Dealing with a Spoof mail attacks and Phishing mail attacks | A little story with a sad end | Part 1#9 5/5 (2) 9 min read

In the current article, I would like to review the chain of events that occurs every time, again and again, in a scenario in which the attacker manages to execute a Phishing mail attack successfully.The reaction of the involved persons is known in advance, and the sad end of the story is known in advance.

The primary goal of the story is – to serve as a wake-up call, so you do not have to be a character in the play of – Phishing mail attack!

The significant challenges relating to the subject of Spoof mail attack and Phishing mail attacks are

  1. The fact the Phishing mail attack is a sophisticated attack that includes many parts that will need to deal with each one of them separately such as – Spoof mail attack.
  2. Our ignorance about the way the Phishing mail attack work and executed.
  3. Our fake confidence which is based on our mistaken assumption that our mail infrastructure is protected and can deal with all this “mambo jumbo attack” stuff.

Why are we so arrogant?

The common denominator of IT people is – the strong belief that he is some kind of Albert Einstein, that knows everything there is to know about IT and security.

The misconception that we have regarding Spoof E-mail attacks and Phishing mail attacks -01

If we will have the courage to admit, most of us not really know what is the meaning of Phishing mail attack, what are the characters of Phishing mail attack, what are the different flavor of Phishing mail attack, what is the difference between spam mail, Phishing mail attack or a Spoof E-mail.

 hugeThe misconception that we have regarding Spoof E-mail attacks and Phishing mail attacks -02

The bitter truth appears when and where we least expect it!

Your organization experiences a successful Phishing mail attack, in which the attacker manage to tremendous damage to our organization.

You feel like a bull rammed you!

 You fell a powerful header which brings down the floor

The next emotion in our emotional rollercoaster is “panic.”

We don’t know what is the volume of damage; we don’t know if our network was infected with malicious code to continue to harm our organization or, just sit and wait for the right opportunity.

The real reason for the “panic” is the very reasonable suspicion that his ass is on fire!

 The misconception that we have regarding Spoof E-mail attacks and Phishing mail attacks -03

The next emotion in our emotional rollercoaster is “anger.”

The source for the “anger,” is frustration.

The source of the frustration is because:

  • We didn’t manage to identify and block the attack.
  • The fact that we face the simple truth, that says that we are not so smart as we thought.

The anger outcome is – shouting and screaming at everyone below us or any other person that who we can shout.

One of the most popular “objects” for channeling our frustration is – the companies that provide us some kind of service because most of the time they will not answer back.

Spoof mail attack and Phishing mail attacks - Shout and scream anyone you can

This is the last phase of our bad trip, which I describe as the “the silent grief phase.”

This is the phase in which we manage to understand and accept that there is nothing that we can do besides of accepting the reality, and understand that the attacker was smart enough to revel in our weak spot.

Spoof mail attack and Phishing mail attacks - The silent grief phase

The conclusion

The drama which described is not so unusual or unique to a particular origination.

It happened all the time to many organizations.

The only difference between the events is the name and the faces of the people that are involved.

The sad story about a Phishing mail attack and the sad end

Let me tell you a story that happened long long time ago in a distant land.

The Legend of the Phishing mail attack and the sad result - Scene 1 -00

Scene number 1

In our little story, your name is Jeff, and you are the CIO of a company that belongs to the financial sector named – “Don’t do anything and hope that everything will work out by itself.”

It’s 9:30 in the morning; the sun is shining.

You’re sitting in your office, drinking a cup of hot coffee (no sugar because you need to maintain your weight).

 legeLegend of the Phishing mail attack and the sad result - Scene 1 -02

You log on to Facebook and start to watch some boring video of a dog or a cat, doing something.

The Legend of the Phishing mail attack and the sad result - Scene 1 -03

Your phone is ringing.

On the line is Suzan, the personal assistant of Brad, the company CEO.
Suzan is asking you to urgently come to Brad’s office.

 legeLegend of the Phishing mail attack and the sad result - Scene 1 -04

Your gut feeling is telling you that something is wrong!

You enter the Brad’s room.

Brad asks you to close the door behind you.

The facial expression of Brad is grave and serious.

Brad says:

“Jeff, let’s make it simple and straightforward.
Yesterday, I got an E-mail message from David (David is the company CFO) that asked me to deposit 500, 000$ in a specific bank account.
The purpose of the deposit was an initial payment for a big acquisition deal, which is about to take place soon.”

This morning, after a brief conversation with David, I understand that I was a victim of an ugly fraud!

The legend of the Phishing mail attack and the sad result - Scene 1 -05

  1. I want my money back!
  2. I want you to locate the persons that carried out this ugly fraud + report the information to the police!

The legend of the Phishing mail attack and the sad result - Scene 1 -06

  1. I demand to know – how can it be that our security infrastructure that costs us so much money, didn’t recognize and blocked this attack, and I demand to know who to blame and who is the person that is responsible for this disaster!

The Legend of the Phishing mail attack and the sad result - Scene 1 -07

Scene number 2

You can hear your heart pounding.

 The Legend of the Phishing mail attack and the sad result - Scene 2 -02

You Instantly call Billy (the company IT manager), and ask him firmly, to reach your office immediately.

Billy enters your office.

You ask Billy to close the door behind him.

 legeLegend of the Phishing mail attack and the tragic result - Scene 2 -03

You inform Billy about the “mess,” waving your finger in his face.

You tell Billy that you need instant answers and that someone will have to pay the price!

The legend of the Phishing mail attack and the sad result - Scene 2 -04

Scene number 3

Billy rushes into his office, finds Bob (the Help desk manager), and informs him about the “issue.”

 legeLegend of the Phishing mail attack and the sad result - Scene 3 -02

Billy asks from Bob to immediately call the IT company, which planned and built our mail infrastructure, and inform them that they will have to provide an accurate answer to the following questions:

  1. How did the hostile element manage to hack our system despite the advanced security infrastructure that was supposed to protect our mail infrastructure?
  2. How to identify with certainty the hostile element, and locate the hostile element which carried out the attack?
  3. How are they going to compensate us for the Indignities and the financial losses?

The legend of the Phishing mail attack and the sad result - Scene 3 -03

Scene number 4

Bob calls the technical support of the IT company that built our mail infrastructure.

Bob informs them about the incident that happened and present the list of questions.

The Legend of the Phishing mail attack and the sad result - Scene 4 -02

The “other side”, explains that this problem is not related to “their side” in any way. He says that the responsibility for protecting the organization mail infrastructure from such attack is the responsibility of the organization that owns the mail infrastructure meaning, our responsibility.

The Legend of the Phishing mail attack and the sad result - Scene 4 -03

After an exchange of harsh words, Bob disconnects the call and informs Billy that the provider refuses to help us and also, blames us for the “mess.”

The legend of the Phishing mail attack and the sad result - Scene 4 -04

Scene number 5

Billy (the company IT manager) picks up the phone, and calls the technical support of the provider who built the mail infrastructure.

The Legend of the Phishing mail attack and the sad result - Scene 5 -02

Billy asks politely but firmly to talk to Stephen, the manager!

Stephen explains that this problem is not related to “their side” in any way and that responsibility for protecting the organization mail infrastructure from such attack, is the responsibility of the organization which owns and manages the mail infrastructure.

The Legend of the Phishing mail attack and the sad result - Scene 5 -03

After an exchange of harsh words, Billy disconnects the call.

The legend of the Phishing mail attack and the sad result - Scene 5 -04

Scene number 6

Billy calls you (just a quick reminder; you are Jeff the company CIO) and reports on the conversation with Stephen.

The bottom line – Stephen that represents the IT company that built our mail infrastructure declares that – they are not willing to take any kind of responsibility for this mess!

The Legend of the Phishing mail attack and the sad result - Scene 6 -02

You ordered Billy to immediately summon a conference call, that includes yourself, Billy (the company IT manager) and Stephen.

The Legend of the Phishing mail attack and the sad result - Scene 6 -03

You start the phone conversation with some statement about the fact that you have decades of experience in the field (usually, the magic number is 15 years).

The Legend of the Phishing mail attack and the sad result - Scene 6 -04

You continue to the “threats phase”, and clarify unambiguously that if he (the provider) will not take responsibility, provide immediate answers and solve the mess, you will fire him, sue him, and also, publish negative information about his company on Facebook.

The Legend of the Phishing mail attack and the sad result - Scene 6 -05

Stephen says that he is very sorry, that he understands my pain, but nothing he can do to help us in this scenario.

The legend of the Phishing mail attack and the sad result - Scene 6 -06

Scene number 7

Clumping you enter the director’s office.

The legend of the Phishing mail attack and the sad result - Scene 7-02

You start to stutter and mumble about security risks, cyber-attacks, the difficulty in dealing with the risks and threats of the modern work environment.

Brad (your CEO) informs you that you will have drawn the required conclusions.

The legend of the Phishing mail attack and the sad result - Scene 7-03

Scene number 8

Two years passed since you have been fired following the unfortunate incident.

You could not find another job (because of age and other reasons).

Your financial situation is not okay, and you get a call from the bank on a daily basis.

After many reflections and obsessive thoughts, you decide that….

The legend of the Phishing mail attack and the sad result - Scene 8 -02

Scene number 9

The wind blows in your face.

You’re standing on a high bridge looking into the abyss which pours down!

Good-bye, crawl word!

The Legend of the Phishing mail attack and the sad result - Scene 9 -02

Dealing with Spoof and Phishing mail attacks | Article series index

Now it’s Your Turn!
It is important for us to know your opinion on this article

Print Friendly

Related Post

Please rate this

Eyal Doron on EmailEyal Doron on FacebookEyal Doron on GoogleEyal Doron on LinkedinEyal Doron on PinterestEyal Doron on RssEyal Doron on TwitterEyal Doron on WordpressEyal Doron on Youtube
Eyal Doron
Share your knowledge.
It’s a way to achieve immortality.
Dalai Lama

One Response to “Dealing with a Spoof mail attacks and Phishing mail attacks | A little story with a sad end | Part 1#9”

  1. Bla Bla bla but you didn’t put anything how to prevent it with a transport rule.. -_-

Leave a Reply

Your email address will not be published. Required fields are marked *