GFI Forums: Kerio Connect » eMail Name fakers

Home » GFI User Forums » Kerio Connect » eMail Name fakers

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

eMail Name fakers [message #138993]

Tue, 27 March 2018 16:52

Spacey
Messages: 143
Registered: July 2011

Hi,

since several time we're getting spammed by outside spammers: The emails come from external servers & accounts but only the sender Names are faked to our own employee ones. Of course the spam text itself is obvious but it annoys many people here. The problem: We got the whole company team incl. eMails on our website and I guess the spammers just grabbed that information and now send's spam with our own names.

Is there any way to block external sender names matching our own employee names?! Some cross name database check or whatever?!

So if an eMail comes in from "Eric Price" <whatever<_at_>external-spam-domain.com> to some existing eMail receipent where "Eric Price" for example is a real existing person in our kerio?!

Thx!

Report message to a moderator

Re: eMail Name fakers [message #139003 is a reply to message #138993]

Wed, 28 March 2018 03:22

j.a.duke
Messages: 239
Registered: October 2006

@Spacey:

You didn't list what you have enabled to combat the spam. Or what version of Connect.

Are you using any blacklists?
SpamAssassin?
Kerio Anti-Spam?
Custom rules?
What's your tag setting? Block setting?
I'm sure there's more, but those answers will be a good start.

Thanks.

Cheers,
Jon

Report message to a moderator

Re: eMail Name fakers [message #139012 is a reply to message #139003]

Wed, 28 March 2018 09:25

Spacey
Messages: 143
Registered: July 2011

Hi...

General Settings: Spam-Tag: 5 / Block: 9
Kerio Anti-Spam: Enabled (Add 6 points)
SpamAssassin: Enabled
RBL's: SpamCop (add 5), SpamHaus ZEN (add 5), SORBS DNSBL (add 2.5), NiX Spam Manitu (add 5), Barracuda Networks (add 3.5), GBUdb (add 2.5), PSBL (add 2.5)
Caller ID: Enabled (add 4)
SPF: Enabled (add 4)
Spam-Repellent: Enabled (22 seconds)

Some own allowed foreign domains which aren't involved in these cases.

Report message to a moderator

Re: eMail Name fakers [message #139019 is a reply to message #139012]

Wed, 28 March 2018 15:16

Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California

You can solve this situation with the anti-spoofing feature https://manuals.gfi.com/en/kerio/connect/content/server-conf iguration/security/configuring-anti-spoofing-in-kerio-connec t-1491.html

Brian Carmichael
Instructional Content Architect

Report message to a moderator

Re: eMail Name fakers [message #139022 is a reply to message #139019]

Wed, 28 March 2018 16:56

Spacey
Messages: 143
Registered: July 2011

Thanks Brian,

this is already enabled in general and for our main domain but matches only the sender-eMail-Adresses - not the names.

The problem here is that the "name" (which appears in the eMail client, the direct (unknown) address is only visible when you hover over the sender name or click it.

If someone sends with a faked address our Kerio already denies it. This is just about name fakers! :/

Report message to a moderator

Re: eMail Name fakers [message #139024 is a reply to message #139022]

Wed, 28 March 2018 17:49

Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California

Ok I see now. In this case you can create Message Filter rules like this:
- All of the conditions are met
- Condition 1 = where from contains "Eric Price"
- Condition 2 = where sender does not contain "your.domain.com"
- Action = reject message

The caveat is that your users won't be able to send/receive email with anyone who happens to share the same name as them. Otherwise you should investigate these spam messages further and optimize your spam filter based on other characteristics than the from name.

Brian Carmichael
Instructional Content Architect

Report message to a moderator

Re: eMail Name fakers [message #139055 is a reply to message #139024]

Thu, 29 March 2018 09:54

Spacey
Messages: 143
Registered: July 2011

OK, that's a manual solution - yes.
You mean a personal filter for every user, eh?!

I tried the following - see screenshot. But unfortunately this doesn't work... The eMail is still in the inbox.

Other spam filters: Problem is that the sender-email-adresses & domains follow no rule, these are hacked normal accounts or whatever. No idea where to start here.

Attachment: Bildschirmfoto 2018-03-29 um 11.12.56.png
(Size: 31.76KB, Downloaded 603 times)

[Updated on: Thu, 29 March 2018 11:14]

Report message to a moderator

Re: eMail Name fakers [message #140738 is a reply to message #139055]

Tue, 28 August 2018 21:00

blackbox
Messages: 46
Registered: May 2006

This approach seems a bit limited in scope (configured within an individual user's account).

Would you have a recommendation for the same equivalent on a more global scale (something that could be applied at the server vs the client)?

Quick update, while diving in, it looks like server side rules now many be possible starting with version 9.

https://manuals.gfi.com/en/kerio/connect/content/server-conf iguration/filtering-messages-on-the-server-1831.html

[Updated on: Tue, 28 August 2018 22:04]

Report message to a moderator

Re: eMail Name fakers [message #140743 is a reply to message #140738]

Wed, 29 August 2018 13:18

freakinvibe
Messages: 588
Registered: April 2004

You would have to work somehow with variables to match your user's names. I don't know if that is possible. In addition, if you have a John Miller in your company and a John Miller whats to write to you, he can't because you block him.

I'd rather look at the headers and contents of those messages and find something in common that you could block via global rule.

If you could post the header of such a message, I could have a quick look.

Dexion Services AG - IT Support Services in Basel, Switzerland
https://dexionag.ch

Report message to a moderator

Re: eMail Name fakers [message #140744 is a reply to message #139024]

Wed, 29 August 2018 16:33

blackbox
Messages: 46
Registered: May 2006

I haven't had any success testing with the method described, as the message arrives without issue.

Quote:

Wed, 28 March 2018 11:49
Kerio/GFI Brian
Ok I see now. In this case you can create Message Filter rules like this:
- All of the conditions are met
- Condition 1 = where from contains "Eric Price"
- Condition 2 = where sender does not contain "your.domain.com"
- Action = reject message

I also tried altering condition 2 a bit, using the "From" header instead of "Sender".

- All of the conditions are met
- Condition 1 = where from contains "Display Name"
- Condition 2 = where from does not contain "domain.com"
- Action = reject message

No luck with this approach either, test message arrives without issue.

Report message to a moderator

Re: eMail Name fakers [message #140746 is a reply to message #140744]

Wed, 29 August 2018 17:32

blackbox
Messages: 46
Registered: May 2006

I dove in a bit more to the suggested course of action.

My results match those of Spacey.

Passing the header information into a notification message via: perform the following action, send notification, displaying the following:

from: $from$
subject: $subject$
text: $text$

suggests the display name is not picked up within the from value, providing only the email address when output.

Example incoming message:

From: Joe User <bad<_at_>guy.com>
Subject: Trust me, I'm legit.
Body of email

Sends a notification containing the following:
from: <bad<_at_>guy.com>
subject: Trust me, I'm legit.
text: Body of email

If I alter the rule to look for a specific from:email address, the rule does work, but basing the rule on a specific from:display name value, as was the main focal point, doesn't seem to work.

Report message to a moderator

Re: eMail Name fakers [message #140752 is a reply to message #140746]

Wed, 29 August 2018 19:46

blackbox
Messages: 46
Registered: May 2006

Post http://forums.kerio.com/m/125940/7359/2bb237f42e204728b0b328 9a29fb5145/?srch=sieve#msg_125940 and http://forums.kerio.com/m/130192/7359/2bb237f42e204728b0b328 9a29fb5145/?srch=filter.siv#msg_130192 seem to suggest Kerio follows the Sieve specs discussed within RFC3028. https://www.ietf.org/rfc/rfc3028.txt

The suggested rule created within the admin console seems to use the "address" Sieve test and not the "header" Sieve test.

The difference being, the header Sieve test compares the complete header text contents (allowing check for everything after From: on the header line, in this case "Display Name" <bad@guy.com>, while the address Sieve test compares only the actual address (everything inside the angle brackets < > on the header line, in this case bad<_at_>guy.com.

Web admin GUI produces something like the following:

if allof (address :all :contains "From" "Joe User", not envelope :all :contains "From" "mydomain.com") {discard; stop;}

Perhaps the rule may work as intended if altered to:

if allof (header :all :contains "From" "Joe User", not envelope :all :contains "From" "mydomain.com") {discard; stop;}

[Updated on: Wed, 29 August 2018 20:11]

Report message to a moderator

Previous Topic:	Outlook one user, multiple accounts
Next Topic:	CentOS 7 + Kerio Connect + Fail2Ban

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Wed Mar 22 04:52:03 CET 2023

Total time taken to generate the page: 0.01771 seconds