Digital Security Authority | Critical information infrastructure in Cyprus falls victim to spoofing attack

Defence Redefined

Published on 26/11/2020 at 17:05

Recently a critical information infrastructure in Cyprus fell victim to a spoofing attack, according to which an email account of the infrastructure was falsified with malicious intent.

Spoofing attack concerns the creation of emails entailing malicious intent. Such emails are created by falsifying e-mail accounts and web addresses from a legitimate source and show that they are sent by the latter in order to mislead the recipient.

The purpose of forging an email address is to get the recipient to take action by trusting the sender. The result of a successful spoofing attack could be the interception of credentials, money, the control of a system as well as the installation of malware.

Spoofing protection measures include the following:

• Adjust spam settings
• Add a Sender Policy Framework (SPF) record where an SPF record lets recipients know if the email is spam
• Use Domain Keys Identified Mail (DKIM) encryption template in the email header. This way when a server receives an email, it checks if someone has lost that email while it was sent, allowing the SPF to minimize the risk of forgery
• Careful check of the sender’s information. Check email headers. The sender’s IP address can be extracted from the email headers and a reverse IP search can be performed to verify the sender
• Installation of DMARC Record in the infrastructure. DMARC (Domain-based Message Authentication, Reporting & Conformance) performs authentication, reporting and compliance based on emails received for protection against spoofing and phishing attacks

Also read: Cyberattack on CNA | What the Digital Security Authority says