Chapter 7 — Phishing and email security
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 The problem"]
N2["7.2 The lookalike lab"]
N3["Lab — Flagging lookalike sender domains by edit dist"]
N4["7.3 Technical controls"]
N5["7.4 Human controls"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 The problem"]
N2["7.2 The lookalike lab"]
N3["Lab — Flagging lookalike sender domains by edit dist"]
N4["7.3 Technical controls"]
N5["7.4 Human controls"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 The problem]
|
v
[7.2 The lookalike lab]
|
v
[Lab — Flagging lookalike sender domains by edit dist]
|
v
[7.3 Technical controls]
|
v
[7.4 Human controls]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) analyse phishing patterns in mail data; (2) detect lookalike sender domains; (3) combine technical and human controls against phishing.
7.1 The problem
Moorfield's clinics receive frequent phishing emails, some pretending to come from head office or suppliers asking for payment or login details. Last year, a clinic manager entered her password on a fake login page, and the account sent phishing to patients before it was locked. Elena wants to understand the patterns. Dr. Qureshi suggests starting with sender domains, because many attacks use domains that look almost identical to genuine ones, which busy staff rarely notice. She asks the email provider for a three-month log export.
7.2 The lookalike lab
The lab reads a synthetic log of 5,823 inbound messages from 68 distinct sender domains. It compares each domain with Moorfield's own domain using edit distance, the number of single-character changes needed to turn one into the other. Four domains are within two changes, such as a digit one replacing a letter l or a hyphen inserted, and 23 messages came from them. Elena notes that all four would pass a quick glance. She shows the four domains to the security committee side by side with the genuine one, and none of the members spots every difference without help.
Lab — Flagging lookalike sender domains by edit distance in a synthetic mail log
"""Flag lookalike sender domains by edit distance in a synthetic mail log (stdlib only)."""
import random
random.seed(30)
OWN = "moorfielddental.example"
def dist(a, b):
prev = list(range(len(b) + 1))
for i, ca in enumerate(a, 1):
cur = [i]
for j, cb in enumerate(b, 1):
cur.append(min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (ca != cb)))
prev = cur
return prev[-1]
fakes = ["moorfie1ddental.example", "moorfielddentai.example", "moorfield-dental.example", "moorfielddental.examp1e"]
normal = [f"supplier{i}.example" for i in range(60)] + ["labwork.example", "dentalsupply.example", "bank.example"]
log = [random.choice(normal) for _ in range(5000)] + [OWN] * 800 + [random.choice(fakes) for _ in range(23)]
flag = {d for d in set(log) if d != OWN and dist(d, OWN) <= 2}
n_flag = sum(d in flag for d in log)
print(f"messages {len(log)}; distinct sender domains {len(set(log))}")
print(f"lookalike domains (distance <= 2): {sorted(flag)}; messages from them {n_flag}")
Run with python3 lab_lookalike.py. Verified output:
messages 5823; distinct sender domains 68
lookalike domains (distance <= 2): ['moorfie1ddental.example', 'moorfield-dental.example', 'moorfielddentai.example', 'moorfielddental.examp1e']; messages from them 23
7.3 Technical controls
Elena asks the email provider to quarantine messages from domains within two edits of Moorfield's and of key suppliers' domains, and to mark all external messages with a visible banner. She publishes email authentication records for Moorfield's domain, so receiving systems can reject messages falsely claiming to come from it. She also enables multi-factor authentication for all mailboxes, so a stolen password alone no longer opens an account. After a month, the quarantine catches several new lookalike messages, and the email provider confirms that messages falsely using Moorfield's own domain are now rejected.
7.4 Human controls
Technical controls miss some attacks. Elena introduces a simple rule for payment and bank detail changes: always confirm by calling a known number, never one given in the email. She adds a report button and thanks every reporter. Short monthly examples show real lookalike domains with the differences highlighted. Dr. Qureshi notes that people and technology together give better protection than either alone. Clinic managers say the monthly examples are useful because staff discuss them in team meetings. Within three months, reports of suspicious emails double, and the central team finds two campaigns earlier than before.
Worked example
Elena analyses 5,823 synthetic messages, finds four lookalike domains sending 23 messages, quarantines near-matches, adds email authentication and MFA and sets a call-back rule.
Synthetic case. Mail data are synthetic; outputs come from lab_lookalike.py.
Errors and limits
Lookalike domains pass a quick glance, so relying on staff spotting them fails.
Exercises
- EX031 — Message count. How many messages does the log contain? Rubric: 3 = 5,823;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX032 — Lookalike count. How many lookalike domains are flagged? Rubric: 3 = four;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX033 — Lookalike messages. How many messages came from lookalike domains? Rubric: 3 = 23;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX034 — Edit distance. What does edit distance count? Rubric: 3 = single-character changes between strings;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX035 — Payment rule. What is the payment change rule? Rubric: 3 = confirm by calling a known number;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 07 (chapter 07 of 12)
← Chapter 06 · Course chapter index · Chapter 08 →
Continue to the next authored lesson.