Abusing Sender Reputation Can Increase Success of Harmful Phishing Emails

Phishing is a common form of social engineering that aims to trick users into revealing sensitive information, clicking on malicious links, or opening harmful attachments. Phishing can have serious consequences for an organization, such as data breaches, financial losses, reputation damage, and legal liabilities.

To help protect your organization from phishing, you need to be aware of the techniques that attackers use to bypass spam filters and deceive users.

Peeling back the curtain on phishing techniques

One of these techniques is abusing sender reputation, a factor that determines how trustworthy an email is based on the reputation of the email server that sent it. By using a trusted email server, such as Gmail, attackers can lower the spam confidence score of their messages and increase the chances of reaching the user’s inbox.

However, using a trusted email server is not enough to make a phishing email convincing. Attackers also need to spoof the display name of the sender, so it appears to be someone the user knows or trusts, such as a colleague, a manager, or a business partner.

To do this, cyber criminals use a long display name that overflows the email client’s display buffer, hiding the actual email address appended by the email server. For example, an attacker can use a display name like “John Smith, Director of Finance, ABC Inc.” followed by many spaces, and then send the email from a Gmail account. The user will only see the display name and not the Gmail address, making the email look more legitimate.

Take steps to prevent or detect harmful spam

The capability of spam filters to detect and block this sort of reputation abuse is still a bit lacking. Fortunately, there are some methods for detecting it at the user level.

• Implement technical controls, such as pattern matching, to block emails containing too many whitespace characters in the “From” header.
• Educate users to look for signs of phishing, such as banners warning about external senders, ellipses indicating truncated data, and contact information that does not match the display name.
• Encourage users to verify the authenticity of suspicious emails using alternative methods, such as calling the sender or using a different communication channel.

How we can help

CLA’s cybersecurity professionals can help you reduce the risk of falling victim to phishing and protect your organization from the negative impacts of this threat.