talk about
how the client and the server actually
communicate and we'll see why eclo
or hello
is literally how that conversation
begins
we'll talk about how you read an email
header
which
a lot of folks who are even do a lot of
advanced things may never have learned
but i'll tell you right now that one of
the very first security things i've been
asked and i've been asked since this you
know since long before i was in my my
current security role i was asked this
question
how do i know if this email is
legitimate
how many of you have ever gotten that
question
right did you know how to answer it for
sure
sometimes i bet right sometimes you look
at it and you're like oh yeah this is
garbage
but do you know
how to dig into it enough to know where
that message actually originated
i mean some of you probably do somebody
i'm seeing like this right
and so uh i i can tell you that
you may not 100 know because
clients can mess with
those headers and you can and and there
are ways that attackers can tinker with
them but we'll we'll go over sort of the
general way you break down the header
and how you figure out where mail
originated and what you can look for
um we'll also talk about all right let's
say you find out this email is garbage
and it's coming from somewhere now what
do i do with it i mean you can certainly
tell the user all right just delete it
that that's a good thing
but what if it's an account that's
constantly sending you crap do you want
to do something with it do you want to
report it how about if it has a phishing
url do you want to do something with
that i know as a support person that
used to frustrate the crap out of me i'd
be like yeah this is garbage and they'd
be like well now what i know i don't
know
right so we'll talk a little about about
reporting um
i will tell you there is no like cut and
dry way to do any of this stuff there's
some sort of basic
tips and tricks you have to to go
through uh and and i apologize we have
you know the band playing on so if you
need me to ever repeat something just
just let me know um we're also going to
talk about some advanced ideas spfd ken
and dmarc which are the only actual
security things that have ever been
added to email and they were fairly
recent
and we'll talk about some useful tools
things you can do to look up stuff and
find out some of the details you need to
know to both know where this mail
message originated and how to report it
so e hello
all right how many people know what this
is like get the joke at least a couple
of you think you know who lionel richie
is all right at least a few of you good
um all right so here's the the history
of email and what i will tell you uh and
people don't believe me um and and
that's cool because they think i'm a lot
younger than i am
um
i got my first email account
when i was five
and they go oh yeah because you're
really young and i'm like no no you
don't understand that is
and they go what
and i say yeah i had my first email
account in 1978 and that is because my
father's director of computing services
at the college where i grew up
so
a lot of what's weird about this even
though this predates me a lot of this
takes me
to where i start getting involved with
computing
so the first email box is not like email
we think of today you don't send a
message and receive it in a different
system
it was an application where you send a
message and it was received by another
user of the same machine
so that was that sort of initial
inception email it was you know i leave
a message for you and you pick it up
because you had people just time sharing
on a single terminal and that's how that
worked
um
the first
email in a network was arpanet
and arpanet was kind of the beginning of
what we sort of traditionally think of
as the internet and that graphic that
you see in the corner is the beginnings
of arpanet and how it starts to grow
and arpanet starts to tie into a bunch
of schools
now the the origins of the internet if
you're not familiar starts essentially
with a bunch of colleges it's four
schools that decide
they want their computing stuff to
essentially have a backup in some
capacity and that's why we have these
four nodes that all kind of support each
other
um and they had no concept of the fact
that this would grow into the thing that
it is today if you told any of the folks
that worked on any of this original
technology
that we're doing what we're doing with
it now they would have been like what
are you out of your mind like who the
heck thought of that
and that's important to understand
because
we'll see why
there's no security in email right
i'm guessing most of you know that but
how many of you didn't know that
anybody not know that
okay
um
i'm always surprised i find people that
are like oh no
like i have secure email i'm like yeah
okay you have secure email if and only
if
it's essentially a closed system so if
your if your doctor's office has a
portal and you send a message through
the portal it never actually leaves the
portal it usually sends you some sort of
out
outside message that says hey you have a
message in a portable chat right
but by its nature email is not secure
so the very first
email that we see
that looks like what we think of his
email doesn't come along until 1971.
and then
the original rfcs
um
we get these add-ons
so we have the original rfc and then we
have um
these other ones
that
get added on so we can see these changes
so this this current one
52 or 5321
is what actually spells out some of the
things that we'll see later like dkim
and dmarc and these editions but it's
been around a really long time
all right so how does an email message
get from place to place
well it uses dns
and of course the joke is what
it's always dns when something breaks
it's always dns right
and for those of you who've never heard
that joke trust me it's true
because without dns networks just fall
down
we had a an issue in the not too
distant past where our firewall stopped
sending traffic outside of our network
and it basically caused our internal dns
service to fall over and then everything
stopped cold so it you know yes in that
case it was technically the firewall but
really was all dns because even
even getting
track inside we could talk to each other
it was crazy
so dns plays a really pivotal role in
email because
you have these three records these ns
records and that's going to tell you
more domain information
so
um
your your basic ns record is going to
tell you uh
what
host names can tell you more
so for example mx records which have to
do with email or a records are sort of
your basic
record of note right so
the mx record is critical here
if your mail system is set up right
your mx records say these are the host
names
that should accept mail
for your domain
and nothing else now
the a record has the ips addresses
associated with with the hosts as well
and and we'll see that ultimately you
can if it doesn't have an mx record it's
just going to go to mit
but i'm guessing this makes sense so far
okay this is pretty basic stuff in the
beginning
so
when you send email this is how dns
plays that role right it's going to say
all right
need some kind of client need a way to
communicate i want to send mail to user
example.com
so
i need to know where the heck is
example.com i have no idea so i'm gonna
i'm gonna look up that ns record and i'm
gonna find out
and then once i know the ns record now i
need to know about those mail servers so
i'm going to ask for the mx record from
where i got the ns record
then i'm going to get the a record to do
the translation for the domain
and this is the part i was talking about
a minute ago
if there's no direct
mx record
but there's an a record to just that ip
address it'll just use that instead
all right
this is an important concept to
understand this is how
some attackers will attack you
this was a much much bigger problem in
the 90s and we still see this as a
problem especially in other countries
we still see it occasionally here but
more often than not we see these other
countries and that's an open mail relay
so
what did i say
about
email the the first thing we're doing is
we're finding out what the domain is
right and then we're finding out bmx
record what mail systems accept mail
those are the only systems that should
be accepting mail for your domain end of
subject however an open relay says mail
yay
i don't care if it's for me i'm just
gonna relay it along right
so attackers will use them to basically
bypass the rules and send it on its very
way it doesn't care if it's supposed to
get that mail or not
so
the the what they should accept as you
can see on the bottom there
so
they say messages from anybody
to a user in our organization's domain
so if our organization is you know
buffalo.edu
then
you know we can get mail from anywhere
as long as it's a valid user in our
domain
and we can accept messages from a valid
user in our domain to a user in any
other domain because we can send out and
that's it this is how it's supposed to
work but open relays will accept it from
anywhere
all right
envelope and header
who has ever seen this distinction
before
i've seen a couple yeses
a few no's
all right
the reason this is important as i
mentioned briefly earlier
is that the
envelope only happens when the message
is created you never see this this is
not the client this is not outlook this
is not thunderbird
this is not your gmail you know online
client
this is the conversation that
effectively happens between your client
and the server that is when this
information gets created
and if you do this at a command line
then you get to see the envelope and
that is the only way you will see the
envelope unless of course i suppose if
you are capturing the network traffic
right you might see this this data but
generally speaking you're not going to
see this because that's
this is how it takes place
so when smtp the protocol actually sends
mail
it it throws this away that's why you
don't see it
so
um what it includes is the mail from
which is the sender
and the receipt 2 which is the recipient
and all this does is it routes mail from
point a to point b
this is not
what you see in the to and from the mail
message
i'll say that again this is not what you
see in a mail message because we don't
see the envelope
if you do this at a command line
you effectively tell it into port 25
and you have the same conversation with
a server from the command line that your
mail client does and that is where you
specify you actually type
the mail from business and receipt too
because you actually have to tell the
server the message is from
the server you know here's who i'm
sending it to
and that my friends is where
spoofing makes
really easy work of this because at the
end of the day
the server goes okay
there's
nothing in there to stop it from
accepting that information because
port 25 is open that's how i accept
email right but there's supposed to be a
check
against this
stuff
going on
if it's configured right so it doesn't
just relay it it should say oh
this mail message is for somebody at
fredonia.edu or google.com
i don't accept now for that
and drop it
but that's not what happens in that case
so again
not visible users very easy to forge the
headers on the other hand are actually
inside the message and they get written
as this conversation is going from
server to server to server
so as mail and we're going to see an
example of this as mail is transferring
from one system to another
additional lines get written to the
headers
now
you can monkey with and four cheddars
that is a thing
it takes extra work to do that
most criminals
do not enjoy doing extra work so they're
gonna go the easy route right so they're
going to forge the envelope in some
capacity they're going to use an
application or some mechanism to do that
they're not going to forge the headers
and they're going to forge the data so
we'll see that in a second because the
stuff that you see in that mail message
the two line of the from line
that's all data that's not the envelope
and that's not the headers
and this is where people get very
confused usually because they make an
assumption that to from is like because
what do we often equate email to
in our day-to-day lives to people who
don't understand tech
regular us postal mail right
and what is the thing we send us postal
mail in
envelope an envelope right and if we're
sending it through an envelope then we
think okay
if we're making this parallel then the
envelope is the stuff and we can see it
except that's not how that works in
email
all right
[Music]
the dubious from field this is what i
use with
again with end users all the time to
explain to them that just because you
see
from doesn't mean that's who it's from
and people say what
what do you mean
and here's where i see it where it
freaks them out the most
the mail message came from me and it
says really bad
things
how many people have seen examples of
that so far
sextortion scams at least a few of you
yeah i get
calls pretty regularly or emails or you
know whatever
um
oh my god i just got this email message
it looks like it comes for me
and it says i've been doing bad horrible
things and you know send bitcoin to this
address and i don't know what i'm doing
you know they're terrified
well it is certainly possible their
mailbox is compromised
or
it could in fact just be
someone spoofing their name
right because
the two and the from are what
what
[Music]
well they're arbitrary but they're part
of data
they're not part of the envelope and
they're not part of the header the part
that you're seeing in that map client is
neither of those two things
it's just data and we'll see you'll
you'll you'll get this in a second
because i'm going to show you a graphic
that'll make that pretty obvious
this is the graphic
this my friends is how email works if
you've never seen this before
[Music]
depending on the particulars of your
mail server or your mail client it is a
conversation that either starts with
e-flo
or
hello
and it's literally like hey i have some
to send you
so in this case
hi i have an email for example.com
[Music]
so hello
smtp.example.com
[Music]
and the server returns that 250 code
which says effectively hey i can process
mail for example.com
now where did we see that
well we saw that as part of that
envelope right because this is the
conversation you don't see unless you're
at a command line
so once you get back the okay then the
client knows it can start sending a
message
this is the envelope mail from
got it
so mail from this is again this is
essentially all
command line stuff it's just telling the
server this is where you're going to
send this it doesn't necessarily care
it's just accepting this information
and
then the server says all right who's it
for
you tell it receipt two
give it that information and you see how
this is built
it is literally a conversation between
point a and point b
so what i often ask the folks that i'm
trying to help is i say to them
cool
we get all the way through this
conversation the next piece is the data
and you'll note my little note here
about the data will often include the
date the to and the from
so if that's where the two in the from
the user sees how easy is it for me to
put anything i want in there
really easy right
so
that's all this is
all right now tell me where's the
security in any of this
do you see anything about encryption
now
hmm
how about uh
i don't know any other mythical magical
way to
to secure this conversation
yeah okay we could we could you know you
can set up
uh you know the conversation itself
could in theory be encrypted
but really this is just plain text data
going back and forth
that's all this is there's no security
built into this by default
and that's the problem with email and
that's always been the problem with me
now because what did i say about the
history of all of this
what i told you was four computing
centers decided they wanted backups for
each other and that decided to connect
there's nothing about security there
there's nothing about encryption you
know again
this is built on these original ideas
and so every time they tried to add to
it they literally had to add on stuff
and so anything that you see that goes
above and beyond these basics they're
add-ons and they break
and so without a complete overhaul which
i don't think we're ever going to see in
email
this is the reality
all right so we have this conversation
it finishes it literally tells it i'm
done and it quits and it says okay
goodbye
so it's literally a conversation
so here's a great example of a type of
employment scam that we get so regularly
it makes my eyes bleed
there is a person named ryan austin at
our university
he is a research analyst and he did not
send this message
but you can see why a student receiving
this message would think wow this is
pretty convincing
now if you're from my area you would
probably know that 774 is not a local
area code and maybe that might tip you
off but okay people have cell phones
from anywhere maybe not
so this is the kind of thing
that i am frequently asked is this
legitimate or crap i've just lost a
bunch of money or something bad just
happened because i responded to this and
whatever
now there's one
really obvious weird thing in this
message does anybody see it
right is this weird gmail address so
sometimes attackers are really stupid
and they actually put in the body of the
message
the reply to as something else and they
literally set it up that way so that
when you hit reply it doesn't actually
go to the what's listed in the from it
goes to this other address so okay you
know
if they do that it's you know could help
in their cause
now i know this is probably really hard
to see
my thing with me um
but what i want you to notice
is this line right here can you see my
my mouse
all right
so when we
when we read email headers
we read the bottom up
and we're going to i'm going to flip
back and forth between this slide and
the next slide but i want to just kind
of take a look
so
the stuff that we see at the very bottom
the reply to the from the to the subject
that's all
the body of the message
none of that is the envelope none of
that is truly the header information
it's everything above that that's really
the header
i mean this stuff's in the header
because
it's just part of what you see
but the the real part of the header
is going to be the very first sign you
see received from
and that very first ip address
that's where that message originated
all right
so these are the things we're going to
look for like i said we'll go back and
forth so that you can actually see these
things
so
remember that i said the way the header
is written
it's line by line right as that
conversation is going as it's being sent
from one server to another
it starts with that bottom line and then
the next line up and then the next line
up and so read bottom up legacy
slots hang upside down very handy if
they wanted to be email headers which
would be weird because there's lots
so you look for that first received from
and then we're going to look for some
consistent inconsistencies
so
for example
this message is supposed to be from
somebody at buffalo.edu
so
if we looked up this ip address this 160
116 etc
and we said who owns this we would
determine very quickly this is not a
buffalo.edu address
okay
that should give you pause
the other thing that of course you will
see in here if you if you dig further um
is the fact that it goes through this
weird website welcome.com
that's also really bizarre because the
university has its own mail servers
which at this point we go through
microsoft
uh 365 exchange online so if anything
you saw a third party it would be
something like a google or a microsoft
not
website welcome like what the hell is
that right
so
you look for inconsistencies the other
things that you would look for
that again i know aren't like super
obvious
but you would look for date and time
stamp inconsistencies because when
attackers monkey with this they will
sometimes tinker with the date and time
like i said you can monkey with the
headers it's just not super easy but if
you know that we're located in
the eastern time zone and you see mail
coming from some other time zone
and it's not a case where you have a
third party server you should be
scratching your head going
why am i seeing this
so
you know you can look for embedded urls
and you can say
huh this message supposedly comes from x
and the url that's in the message
doesn't match that domain that's a
little weird
again we talked about time stamps
sometimes they'll put stuff in the wrong
order
so that's something you can look for
um
and the human element for verification
right one of the things i tell folks is
look i can't answer for you for every
message you get whether this is
legitimate like you know again folks
want to know and that's fine and i'm
happy to help them
but we have three campuses and you know
40 000 students and there's one of me
so one of the things that i teach them
to do
is to make a phone call you think that
you've gotten a message from your bank
that you know says this is your account
has been popped or something
pick up the phone
and call the number that you know
nothing that's in the message
that the bank uses right contact them in
a way that you know is legitimate
so you know if all else fails and you're
looking at this and you're just not sure
i mean we get departments that send
things through third parties all the
time
and
i can't stop that i you know we try to
work with these departments to try to
make what they're sending look as
legitimate as possible and make
references to another website so that
folks can verify that because we don't
expect them to read the headers right
that's not something we expect of them
so these are the kinds of things that
you're going to look for
all right
so how do you find
these these headers to even send them
because if you're going to report that
you have this garbage coming from an
account that's not yours and you know
it's made to look like it's yours
i will tell you right away do not
forward the message to
the offender
and say hey this piece of garbage came
from gmail fix your stuff
because they will say
i don't believe you
now why will they say that
what if you if you just forward the
message what have you not provided to
them
the header details and what do we just
say is necessary to determine whether
that message actually came through gmail
right
so
if you have one of these things and you
need to report it it's going to be your
number one tip so i do teach
folks how to find the headers and send
them to me
these are the sort of general here's how
you get them from gmail here's how you
get them from outlook you know owa
in most email clients the other thing
you can sometimes do is create a brand
new message
and attach the suspect message as an
attachment and you get the headers that
way but just forwarding that
if we if you think about what we said
about how email works
what ends up happening is when you
forward that message those headers get
rewritten and that communication from
the last server is all you're going to
see
so you're going to miss that whole early
conversation
all right
so
we know this is badness we know it is
malicious
what do we do with this well
this gets complicated only because
uh
it used to be that you could look up
abuse addresses and they were all listed
it was public information and it was
super easy to notify
that is not so much the case anymore
so
you need to look up who the domain owner
is not the
registrant and there are tools you can
do that make this fairly easy i'll have
one on the slide one of them a bit one
is called domain dossier it's very handy
it will give you all kinds of really
cool info it's free
the problem is because of gdpr
a lot of organizations have redacted all
that information
so you get you know garbage from
some place and you look up the ip
address and you find out it's
badfing.com and you'll pay you look up
who's abuse use the abuse contact for
bad thing.com
i don't know it's been redacted well
that's annoying
but even some of these companies that
have redacted
the bulk of the information they have
some sort of email address and if you
send a note to that email address they
send you back instructions
either they send you back a link to a
form they'll send you back
please provide the following information
here it's almost always the same kinds
of things they want those headers they
want proof that that message originated
with them which is what i would expect
doing the same thing
because if we genuinely have an account
that's compromised i want to know about
it because hello i want to get that
a compromise account shut down i want to
get those credentials reset
but the only way i know for sure
if someone spoofs the message if it
really came from our mail servers is
that header so that's what they're going
to expect too
some providers gmail has a form aws has
a form
um microsoft if you uh if you email
like if you get garbage that comes from
like outlook.com
they just use abuse outlook.com so abuse
ads sometimes will just work uh it
sometimes doesn't work some of these
places will lock down the reviews so you
can't send to them which is stupid
because it kind of goes against the
point
so if it is redacted follow whatever
instructions are there sometimes you
have to dig and there are times where
you're just not gonna find that data
which is a pain
um but more often than not there's
something you can report to
you can report bad urls the same way
you're going to look up the domain so if
somebody sends a phishing message with a
url in it
and i'm reporting
i'm going to report both
who sent the message so where did it
originate and the garbage url that's in
it so i can try to get that taken down
because if it's a phishing message i
don't want folks to click on it yes
there's other things i can do in the
meantime right
if you have tools that allow you to
block like that's a thing right so like
if if you're um
if you have some sort of
uh maybe black hole dns where you can
add it to a list somewhere or your
firewall has special protections
um you know cool but what if somebody's
not behind those protections they're at
home and they're looking at it right so
uh so i try especially if it's something
that's particularly bad um
and when i say that for argumentization
in particular it's something that maybe
mimics one of our login pages or would
be particularly convincing to our folks
right
so um i found this out actually
from a friend of mine who does a lot of
business email compromise
he said
with these two particular
mechanisms these are some other ways you
can report the url so if the domain is
owned and
managed by name chief
which is notorious for bad garbage
because
as their name implies they're cheap
right
and they don't really care who's
registering domains they don't care who
owns them
if you tweet
at
namecheap and say hey there's this you
know garbage out there within the hour
they'll take it down typically so that
was cool i didn't know that
and the other thing you can do is you
can submit to virustotal now virustotal
is good and bad
right as somebody who does any kind of
incident response
if you submit a file or something to
virustotal you've now essentially given
it to the universe
everybody and their brother can have a
copy of that
now if it's the case where there's
nothing of yours of value of your
institutions which with a file you don't
always know
but if it's a bad
url like it's out there right like
there's probably nothing in your
organization where that's going to be an
issue and the cool thing is if you
report that bad url
now everybody and their mother gets a
hold of it and sometimes it gets taken
out faster
so um you know so that's a thing
so we'll touch briefly on these advanced
concepts i i don't want to spend a lot
of time on it
but there are these three additional
email things that have been added i
mentioned
that in the last update to
the protocols they've actually added
this information to them which
does provide some security measures so
the spf basically says
did this message come from an approved
server or not
here's the cool thing about spf records
you don't have to have them so lots of
people don't or lots of institutions
don't
and even if you have them
you can simply ignore what they say
so
just because you know just because there
is an spf record does not mean that it
matters
but it is sometimes handy and in the
header you can sometimes see a reference
to it uh and if i had it behind me it
would be easier and i could show you
because that one message does
um so dkim
actually validates whether that message
is authentic by adding this digital
signature
again it's not something that is
required it is an add-on to uh you know
that rfc
and um
it's another thing that you can turn on
but not actually do anything
to stop you know mail
dmarc takes those two things together to
try to prevent spoofing so if you put
both of those things in place
it will say oh this message supposedly
comes from
user at buffalo.edu
well there's no valid signature and or
it didn't actually come from
user at because it's it's looking at
that header information it's making that
call
um while it's doing well it's doing the
envelope thing right so if that's in
place
it will drop the message
and so these things are additions
they're not perfect there are still ways
to get around them even if they're in
place but it does help
so those are some things that can be
added
so these are some cool
online tools you can just google them i
didn't put the urls in here because i
knew that like most people would just
want a screenshot
if you google domain dossier it can do
domain and ip analysis so when you're
when you're doing this research right
and you're looking at that header and
you're saying all right i have that
weird ip address
and whose ip address is this and who
who's responsible for it and
remember that you want to be looking for
the domain owner
and potentially technical contact not
the registrant
so for any of you who aren't familiar
the registrant is just the person who
registered with whoever provides that ip
address with with the domain and ties
those together
they often don't care about whether
their ips are used for badness you can
report to them as well they often will
tell you we don't care uh you know tell
the company that actually owns it but on
occasion especially if it's particularly
bad they will do something
so the other neat thing that domain
dossier will do
is it will look for what services are
open um for that particular domain so
we'll tell you are their mail services
open are there uh you know is port 80
open is 443 open and that can sometimes
give you
other contact information and other
useful data so i i use domain dossier a
lot it just it gives you so in the olden
days we used to do this
manually via nslookup which is command
line thing
really cool gives you lots of info but
you need to know you needed to know all
the different
uh switches and what not to get the data
back this just gives it all to you in
one place and you don't have to bounce
back and forth which is really nice
the mx toolbox is a header analyzer
it will take the header and it will
actually break it down and say
from
to
and that very ugly header that you were
looking at it will make it much easier
to read
what i will warn you about is any email
analyzer
is only as smart as the people who
programmed it and the header it's given
the headers in some cases
give you information in the reverse
order
because that's how the client is giving
it to you
so you're looking at what this analyzer
is showing you and you're like why does
this make no sense i know headers read
from bottom to top why is it backwards
oh
so if you use just
caveat analyzers are great and sometimes
when you get headers
uh they're even harder to read there
there's no line breaks like those are
sometimes really really hard to follow
and that's where this can be somewhat
helpful but just be aware that when
you're looking at that you may get even
more confused by
the way they parse out that data
if you have an email message that has
some kind of weird encoding
crap in it whether it's in the header
itself which does sometimes happen
attackers will try to hide stuff about
where the message originated or there's
something in the message itself that you
need to decode has anyone seen url that
has like a bunch of gobbledygook and
you're like what is all of this
gobbledygook so sometimes
that is just encoded stuff and there's
this awesome tool called cyber chef
which again website just go there
and it
it has a bunch of options that are drag
and drop you put the code
in one little box
and
uh you
tell it what kind of decryption method
you want to use by dragging and dropping
or you can use what's called magic where
it just kind of tries to figure it out
for you and it will show you
how you know what it decrypted into if
it can
so that's a really handy thing if
there's encoded sections of that header
and then message header analyzer is just
another tool that does more or less what
mx toolbox can do only all it does is
the header part it doesn't do the mx
lookup so if you actually want to do the
mx lookup um some of that data is in mx
toolbox and you can also find some of
that in domain dossier
so i like to close with this quote and
then i'll open it up to questions
because
my background i actually started in the
music business
my degrees in music industry
i started a long way from here i had
absolutely no intention of ever going
into technology
but i had an email address at five years
old
and this was the direction i wound up
going
and so i may not have gone where i
intended to go but i'm pretty sure i
ended up exactly where i'm supposed to
be
and with that
questions
yes
are there any like safe alternatives to
email that do you use
regular encryption or
so i'm going to repeat the question for
those of you who didn't hear are there
alternatives to email that are safer or
uh offer encryption um
not in the sort of easy method that
we're accustomed to an email
what i tell folks is if you really need
to send something an email and it really
needs to be encrypted put it in a file
zip it up add a password i mean it's a
payment drain right but if you really
need to send it that way
um you know obviously the safest
mechanism is sneaker net go and hand it
to somebody but that's just not always
practical so um
you know
there are lots of ways to make emails
safer but you're never going to make it
100 secure any more than you can make
anything else 100 secure
any other questions
yes
as a business would you recommend
setting up an abuse
it's usually best practice
if you own a particular domain it's good
because then if another entity sees mail
that legitimately appears to be coming
from you they can let you know
if it's a small business often you work
with
the host provider
and you you either sort of dovetail that
um and you you know you can talk to them
about how you want to manage that but
yeah i think it's invaluable because
honestly how else will you know right
like i and i have been known i will tell
you i have been known to email the
business directly if i see like for
example another um great use case is
your website is compromised and it is
now hosting a phishing site and you have
no idea until i email you and say hey
uh you know person at company.com your
you know clearly your web server has an
issue here but you never know that so if
your secretary person gets that email
they may just toss that away because
they don't know but yes if you set up
the question in case i didn't repeat
that was um as a business should you set
up an abuse at and my answer is yes
either directly or through
your your isp or you know whoever's
providing your services it's not a bad
idea because there really should be a
way for folks to let you know you have a
problem that's not going to go to
somebody who doesn't realize this really
is legitimate
yes
how does stuff like pgp and a service
like protonmail fit into the whole
security
so the question is how does something
like pgt or protonmail fit fit into this
so um pgp is going to uh going to offer
some external encryption
of files typically protonmail is
supposed to be end-to-end encrypted and
here's what i will tell you about
services like protonmail someone else
owns them
bottom line someone else owns that if
you don't own it and you don't manage it
can you trust it 100
and for those of you aren't familiar
protonmail claims to be 100 safe
encrypted no one else can read your
stuff
well the reality is you don't know that
you know what they tell you
and that's true for a lot of these
services and and you know you don't know
if they have your encryption key
they could
i mean
how do you know yes
dr woman um do you personally
unsubscribe because a lot of people are
reluctant to unsubscribe because then
it's like you're doing like a sin accent
you're letting them know that you're
alive so the question is
do i unsubscribe to things because
there's this notion that if you
unsubscribe then you're letting them
know you exist
sometimes
like most things the answer is it
depends
i will often do some if it's a
legitimate business that i that i know
and i've done
stuff with and i just don't want their
stuff anymore i will unsubscribe if i'm
getting
spam from an organization i've never
heard of i might if it's annoying enough
i might research it such that uh i can
determine do they have an unsubscribe on
their website that seems to be the same
like is there some other mechanism that
tells me this is legitimate i will not
typically unsubscribe to stuff randomly
uh just because i get stuff because yes
you can absolutely get into lists in
that way and that's really annoying so
you know you kind of have to do your
homework unfortunately
you're welcome yes
are you opposed to
dropping
emails
that
failed
am i opposed to dropping emails that
fail spf
personally no
it's a business tolerance decision it's
very much a business decision so
one of the good things that i will tell
you remember i mentioned spf you can
have it on but essentially you can still
have it passing mail so it just tells
you whether or not it's failed um a good
practice to get into if you're going to
use something like that and you
ultimately want to make it a permanent
thing
turn it on and start watching to get a
feel for what you would be dropping and
that'll tell you you know
we have a problem where messages are you
know going to be dropped that are
totally legitimate and it's going to be
this you know large number of messages
and that could be an issue so i would
say if you if you can turn these
features on by all means you should turn
them on but put them in a pass-through
mode and start to get a feel for where
your problems are if you're a business
that has a sub-domain so the university
has a lot of sub-domains you can wind up
in a huge headache if you don't do that
and get a feel for it first
any other questions
all right well thank you again so much
especially for coming out i'll be up
you know feel free to hit me up on you
know the twitters and whatever else if
there's anything for you
okay
so
[Music]
you