For those of you of a certain age, do you remember when we went from plain text email to rich content html emails? Of course, by rich content I mean some bold and italic text and some images!
Here is a new attack using old technology – called Kobold Letters.
Why HTML emails are a risk to your organization? – Lutra Security
The article goes into the detail of the attack but here is the premise:
Imagine you receive an email forwarded by your manager asking you to wire a large sum of money to a bank account. Of course, you have heard of CEO fraud, so you double-check that the email really comes from your manager. It does, and it may even be cryptographically signed – if you do that in your company. However, you are still not convinced, so you call your manager to ensure that the email is legit. He confirms, so you transfer the money.
Konstantin Weddige
The trick here is that CSS used to style the HTML email changed the email, from an innocent enquiry email, to an email requesting you to transfer money, by the action of forwarding the email.
In my Cyber Security Awareness Session, I talk about finding the point of trust in any system as a way of examining and dealing with a cyber-attack. If this type of email was forwarded to you from the CEO or other line manager, then you would trust it and the phishing email attack has worked.
The major email client vendors have been notified of the vulnerability.
So now the vendors know about this they will fix it?
Mozilla Thundbird is going to do something about it in the future. Microsoft has decided to take no immediate action for Outlook, Google has not commented on Gmail.
The article outlines how to the exploit works in these products.
Mitigation?
I’ll quote from the article for my conclusion:
“Unfortunately, for the foreseeable future, it is sadly not realistic to expect email clients to implement robust mitigation. This means that it is up to the users to be aware of the dangers of HTML emails and to take the necessary precautions.” Konstantin Weddige
It looks like it comes back to training and awareness. Here are our options.
Clive Catton MSc (Cyber Security) – by-line and other articles
