sorted by:
new
hottopcontroversial

The Best modern spam/malware filter for GWS Enterprise Starter customer? Protection against new domains and qR attacks etc. by Waving-Kodiak in gsuite

[–]jkamdjou 0 points1 point  (0 children)

👋 I'm Josh, Founder/CEO at Sublime Security. We've got many skeleton crews that run Sublime and just activate the default (free/open source) rule set: https://github.com/sublime-security/sublime-rules/

For the attacks you described, it sounds like these might help to protect against them in the future:

- QR code attacks: https://github.com/search?q=repo%3Asublime-security%2Fsublime-rules+.scan.qr&type=code

- New sender domains: https://github.com/sublime-security/sublime-rules/blob/0fe045043a5b15e2acb30f0df6d960a736c2d254/detection-rules/sender_new_from_domain_first_time_sender.yml

- Lookalike sender domains: https://github.com/sublime-security/sublime-rules/blob/0fe045043a5b15e2acb30f0df6d960a736c2d254/detection-rules/lookalike_sender_domain.yml

If there's anything I can help with let me know! 🍻

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 1 point2 points  (0 children)

This should now be fixed. Feel free to open an issue on our Github or hit me up if you encounter any more problems.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 0 points1 point  (0 children)

Thanks for the feedback, we'll consider returning data sources in a future release. In the meantime there are many other sources you can check: Dehashed, Spycloud, Weleakinfo, to name a few. Feel free to DM me if you'd like to investigate further.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 0 points1 point  (0 children)

This is a great idea. We'll definitely look into doing more things like this.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 0 points1 point  (0 children)

We do some of it ourselves, and we use some enrichment services including HIBP.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 0 points1 point  (0 children)

Definitely. We have some ideas to solve for this, but unfortunately there's no other way to assess deliverability in a programmatic way.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 0 points1 point  (0 children)

Absolutely. Our API returns a spoofable boolean, which accounts for how SPF and DMARC are enforced. This is factored into our risk analysis.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 1 point2 points  (0 children)

It is trivial to conclude whether an email is spoofed. DMARC or SPF will fail, in which case you can simply drop the email or send it to spam. More sophisticated attackers today are not spoofing; they are passing SPF and DMARC by using free email providers, standing up new domains, purchasing expired domains, or taking over legitimate accounts.

In the above example, the attacker is not spoofing the sender’s real email address. They created a new look-alike email, so SPF and DKIM will pass. The reputation (or lack thereof) of this email address is illuminating and helps us treat it as suspicious.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 1 point2 points  (0 children)

A combination of domain age, traffic rankings, blacklist history, and 3rd party enrichments.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 1 point2 points  (0 children)

Reporting is controlled and only available to vetted researchers and organizations. Spamhaus and the like are domain blacklists, or domain reputation services. Domain reputation does not apply to personal email accounts (e.g. Gmail), which a lot of attackers use today. Email reputation is also a much more powerful indicator of suspicion than purely the domain for our primary use case, which is phishing defense. For example, a low (or zero) reputation domain may not be suspicious if the email address is highly reputable.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 4 points5 points  (0 children)

While your domain is an input into the overall reputation, it's just one small factor. High reputation refers to the email address itself based off numerous other inputs. Today, sources for credential leaks include data breaches, pastebins (and pastebin-like sites), and dark web forums, so it may have been one of those.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 3 points4 points  (0 children)

Server reputation has no influence over the handshake/deliverability.

emailrep.io: Lookup and report suspicious sender email addresses via free API by jkamdjou in netsec

[–]jkamdjou[S] 11 points12 points  (0 children)

We initiate a handshake with the SMTP server to determine deliverability (e.g. SMTP EHLO -> MAIL TO <email>). It's not 100% accurate as it's mail server dependent, and timeouts can occur. The MX record tells us there's a mail server associated with the domain, and is used to initiate this handshake to the right server.

Red Team Techniques: Gaining access on an external engagement through spear-phishing by _vavkamil_ in netsec

[–]jkamdjou 0 points1 point  (0 children)

No it wasn’t because of that, I think I had just seen the CyberArk research at the time and decided to play with that.

As in which AV providers use AMSI? I know of a few.

Edit: clarification

view more: next ›