Towards Blocking Outgoing Malicious Impostor Emails

Abstract

Electronic mails (emails) have become an indispensable part of most people's daily routines. However, they were not designed for deployment in an adversarial environment, which explains why there have been so many incidents such as spamming and phishing. Malicious impostor emails sent by sophisticated attackers are perhaps even more damaging, because their contents, except the attachments, may look perfectly legitimate while silently targeting certain critical information such as cryptographic keys and passwords. In this paper, we explore a mechanism for blocking malicious impostor emails called ContAining Malicious Emails Locally (CAMEL), which aims at blocking compromised victim user machines from further infecting others.

Behavioural Observation for Critical Infrastructure Security Support

“…The United Kingdom, particularly in 2011, has also been very vocal on the large volume of cyber-attacks that occur daily, which are aimed at government services and global corporations, with the Secretary of State for Foreign Affairs, William Hague, highlighting the volume and variety of cyber-threats being encountered. Whilst many of the attempted attacks remain small, for example, malicious emails [32], [33] containing Trojan horses [34], the sheer volume of the attacks occurring, regularly poses a cause for concern.…”

“…As emailing has become indispensable to the operation of businesses, a threat of malicious emails has also grown exponentially [32], [33]. This threat is particularly difficult to counter as their contents may seem genuine making them challenging to identify.…”

e-mail authentication system

“…Kartaltepe, E.J., and Xu, S. [9], propose a blocking mechanism for spam e-mail call ContAining Malicious E-mails Locally (CAMEL). The CAMEL mechanism is enforced at legitimate outgoing e-mail servers.…”

“…Similar to [9], Yeh, C.F. et al [10] had considered the profiles of users or users' interesting topics.…”

SEFAP: An Email System for Anti-Phishing

“…It also requires the email servers have the established trust (i.e., sharing a common secret), which requires the unrealistic, widespread common key exchange and deployment. Mechanism, CAMEL (ContAining Malicious Emails Locally), dealing with the malicious imposter email including the case that the claimed email senders could have been compromised by the adversary, was explored in [6] in 2006. The mechanism was designed to block outgoing malicious imposter emails to avoid the malicious imposter email attacks.…”