725ee191354be8a85ea104735c7f9264

Software Engineer, Open Source Enthusiast, Tactical & Stealth Gamer, Sport Shooter, Motor Biker, interested in InfoSec, AppSec, Linux, Cyberpunk.

Enterprise Solutions Engineer

Mathias Conradt

Checking a user's email reputation is a great way to filter for fake signups and assign user permissions according to their reputation, especially in B2C scenarios.



I love Meetup.com. It's a great way to organize or attend events with and for like-minded people around any topic in your region. I'm using the platform both as an organizer as well as an attendee.

Recently though, the platform has seen a lot of spam, which becomes quite annoying. Fake accounts that are just created to randomly join groups and add comments to their discussion boards.

![Meetup Fake Account Sample](https://images.ctfassets.net/23aumh6u8s0i/3R5elw5aU1VvmGZ4cg3dXH/8b3310032e15bc056e24b9cb81fb2d16/emailrep_1)

There are different ways to solve this without shutting down the comment feature for all members entirely.

One way, and the way we'll be focusing on here, is to use an email reputation  check when a user authenticates or signs up. Based on the reputation score, you could allow or disallow that user to comment.

I will demonstrate what the integration of an email reputation check looks like when using [Auth0](https://auth0.com) as IDaaS (identity as a service platform) for user registration and authentication. I will call my fictitious application and backend/API "Meetdown".

## Using EmailRep.io

In the background, we will make use of a service called [EmailRep](https://emailrep.io), available at emailrep.io and also available as an [open-source project](https://github.com/sublime-security/emailrep.io).

EmailRep is a system of crawlers, scanners, and enrichment services that collects data on email addresses, domains, and internet personas.

EmailRep uses hundreds of data points from social media profiles, professional networking sites, dark web credential leaks, data breaches, phishing kits, phishing emails, spam lists, open mail relays, domain age and reputation, deliverability, and more to predict the risk of an email address.

EmailRep is currently in alpha stage and doesn't require an API key yet.

The API can be called by a simple request with the user's email address as a parameter:

```
GET https://emailrep.io/<email_address>
```

The image below shows what the results for that request look like, with the important attributes for us being `reputation` and `suspicious`.

![High Email Reputation Score Example](https://images.ctfassets.net/23aumh6u8s0i/tQa71FHFg8iQp7wEWi5PA/d80e14fdea90c0d833a2a69f7f5272ea/emailrep_2)

![Risky Email Reputation Score Example](https://images.ctfassets.net/23aumh6u8s0i/38w3kDYPvZq0bsLW55UGct/6ad4aea2805869396d31e0c622d9918b/emailrep_3)

## Using the Auth0 Dashboard

In order to check for a malicious e-mail using EmailRep.io, first create a <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">free Auth0 account</a>.

## Creating the Email Reputation Score Rule

In order to run an email reputation check when a user authenticates in Auth0, we create a [**Rule**](https://auth0.com/docs/rules) in the Auth0 dashboard.

Go to the "Dashboard > Rules > Create Rule" and create a rule named "Email Reputation Check".

![Auth0 Dashboard: Create a Rule](https://images.ctfassets.net/23aumh6u8s0i/7zUtgXJaw30GD0MhukjV18/889b24dc9b977f57020c0d27badaa05e/emailrep_9)

![Auth0 Dashboard: Rule Code](https://images.ctfassets.net/23aumh6u8s0i/A9aP9F4BTAt8EGNhtxpyx/504654a0cc1c0bd5efed5016ab955a73/emailrep_10)

Paste the following code block into the code sandbox for the "Email Reputation Check" rule. The code is also available as a [Gist on Github](https://gist.github.com/mathiasconradt/a118ffa4e0df16d63e04c72ca0199bfa):

```javascript
function (user, context, callback) {
  // skip if emailrep.io metadata is already there
  if (user.app_metadata && user.app_metadata.emailrep) {
    context.idToken['https://emailrep.io/reputation'] = user.app_metadata.emailrep.reputation;
    context.idToken['https://emailrep.io/suspicious'] = user.app_metadata.emailrep.suspicious;
    context.accessToken['https://emailrep.io/reputation'] = user.app_metadata.emailrep.reputation;
    context.accessToken['https://emailrep.io/suspicious'] = user.app_metadata.emailrep.suspicious;    
    return callback(null, user, context);
  }
  request.get('https://emailrep.io/' + user.email, {
    json: true
  }, (error, response, body) => {
    if (error || (response && response.statusCode !== 200)) {
      console.log(error);
      // swallow emailrep.io api errors and just continue login
      return callback(null, user, context);
    }
    // if we reach here, it means EmailRep returned info and we'll add it to the metadata
    user.app_metadata = user.app_metadata || {};
    user.app_metadata.emailrep = body;
    auth0.users.updateAppMetadata(user.user_id, user.app_metadata);
    context.idToken['https://emailrep.io/reputation'] = user.app_metadata.emailrep.reputation;
    context.idToken['https://emailrep.io/suspicious'] = user.app_metadata.emailrep.suspicious;
    context.accessToken['https://emailrep.io/reputation'] = user.app_metadata.emailrep.reputation;
    context.accessToken['https://emailrep.io/suspicious'] = user.app_metadata.emailrep.suspicious;
    return callback(null, user, context);
  });
}
```

This rule does the following:

* Check if the email reputation score for this user has already been checked before. If so, there should be data in his user profile under `user.app_metadata.emailrep`.
* If an email reputation check hasn't been done for this user yet, we'll call the emailrep.io API and store the result in the user profile under `user.app_metadata.emailrep`.
* Auth0 returns the `reputation` and `suspicious` value in the ID and access token for further evaluation on the client application (via ID token) and/or backend (via access token).
  
The frontend application showing the ID token claims, including the user's reputation:

![User Profile in Client Application](https://images.ctfassets.net/23aumh6u8s0i/6V0Hx74tby77ZCw0q76kVY/9fa5c481ae2147a66609ac7cd8041062/emailrep_12)

The access token now contains reputation information as well:

![Decoding a JWT on jwt.io](https://images.ctfassets.net/23aumh6u8s0i/6zWGoViEYJJ0uVAFRLURwQ/c45aa4d98bcfd125acb8699a6e9da4ab/emailrep_14)

Both our Meetdown frontend as well as backend API could now check for these reputation claims in the ID token (in the frontend) and access token (in the backend) respectively when a user tries to submit a comment. Based on the email reputation check, **spammy comments by fake profiles are now blocked**.

Thank you for following along and let me know if you have any questions in the comments below.


Checking Users Email Reputation Score During Authentication

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Spam email hardly ever makes it to your inbox, and even when it does, you can't be fooled by it, right? Think twice, as 'artisanal spam' has arrived.



Anti-spam filters have come a really long way. While junk mail still makes up 86% of the world's internet traffic—400 billion messages a day—it doesn't seem to wind up in our inboxes very often, if ever. But it's because we're accustomed to feeling so safe in our email that we're actually more vulnerable than ever to modern phishing and spoofing techniques.

But there's a new generation of scammers out there. In an attempt to get past all your filters and protocols, they're going artisanal.

These criminals are crafting higher quality spam messages and picking smaller groups of people to target. They're not pretending to be Nigerian princes: they're pretending to be from Apple, or from Google, or from the company where you work. And it's working—every year, these “artisanal spammers” steal billions of dollars from small-to-medium size businesses.

<include src="TweetQuote" quoteText="Cyber criminals are crafting higher quality spam messages and picking smaller groups of people to target"/>

Maybe you think you'd never fall for it. But it's not about you: it's about everyone at your company. All it takes is one clever scammer and one unsuspecting person's momentary lapse for your company to potentially lose millions. To understand why artisanal spam is so dangerous and so effective, we first have to return to one of the most memorable internet scams of all time.

## Why The “Nigerian Prince” Scam Was So Genius

We all remember the Nigerian prince email scam. It usually went something like this: “Dear beloved friend... due to a [tragic financial collapse/death in the royal family]... I must [come to America/hide my fortune]... Please reply if you can help.” For many of us, it was our first ridiculous introduction to phishing: when someone masquerades as a trustworthy source to try and get to your sensitive personal information.

Microsoft researcher Cormac Herley, who wrote [the seminal paper](http://research.microsoft.com/pubs/167719/WhyFromNigeria.pdf) on this scam, argued that this scam *relied *on being seen as inept, even comical. After all, only those gullible enough to respond to a “far-fetched tale of West African riches” would be gullible enough to then give up their sensitive personal information when asked for it.

Con-men as far back as the 15th century have this trick, a modified version of the [Spanish Prisoner scam](https://en.wikipedia.org/wiki/Spanish_Prisoner). But there's a key difference: the “Nigerian scammers” never focused their efforts on convincing one person to become a victim. Instead, they sent millions of *intentionally unconvincing* emails in order to self-select for the best possible victim.    

It was an ingenious way to leverage the power of the early Internet. But these kinds of scams have lost almost all their effectiveness, and there are two basic reasons why:

1. Legislation like CAN-SPAM set out tough penalties for spammers and mandated easy to spot opt-out buttons, while advanced anti-spam algorithms keep 99% of junk mail out of our inboxes anyway.
2. People are so accustomed to these stories—Nigerian princes, shady prescription drugs and fake “New Message” notifications—that even if they **do** get into your inbox, they're not convincing.

These two factors are essential to understanding why “artisanal” spam poses such a threat.

![Nigerian Prince jokegit](https://images.ctfassets.net/23aumh6u8s0i/3aIlC0ljlJ3vLG6W4JvcT8/7d4fca50559e3fdf3e85a12399753e0d/nigerian-prince)

## Spam Always Finds A Way

Last October, a group of hackers sent out an phishing email to French iTunes users. The operation was a massive success by modern standards: almost all of the emails reached people's inboxes and the spammers were able to run the operation for eight full hours before they were stopped.

A similar attack around the same time specifically targeted Italian PayPal users. Those also came from a small data-hosting company, a French one that had never been on any worldwide blacklist, and they were similarly effective.

There are a variety of reasons why these artisanal attacks are so effective. Let's go through them one by one.

### They narrow their scope

The hackers that went after France's iTunes users didn't try to send messages to *all *of France's iTunes users, which would be millions of people. Nor did they send messages just to a few high-profile members—a technique known as spear phishing—whose account information would be inordinately valuable.

They sent it to [5,000 people](http://www.bloomberg.com/news/articles/2016-01-19/e-mail-spam-goes-artisanal). And it worked—the vast majority of these messages were delivered.

The Italian PayPal scammers targeted even less, picking just 169 people. Conventional spam filters tag floods of identical or near-identical messages as spam, so the fewer recipients a spammer chooses, the higher the likelihood their attack will succeed.

### They send through obscure hosts

The big email hosts that are used to dealing with spammers have all implemented authentication protocols like:

* [DKIM](http://www.dkim.org/), which lets organizations take responsibility for the emails they send.
* [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework), which validates emails by cross-referencing the originating domain with a universal whitelist.
* And [DMARC](https://dmarc.org/), which gives users of DKIM and SPF the power to talk to other companies about what mail is/is not getting through and make recommendations.

These let them intercept spam before it's ever sent. But artisanal spam flew under the radar of all these protocols because the hosting companies they used were small and inexperienced.

Not only do these protocols require investments of time to set up and maintain, they can sometimes block totally legitimate mail from going through. That means dedicated spammers can usually find a host that will send their messages without flagging them.

### They spoofed with picture-perfect accuracy

The emails that the French iTunes spammers sent had spoofed headers, so they appeared to come directly from Apple. In the body of the email, there was a link to a login page that looked eerily like the one on Apple's legitimate website:

![Fake French Apple Site](https://images.ctfassets.net/23aumh6u8s0i/26vYls6jNAZ9cLsbJ8efjQ/a73abc4e698a705f8922f6f299f0c861/fake-apple-fr-site)

If you're thinking “Well, that's stupid, I'd never fall for that,” give it a bit more thought.

For instance, I bet you think that the average Twitter engineer is a pretty smart person. Yet when Twitter sends its new employees phishing emails with spoofed headers to test their security acumen, do they mark it as spam or report it to IT? No. They [fall for it all the time](http://www.huffingtonpost.com/2015/02/12/company-hacks_n_6670604.html).

Spammers have figured out that crafting high-quality spam and sending it to a small segment of users is their best bet for phishing login information and gaining access to people's accounts. And protocols like DMARC are useful, but they lose effectiveness if even a single company doesn't apply them. A false sense of security pervades the way we think about email, and no protocol can fix that.

### We trust our inboxes too much

Opening your spam folder kind of feels like going back in time. It's hard to believe that anyone ever fell for these tricks: it's even harder to believe they do today. But this is the wrong attitude to have about spam.

![Inbox with Spam](https://images.ctfassets.net/23aumh6u8s0i/7kvagxqb9G9lQptyuVnvuQ/a051e4678c107eb2fdfb94c8eb176df3/spam-in-your-inbox)

Because most of us have very good anti-spam filters, we've grown extremely accustomed to having clean inboxes:

![Spam detection warnings](https://images.ctfassets.net/23aumh6u8s0i/1e6PE5J7EmyI9vTZK9jzJk/d2671f710fdd91854f58eef77be6cdb2/types-of-spam-warnings)

An overflow of calendar invites and email newsletters, maybe, but scams and viruses? No chance.

That means that when our safeguards fail—when spammers are able to use small batches and little-known hosts to bypass anti-spam filters—we put ourselves and the companies we work for at incredible risk.

## Scammers Infiltrate Organizations From Above

According to the FBI, well over $1.5 billion have been stolen from companies in email spoofing scams just over the last few years. Because the scams are so often aimed at executive leadership, they've become known collectively as “[CEO fraud](http://krebsonsecurity.com/2015/08/fbi-1-2b-lost-to-business-email-scams/).” But they don't usually target the C-suite directly—they infiltrate through trusted employees.

[In one case](https://www.fbi.gov/news/stories/2015/august/business-e-mail-compromise/business-e-mail-compromise), an accountant received an email from the CEO of her company. It requested funds to be transfered for a time-sensitive acqusition—$737,000 by the end of the day. She approved it.

The next day, the CEO called her about an unrelated matter. During the conversation, she happened to mention the wire transfer from the day before, at which point the CEO exclaimed that he knew nothing about this purported transfer of funds. It turns out the CEO's email password had been stolen, and his account had been used by a scammer to send the transfer request to the accountant.

And this theft probably hadn't happened anytime recently. Artisanal spammers don't just find your username and password and flagrantly send out a bunch of requests for money.

They sit on it. They comb through all of your correspondence and learn how you write and how you think, the vocabulary you use to talk to your colleagues. They ingest as much information as they can, and when they feel ready to strike, they do. And attacks like this are very common:

* Ubiquiti Networks, a networking firm in San Jose, [lost $46.7 million](http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheist/) when a scammer was able to successfully impersonate both an employee and a outside financial entity.
* Scoular Co., an employee-owned commodities trader in Omaha, [lost $17.2 million](http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheist/) when an accountant wired the money in installments to China—because he received an email “from his boss” asking him to.  

### Inadequate authentication turns you into prey

The scammers that commit this kind of fraud rely on businesses having inadequate authentication in place.

If those email accounts had been protected by something more than a password, then virtually none of these scams would have succeeded. Those businesses wouldn't have had to get into complex legal negotiations with the Chinese banks where their money was funnelled, and their reputations for security would have been spared.

If you want to get access to something (your email, your Seamless account, your company intranet) and you're only asked for digital credentials, you're susceptible to an attack.

## Knowledge, Possession, Inherence: How To Authenticate

There are three basic types of authentication. You can be identified based on knowledge (what you know), inherence (what you are), and possession (what you have).

**1— The Knowledge Factor **
The password is the classic knowledge factor. It's as old as “open sesame” and Ali Baba and the Forty Thieves. But “secret questions” are also knowledge factors, and not particularly good ones.

If your Gmail account asks “What's your mother's maiden name?” to authenticate your identity, and you're a public figure or head of a company, it's not going to take long for a semi-dedicated scammer to figure that out through public records.

**2—The Inherence Factor **
Access to Mjolnir, Thor's mythical hammer, is controlled by an inherence factor. Thor himself can wield Mjolnir with ease: he can throw it into the air, summon it to return, use it to manipulate the weather. But no one else can lift it, not even Doctor Doom, because it's tied into Thor's unique identity.

That's great security policy. The same principle is at play in modes of biometric or GPS authentication: only your retina, fingerprint, or precise geographical location will grant access.

**3—The Possession Factor**
The last factor, possession, is the easiest and quickest (after knowledge) to implement. It relies on you physically having something—a smartphone, memory card, or badge—that wouldn't fall into a scammer's hands through digital means.

If you're currently only using a single factor to authenticate, we recommend—at minimum—implementing two-factor authentication.

It can be annoying at first having every log in and sensitive transaction verified twice, but this alone will virtually eliminate the possibility of a phishing or spoofing scam affecting your company.

## The Practical Way To Protect Yourself And Your Company of Artisanal Spam

DMARC, DKIM, and SPF are great. The spam filters that Google has developed to protect Gmail are great. But they're not perfect—spam filters fail, and protocols are vulnerable as long as they're not universally adopted. Getting every company in the world on the same page is a Sisyphean task, so let's get practical.

Implementing multi-factor authentication on your business email (some combo of knowledge, inherence and possession) is really the only way to be safe.

And setting up multi-factor authentication [is easy with Auth0](https://auth0.com/docs/multifactor-authentication). Whether you want to enable it by default, trigger it only under abnormal or specific conditions, or involve custom hardware, you're covered.

Support for Google Authenticator and Duo Security are built in, so enabling MFA via those is as simple as flipping a switch:

![Enabling Multifactor in Auth0](https://images.ctfassets.net/23aumh6u8s0i/4jsOBDYT6ZNS5lj3iZnk7E/f2d324f4612a9cb999b47e8b995fabb5/multifactor-auth)

Implementing MFA exclusively in special situations—first login from an unfamiliar device, for instance—is only slightly more complex. For the full how-to, [check our documentation](https://auth0.com/docs/multifactor-authentication).  

However you choose to do it, you have several options as far as what your second factor (after your password) will be. Some popular ones:

* **Time-based One-Time Password, or TOTP: **this generates a single-use password using the current time along with a secret, shared key. These only work for 30-60 seconds.
* **SMS verification**: when a user tries to login, an SMS is sent to their mobile phone. If they don't have it, they don't get in.
* **Hardware**: companies like [Yubikey](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwiVo_zD8ZPLAhXEFh4KHbtRAp0QFggdMAA&url=https%3A%2F%2Fwww.yubico.com%2Fproducts%2Fyubikey-hardware%2F&usg=AFQjCNHrslXsaYuos9kMmWoMpF84eruZGQ&sig2=ZWP9wx_ww1GHCBZoh0kx7A) make USB dongles or other accessories that maintain special password-generating keys.  

## Conclusion

You can't completely protect your company from attacks by artisanal spammers, but you can go “upstream” and institute a higher level of protection where you really need it the most—on your identity. Multi-factor authentication is the best way to do that. Implemented correctly, it can make the chances of an attack like that succeeding virtually zero.


"spam"