Homer’s great epic “The Iliad” deals with the assault on heavily fortified Troy by the united Greek forces. It dates back to 1250 B.C., the polytheistic ancient Greek civilisation. It all started after the Queen of Sparta left her husband, Menelaus and eloped with the Trojan Prince, Paris and sailed across the sea to Troy. This set the stage for clash between 2 powerful but friendly nations the Greeks and the Trojans. The Spartan King, Menelaus joined his forces with his brother commander Agamemnon. Together they amassed a fifty thousand strong army to attack Troy across the Aegean Sea.
On the other hand, Troy was never defeated; their city walls were so strong that it was never breached by anyone in the known history. Paris’s elder brother Hector the future King of Troy was a very skilled warrior and a foremost war strategist.
However, the emergence of Achilles, the famous Greek mythological character to support the Greek cause helped the Greeks to turn the table on the Troy. Turns of events forced the Trojans to fell back to their best defensive posturing.
Once the Trojans hidden themselves inside the strong walls of the city the Greeks were left with nothing but to starve and die. Months after when the Trojan spies informed the King about the waning Greek camp, his confidence boosted up. In the mean time the Greeks built a huge wooden horse and left it at the door of Troy as a gesture of goodwill before they sail back to Greece.
The Trojans welcomed the horse inside their fort as an acceptance of the goodwill and a gift from the royal deity Apollo. Every Trojan celebrated that day as a mark of victory over Greeks and went on to sleep jubilant.
This was all staged, Greeks never left for their home. They were all keenly waiting at the doors of the Troy for their soldiers hiding inside the wooden horse to open the city door in the dark of the night.
That was the back story of Trojan Horse. An otherwise legitimate looking person/object/application will get access into your most fortified infrastructure with clearly malafide intention to carry on havocs later.
Cyber attacks such as Phishing, and Spoofing are based on this concept.
✓ 3.1 billion domain spoofing emails are sent per day.
✓ More than 90% of cyber-attacks start with an email message.
✓ Email spoofing and phishing have had a worldwide impact costing an estimated $26 billion since 2016.
✓ In 2019, the FBI reported that 467,000 cyber-attacks were successful, and 24% of them were email-based.
✓ The average scam tricked users out of $75,000.
A common attack that uses email spoofing is CEO fraud, also known as business email compromise (BEC). In BEC, the attacker spoofs the sender’s email address to impersonate an executive or owner of a business. This attack usually targets an employee in the financial, accounting, or accounts payable departments.
Even smart, well-intentioned employees can be tricked into sending money when the request comes from someone they trust—especially an authority figure. Here are just a few high-profile examples of phishing scams:
✓ The Canadian City Treasure was tricked into transferring $98,000 from taxpayer funds by an attacker claiming to be city manager Steve Kanellakos.
✓ Mattel was tricked into sending $3 million to an account in China, but it was lucky enough to claw back the money when the defrauded financial executive was able to confirm that the email message was not sent by the CEO, Christopher Sinclair.
✓ The Crelan bank in Belgium was tricked into sending attackers €70 million.
✓ Three specific instances are increasingly adopted by fraudsters to send emails urging the recipient to inter alia click on a phishing link, effect a financial transaction, download (potential) infected file and/or divulge confidential information.
Method 1:
The email in the specific instance contains a mandate to do a fund transfer on urgent basis. In this case, the executive, by seeing the display name and not the sender’s email-id is subjected to “Display name spoofing” email fraud.
As seen above, while the email originates from some email account unrelated to the bank, the display name is spoofed by the fraudster or chosen in such a manner that a recipient may be deceived to think that the email is legitimate and has originated from the email account of the MD of ABC Bank.
The actual sender is a fraudster using some mail services account and not the bank’s mail domain name and therefore controls like DMARC may not be able to prevent this type of attack.
Method 2:
The legitimate email address of the MD of VICTIM Bank is mdceo@victimbank.co.in. A staff of the bank receives an email to remit funds to a third party some outside entity.
| Email Parameter | Expectation | Reality |
| Sender’s Display Name | MD, Victim Bank MD | Victim Bank |
| Sender’s Email Address | mdceo@victimbank.co.in | mdceo@victmbank.co.in |
On a closer scrutiny of the email-id, everything in the mail looks legitimate except that it originated from a domain looking similar to that of the bank’s domain [Note victmbank.co.in and NOT victimbank.co.in].
The recipient thus remits the fund to a fraudulent entity in a manner that appears completely normal to him. The mail could be received as if sent from a top executive/existing/potential customer/entity dealing with the bank etc.
Fraudsters also have, on multiple occasions, attempted this approach to defraud the regulated entities by posing as regulators. Email addresses such as csite@rbii.or.in; ubdnewdelhi@rb.org.in with seemingly legitimate display names and official-looking email signatures and language have been used in the past.
Recently, there was a fraudulent email sent from csite@rbi.org.in [mailto:csite@cdrbi.org.in] to the banks. It may be observed that the sender mail domain is “cdrbi.org.in” and not “rbi.org.in”.
Method 3:
A fraudulent email originates from what appears to be a legitimate email address of the sender in the bank’s domain. This is an instance of Email Address Spoofing.
| Email Parameter | Expectation | Reality |
| Sender’s Display Name | MD, Victim Bank MD | Victim Bank |
| Sender’s Email Address | mdceo@victimbank.co.in | mdceo@victimbank.co.in |
Such emails may be identified, flagged and acted upon by a DMARC solution.
Leave A Comment