Discussion Reply to spoofing email gets answer from spoofer. How?

[Hlsgsz]

Please consider this scenario, all while using Gmail's web client in an upto date and secure browser:
Someone receives a legit email containing important information and, after a few hours, a spoofed email containing the same, but with some vital information altered. Gmail sais that it can't verify the identity(SPF failure), but said person unattentively replies to the bad email.

Now, here is the part I can't figure:
A reply arrives from the spoofer(again, with failed SPF), even if the victim's reply was directed towards the correct email address(there was no reply-to in the bad email and the return path was set to the proper address). How can bad actors achieve this and where do you think the breach in confidence is most likely, on the victim's side or with the owners of the legit email on the other side. So far as I can tell, the pc used is clean.

Thank you!

 

[rgd1101]

is the a real issue. or make believe?

 

[Hlsgsz]

is the a real issue. or make believe?

Real, unfortunately.

 

[rgd1101]

, but said person unattentively replies to the bad email.

? so, did they or did they not replice to the bad email?

 

[Hlsgsz]

? so, did they or did they not replice to the bad email?

Yes, they replied to the bad email. What I don't get is how the reply got to the spoofers, as they responded back. The correct email address was spoofed, so the reply should have arrived to that, so far as I understand these things.

 

[Ralston18]

Perhaps the "reply" did not actually get back to the spoofers.

The spoofer's simply sent another email pretending that they got a reply.

Just fudged the second email enough to appear to have done so.

I get regular "junk" mail that uses a similar approach using words and phrasing to make it look as if I failed to do something. E.g., "You have yet to....." sort of language. Often referring to a previous, non-existing correspondence.

And rather realistic phone calls from "Jim" in "Shipping" claiming my shipment is ready....

Scammers, crooks, etc. are very igneous when it comes to such things.

 

[rgd1101]

or could be the sender that got hack? email got forward?

 

[Hlsgsz]

Perhaps the "reply" did not actually get back to the spoofers.

The spoofer's simply sent another email pretending that they got a reply.

No, the reply was precise and in the right context. The victim replied with a (unpredicatable) question and the spoofers answered.
So, in your opinion, am I correct in assuming that a reply to a spoofed email should arrive at the proper address, not the spoofers? If so, I am assuming this to be some sort of man-in-the-middle attack on the other side, since the victim was using Gmail in a browser(HTTPS). Either that, or some sort of remote access to the victim's computer, but I scanned it thouroughly with a good AV.

 

[Hlsgsz]

or could be the sender that got hack? email got forward?

That's what's I'm assuming. One of the sides must be compromised, and trying to figure out which one.

 

[rgd1101]

If only email from that one sender having issue. would assume that the issue.

but then not sure what this "some vital information altered", so it might be only targeting that sender too.

 

[Ralston18]

Way out of my comfort zone now.

But I got to wondering about using BCC to hide another "reply" to the spoofer(s).

No way for me to figure out the forensics involved but just reading more about "failed SPF" led me to believe that discovering what went astray may take some effort.

Again, I am out of my comfort zone but I do believe what happened can be worked out if that is deemed a "must do".

For example; the following link may be suggestive with respect to what happened and how.

https://support.gfi.com/hc/en-us/ar...different-results-in-Sender-Policy-Framework-

And this next link gets even more involved.

View: https://www.reddit.com/r/sysadmin/comments/aph6ee/lets_talk_about_email_spoofing_and_prevention_alt/?st=k05nodh2&sh=3d4026b6


But that work must be done by someone who can readily delve into all of the related configuration settings, logs, etc..

Reverse engineering may uncover the flaw.

 

[ex_bubblehead]

The "From:" field is just a text field that can contain any text at all. It is NOT definitive. You have to parse the headers to deduce the actual sender, which is what your email application uses when replying. This is the way email has worked since day 1 all those decades ago. And one should NEVER reply to spam as all it does is confirm a live mailbox.

 

[Hlsgsz]

The "From:" field is just a text field that can contain any text at all. It is NOT definitive. You have to parse the headers to deduce the actual sender, which is what your email application uses when replying. This is the way email has worked since day 1 all those decades ago. And one should NEVER reply to spam as all it does is confirm a live mailbox.

I actually did one better and checked the code of the actual reply sent by the victim and it did go to the proper email address, yet the spoofers replied..

 

[Hlsgsz]

Way out of my comfort zone now.

But I got to wondering about using BCC to hide another "reply" to the spoofer(s).

No way for me to figure out the forensics involved but just reading more about "failed SPF" led me to believe that discovering what went astray may take some effort.

Again, I am out of my comfort zone but I do believe what happened can be worked out if that is deemed a "must do".

For example; the following link may be suggestive with respect to what happened and how.

https://support.gfi.com/hc/en-us/ar...different-results-in-Sender-Policy-Framework-

And this next link gets even more involved.

View: https://www.reddit.com/r/sysadmin/comments/aph6ee/lets_talk_about_email_spoofing_and_prevention_alt/?st=k05nodh2&sh=3d4026b6


But that work must be done by someone who can readily delve into all of the related configuration settings, logs, etc..

Reverse engineering may uncover the flaw.

Thanks for the resources. I'll post here if I ever manage to figure out what's what.