Not That You Asked

Sneaky Email Sucks

Having just hastily pulled together my last post on “Phishing” – I’ve been keeping a keen eye on my inbox for more interesting examples of evil email. A new message caught my eye – a good example of bad email – possibly evil, but sneaky at best.

Here are some key elements worth calling out:

[1] Once again, listed in my inbox the message looks innocuous enough. I recognize Reunion as Reunion.com – I’m not a member but occasionally see these types of invites, similar to other social space sites like Facebook, Linkedin, Plaxo, etc…

[2] Mozilla has protected me again – like with Mozilla Firefox screening links I click to known bad websites, Mozilla Thunderbird blocks any images from rendering – particularly from senders that are not in my address book. They give me the option of allowing this if I choose – presumably for senders I know. This is a common feature in email tools.

[3] Ah, here we see a bit more than we did in the Inbox listing [1]. Now I see a bit of trickery – Reunion Request is plain enough but now I see the local/user part of the sending email address is reun-ion.request@ and the domain portion is mutebrmodern.net. Why would anyone have to jack up the user portion of their email that way? It’d be like me being to-mba.rtel@somedomain.com. And that domain, if this is from Reunion – who the heck is mutebrmodern.net? It’s not out of the ordinary to have other domains send on your behalf, particularly if as a business you contract it, but as a user/recipient, your radar should be up at this point.

[4] Now this is really sneaky – back in the early days of email, there was only plain text formatting. Eventually HTML formatting made it to email providing a richer aesthetic appearance for content, similar to web pages. It can be useful, but some email programs can struggle with display of HTML code. At first blush it appears that something has gone wrong with my email program, Thunderbird, trying to render the message. Gosh, I am having trouble reading this message so I guess I better click the link right? More on that in a moment…

[5] Quick mention to take note of my email address in he URL/link in the message – shows me that the message is “personalized” but also a flag that I’m being tracked – when I click, someone, somewhere will know it was me.

[6] You have virus protection on your computer, right? I do. Make sure your anti-virus software scans your email, inbound and outbound. I’ve used AVG by Grisoft for several years. It is a fantastic program, and is free for individual, non-business purposes.

So back to point [4] – I’m not necessarily buying this – the error message “Having trouble viewing this message?” looks odd – not like what I’ve seen before in my email program. Now, I’m an email guy and have regularly scrutinized email as part of my job for years, so I don’t expect others to know this, but you can look at the raw source of an email to get even more insight. In Thunderbird a handy shortcut, Ctrl-U, does this. Here are some notable and telling things about this message from analyzing the raw message:

[7] Looking at the transmission details of the email recorded in the message headers, I see that the mail was delivered to my email server from yet another unknown domain, lsrree217.closerdried.net. As I said, it is not uncommon for legitimate companies to outsource delivery of email, but there is usually clear accountability and transparency in the domain names of those legitimate email service providers. I’m getting the feeling here that someone is purposely trying to not be known here.

[8] Further down in the message I see the plain text portion of the source message and my suspicions are confirmed – my email program Thunderbird didn’t have a problem showing the message and prompt me with “Having trouble view this message?” – that’s what the email author typed in – that is the message! Further review of the message source shows that this is the case in the HTML portion of the message as well. Okay, now I’m certain the sneakiness here is intentional.

[9] Here is more sneakiness/evilness – something those in the anti-spam space refer to as “hashbusting”. Sophos has a good example of it on their blog in which they describe it as “Hash busters are the seemingly random words or sentences located at the bottom of a spam message, used to try and bypass a variety of anti-spam techniques“. In the Sophos example the spammer puts the words where they are visible to he end recipient. In my case, the rendered message didn’t show this because the sender hid the random words in some HTML tags that aren’t visible.

Okay, so I’m convinced this isn’t even quasi-legit at best at this point, but I’ll bite – let’s click the link.

[10] mylife… what is that? Isn’t this supposed to be Reunion? In this case I happen to know that Reunion recently re-branded as mylife. Looking at the web address I see it starts with http://affiliates.mylife.com which is the bonafide mylife (formerly Reunion) website. Apparently Reunion has an affiliate member who advertises on their behalf, who not only uses sneaky and evil tactics, but hasn’t adjusted for the new brand!

[11] What the heck does this say? One of the things we encourage emailers and web site operators to do is to be openly transparent and accountable. Notices and disclosure in teeny type with low contrast is simply untrustworthy on the face of it. Bad job here mylife.

[12] This web page comes with a third-party seal of trust from Truste. These can be easily faked as well, but clicking on it shows it is legitimate.

[13] Again, check the website URL and validate that it makes sense and meets your expectation. In this case the Truste logo goes to a truste.org site and appears to make sense referencing the [14] mylife.com page we clicked from.

So, that’s a lot of analysis from one email. If anything, it exemplifies how easy it is for mailers to be sneaky in their email and how hard it is for consumes to understand what’s legit and what isn’t. In this case, Reunion appears to operate an affiliate program. That’s not uncommon for businesses on the Internet – but it take s policing – I’m betting (and hoping) that they aren’t aware of this particular affiliates behavior. I’ll pass this information along to them – in the hope that they will terminate this bad actor from their affiliate membership.

If you’ve got a good product, you shouldn’t have to trick people to come to find out more about it.