RavenMail Security’s Post

Name: RavenMail Security on LinkedIn: #emailsecurity
Uploaded: 2024-10-17T04:10:20.983Z
Duration: 2 min 58 s
Channel: RavenMail Security
Description: Demo Attack #4: Often SoC teams block malicious IP addresses, but this can be by-passed by using masking your real IP using a TOR network. Here's a short explainer on how threat actors use ToR to send mail and by-pass traditional mail security To view on YouTube: https://lnkd.in/gX-GZAir #EmailSecurity

RavenMail Security

402 followers

2mo

Demo Attack #4: Often SoC teams block malicious IP addresses, but this can be by-passed by using masking your real IP using a TOR network. Here's a short explainer on how threat actors use ToR to send mail and by-pass traditional mail security To view on YouTube: https://lnkd.in/gX-GZAir #EmailSecurity

Transcript

Tor The Onion Router is a free, open source software that enables anonymous communication over the Internet by routing traffic through a global network of volunteer operated servers. How does Tor hide the real IP address? Tor hides your real IP address by encrypting your Internet traffic and routing it through multiple nodes, making it difficult for anyone to trace your online activities back to your original location. Multilayer encryption. Onion routing. And I address obfuscation Tor users onion routing, where data is encrypted in layers and sent through several nodes, each decrypting a layer which ensures that no single node knows both the sender and the receiver, effectively obfuscating your IP address. Each step shows how the e-mail travels through the Tor network, starting from the user and moving through encrypted nodes, ending at the e-mail provider with a hidden IP. This is my preferred way to do it. Using a Linux based OS and install tool. Have a script which we'll use or handle tour related functionalities such as refreshing tour circuit and handle proxy settings. Next step is to have a config file where you have all this credentials of the e-mail sender. I'm using Mailgun for this example. Get the list of recipients you want to send the e-mail. The if the tour circuit is working properly now trigger the e-mail. This will give us more flexibility in anonymity. By hiding the reli. Once the script is executed, we can see that the e-mail is sent to the victim. Here we'll be sending 2 emails, 1 using normal way too using it in the tour way. As we've now received the first e-mail, let's send the second one. As we can see in the video, I'm making some changes in the config file to enable tour and send the e-mail. Now we've both the emails, let's see the difference between both the emails. In one of the emails received from filed, we can see that the from address is 124.123 dot X ** dot ** X which is the original IP whereas in the other. Ace of the emails from address we can see that the address is torexit128.relyon.org. Do weave any limitations? Yes, we do hit few limitations in this process. We are anonymous but not invisible. While Tor provides strong anonymity, it's important to remember that the content of your e-mail, unless encrypted, can still be read by the e-mail provider or intercepted in transit. Use encryption tools like PGP for content. Privacy.

To view or add a comment, sign in

More Relevant Posts

Darktrace

216,770 followers
1mo
Report this post
Did you know that a simple phone call could lead to a major network compromise? 📞 When a remote user fell victim to a vishing attack, it allowed a malicious actor to gain access to a customer network. But thanks to our swift detection and response, we prevented any data loss and secured the network. Discover the full story and learn how we tackled the threat in our Inside the SOC blog 👇 🔗 https://lnkd.in/gbMRkvsM

1 Comment
Like Comment
To view or add a comment, sign in
Katherine Winn

Certified in Cybersecurity | Self-Learning AI Partner for The Bay Area
1mo
Report this post
In today’s threat landscape, while we can’t always stop vishing at its source, Darktrace focuses on preventing attackers from achieving their end goal. Here’s how: 1. A vishing attacker spoofed an internal IT line and tricked a remote user into approving an MFA request. 2. The attacker used static IP addresses to proxy through the VPN, making their actions appear legitimate. 3. Darktrace detected reconnaissance activities like LDAP and port scanning, alongside failed NTLM authentication attempts. 🛡️ How Darktrace Stopped the Attack on the remote user: Autonomous Response blocked all outgoing traffic and SMB connections. Enforced a pattern of life and contained activity, halting lateral movement. Learn more about how Darktrace protects against these threats:

Darktrace

216,770 followers
1mo

Did you know that a simple phone call could lead to a major network compromise? 📞 When a remote user fell victim to a vishing attack, it allowed a malicious actor to gain access to a customer network. But thanks to our swift detection and response, we prevented any data loss and secured the network. Discover the full story and learn how we tackled the threat in our Inside the SOC blog 👇 🔗 https://lnkd.in/gbMRkvsM
Like Comment
To view or add a comment, sign in
Des Denny
8mo
Report this post
Time is of the essence when tackiling adversaries, you need a SOC that has the agility to react with one source of truth. ⌚ It's time to transform your SOC to outpace today's adversaries. ⚡ Discover how the next generation of #SIEM will help you stop breaches faster than ever. 💻 Register for the definitive SOC transformation event of the year: https://lnkd.in/eKHM-Xrg
Like Comment
To view or add a comment, sign in
Connie Dimitroff
4mo
Report this post
Can you believe 80% of the breaches we see leverage identity as a key component? Because of this we want to help you learn how to protect your users. Join us for a webinar on 8/21 so you can see how Duo is working hard to stop identity-based attacks. How do we do it differently? It starts with offering broad identity coverage for really unique use cases, with intelligent and actionable visibility into all identities, all while having the easiest experience for both end users and IT administrators. Register now as you don't want to miss it! https://lnkd.in/eJ9nj8nK

5 Ways Duo Helps you Combat Identity Attacks

duo.com
Like Comment
To view or add a comment, sign in
Jason Giorgetti
9mo
Report this post
Join Cortex by Palo Alto Networks on Feb 15 for a 30-minute demo of #Cortex XDR and see how it can help your SOC ensure the security of your organization while staying within budget. Don't miss this opportunity to learn how Cortex XDR can help you avoid breaches! #SecuredByPANW

Detection + Response

register.paloaltonetworks.com
Like Comment
To view or add a comment, sign in
Tyler Neidhart

Solutions Consultant - Enterprise Ohio
9mo
Report this post
Join Cortex by Palo Alto Networks on Feb 15 for a 30-minute demo of #Cortex XDR and see how it can help your SOC ensure the security of your organization while staying within budget. Don't miss this opportunity to learn how Cortex XDR can help you avoid breaches! #SecuredByPANW

Detection + Response

register.paloaltonetworks.com
Like Comment
To view or add a comment, sign in
Eric Olmstead

IT Leader and Strategist | Technical Sales Challenger | Business Development Innovator - Digital Transformation
9mo
Report this post
Join Cortex by Palo Alto Networks on Feb 15 for a 30-minute demo of #Cortex XDR and see how it can help your SOC ensure the security of your organization while staying within budget. Don't miss this opportunity to learn how Cortex XDR can help you avoid breaches! #SecuredByPANW

Detection + Response

register.paloaltonetworks.com
Like Comment
To view or add a comment, sign in
Matt Krueper
9mo
Report this post
Join Cortex by Palo Alto Networks on Feb 15 for a 30-minute demo of #Cortex XDR and see how it can help your SOC ensure the security of your organization while staying within budget. Don't miss this opportunity to learn how Cortex XDR can help you avoid breaches! #SecuredByPANW

Detection + Response

register.paloaltonetworks.com
Like Comment
To view or add a comment, sign in
Baron Lopez
9mo
Report this post
Join Cortex by Palo Alto Networks on Feb 15 for a 30-minute demo of #Cortex XDR and see how it can help your SOC ensure the security of your organization while staying within budget. Don't miss this opportunity to learn how Cortex XDR can help you avoid breaches! #SecuredByPANW

Detection + Response

register.paloaltonetworks.com
Like Comment
To view or add a comment, sign in
Diego F.

Enabling clients to securely transform their business. Views are my own.
9mo
Report this post
Join Cortex by Palo Alto Networks on Feb 15 for a 30-minute demo of #Cortex XDR and see how it can help your SOC ensure the security of your organization while staying within budget. Don't miss this opportunity to learn how Cortex XDR can help you avoid breaches! #SecuredByPANW

Detection + Response
Like Comment
To view or add a comment, sign in

402 followers

View Profile Connect

RavenMail Security’s Post

Transcript

More Relevant Posts

Explore topics