Scam emails using images?

[Dustin Anderson]

I've started seeing some scam emails coming in, but they are just from a random gmail account with an image of a fake bill with a scam 800 number to call. same junk we have all seen, but does anyone know a way to block them? I can't block gmail as we have customers and I don't think the ESAs can OCR scan an image to trigger. They change the filename, so file hash isn't useable.

[Ken Stieers · Accepted solution]

You're correct, the ESA can't OCR the picture.
I think our option is going to be sending mail to ETD and getting a verdict from those cloud based engines. That option is coming in the 15.x code sometime, but I haven't seen a definitive roadmap as to when that might be available.

[Dustin Anderson]

The never ending cat and mouse of email. They are tagging the email body with a # code, so seeing if a filter of from @gmail.com and body contains #[a-z]  send to a quarantine. Testing with just a copy to see what it gets wrong.

[PeterEriksson8954]

Seeing the same happening here today, i.e. multiple gmail.com senders with similar subject lines (made to be tracked by the senders) and similar attachments (all jpgs so far), but with different names... and they all came in with sizes above the max scan limits set for certain filters... so I've upped that here to see if anything gets caught. Worth a try at least

[Dustin Anderson]

yeah, I saw the images are 3MB, but we manually scanned and nothing triggered as it's not technically malicious.

I'm testing a filter of from @gmail.com and body contains ^#[a-z]

we'll see if I get more tonight.

[PeterEriksson8954]

Thanks Dustin... and yeah, you're correct, it's basically a "Geek Squad invoice" with a number to call... so if OCR can't catch that, not much will I suspect... except a filter nailing the details you are trying with without causing too many false positives

Looking forward to hearing about the results...

[Dustin Anderson]

I had to change the filter to ^#[a-z] as it was triggering on HTML format emails for color codes. the ^ means beginning of line and I've had no false positives, but none of those emails yet. and it only works if they keep adding the # code into the body.

[PeterEriksson8954]

I've seen three similar emails so far today and they all got caught by the filter... "... scanned by Anti-Spam engine: CASE. Final verdict: Positive"... so maybe upping the max scan limit for Outbreak and Ironport Anti-Spam did it... or Cisco had the included jpg hash flagged already? Either case, it's good!

[Ken Stieers]

And that enough people reported it... so the CASE engine got updated.
So now everyone is protected...

[PeterEriksson8954]

I'm OK with that!
Would be nice though to get that 1 MB size limit upped for the reporting add-in... to make it easier for non-IT users to report larger emails... along with a way to centrally enable some form of feedback from the Talos portal to those users without them having to register with Cisco (can't see people on the shopfloor do that for example... or even office workers) so they feel that something happens with what's being reported.

[Dustin Anderson]

We'll have to see, I got 2 today. One was 1Mb and 1 was 822K, so under the scan limit and got through.

[PeterEriksson8954]

Saw one yesterday slip through, this time with a different subject line (but including # followed by tracking number) and attached picture was of a "Paypal invoice" instead of the earlier "Geek Squad invoice". Just over 1 MB in size and it was reported to Talos by the end user here. There was a second email from same sender and with same subject line only ONE second after the first email, it was dropped by Anti-Spam.

[Dustin Anderson]

I've had 15 so far today, I set up a quarantine and a rule of from gmail, jpeg attachment and # in the body. Got some false positives, so I do have to watch queues, but I've had 3 false in a day and we have around 140K/day emails incoming.

[Mike Sanders]

has anyone found a solution to block these in an effective way with no false positives please? Thank you.