Entries by Rodolfo Saccani

The mysterious protocols: SPF, DKIM and DMARC explained

November 2, 2020 in /by

Email is an ancient thing, it was born much longer before the Internet. The first email system was born in 1965 at MIT. At that time email communication was limited within the boundaries of a single mainframe, those huge and very expensive and delicate multi-user computers that occupied entire air-conditioned rooms and required continuous supervision. […]

Email trojan horse: application/html entity

November 22, 2019 in /by

We just discovered a new trick that is currently being used to slip malicious html files through email security solutions and,  in some cases, through antivirus engines. The trick is quite simple: declaring an email entity as “application/html” instead of “text/html”. “application/html” is an invalid type and this allows it to slip through some checks. […]

Phishing campaign uses Google reCAPTCHA to avoid Sandbox detection

September 9, 2019 in /by

Recent email phishing campaigns are using Google reCAPTCHA as part of their efforts to bypass click-time protection sandboxing, requiring user interaction before delivering the actual contents of the phishing page. We have seen two different instances of such campaigns, both are targeting Office 365 users in order to collect their credentials. Implementation details suggest that […]

Ramnit apparently still spreading after 9 years

March 19, 2019 in /by

It might be a targeted attack, given that we detected it only in one organization, or it might just be an ancient infection still attempting to propagate. In both cases it is an interesting case. The attack is coming via email, which is interesting given that it is a vbscript attack. Here is how the […]

How your email credentials end up in the wrong hands and how they are monetized

March 6, 2019 in /by

Anything can be monetized online, especially the credentials of your email account. Here is how they are abused. Botnets are one of the main distribution channels for malware and phishing email. A botnet can be composed of hundreds of thousands of compromised devices (increasingly IoT devices) and the command-and-control (C&C) center coordinates the activity of […]