The Anti-virus Times

Monday, February 13, 2017

News outlets are full of reports about information privacy and big scandals caused by data leaks. This topic becomes particularly popular in the run up to elections. But politics aside, let's take a look at our own emails.

Let's say we've sent a message to a Gmail address. Wouldn’t you agree that that’s a normal thing to do? Let's take a look at the diagram.

In our news posts, we often mention that many malicious programs communicate with command and control servers. That's why any unsanctioned connection made between an accountant's computer and a node on the Internet that doesn't host a website is not a very good sign. It is quite possible that the connection was established by malware. To rule out incidents of this kind, experienced system administrators only allow inbound and outbound traffic over certain protocols in their corporate networks and can even restrict the number of sites that employees are allowed to visit.

But attackers know a way around this: to achieve their goals, they can use services whose traffic is allowed into a corporate network. Email is one such service. To commence an attack, intruders can register a mailbox on a popular mail server that provides protection from the keen eye of intelligence services (a highly demanded feature nowadays). As a result, an email sent by malware over a protected protocol will pass all security checks because the protocol safeguards data from anti-viruses and intelligence services with equal effectiveness. An administrator is most likely to disregard it too—after all office employees correspond via email a great deal. #corporate_security #email #SpIDer_Mail