Do you have access to data that would cause a news story if you sent it to the wrong person? If yes, then yes, verify it before sending.

Also, spoofing an email address wouldn't help. If you respond, it will go to the spoofed address, which is the correct one. They need to send it from their own email address, which means that you only need to verify that it's send from your manager's address, or just manually send it to your manager.

It's likely that their SMTP server accepts messages with an SMTP "MAIL FROM" command and/or "From" header address that belongs to the company's own domain without requiring authentication. The attacker then adds a "Reply-To" header so that replies will be sent elsewhere (likely a throwaway free email account).

This shows up in email clients as "From: [email protected]". When the recipient replies, they don't notice that they're sending a reply to a different address than the one their client claimed was the sender of the original message.

Receiving SMTP servers need to be configured to require SMTP authentication for messages claiming to originate from the company's own domain.

> Receiving SMTP servers need to be hardened to require SMTP authentication for messages claiming to originate from the company's own domain.

Or validate SPF / DKIM and enable it for their own domain.

But unless you actually break into someone's account, email spoofing should be a solved problem. Sure, you can set the from field to whatever you want, but in a typical company scenario, it will look very different in outlook - it will actually display the sender's email, and if you try to spoof that, you'll just get rejected at the server.

Now if you ignore that and respond anyway... well, there's not much anyone can do about that.

We've been a target of this attack previously and it's not as simple as email spoofing as email addresses aren't (in Google Apps at least) displayed prominently, [email protected] with a corresponding name and profile picture is how we were targeted. Very easy to fall for (especially in companies that aren't strict about personal/professional email separation).

Serious question: what would it look like on a smartphone email client?

No idea. Work email doesn't go anywhere close my smartphone.

How do you reply to emails at 11pm? ;)

Don't reply to mails at 11pm might help, for a start.

I look at mail headers more often than necessary.

I would post it on slack. Figure I know who my manager is there and even if i didn't, at must it would end up somewhere in the company.

isn't this what DKIM and SPF and all those fancy email security things are for?

An attacker-controlled domain, say snaapchat.com, can pass DKIM, SPF, and DMARC if configured appropriately.

Better solution is to append a warning to any message that originates outside the domain.

This is actually a really good idea in corporate environments, and I would encourage everyone to think about doing it. It is a simple thing to push a rule to Outlook that e.g. displays emails from outside the corporate domain with a red tinted background in the email list. This helps people to think twice. It also compliments an email classification system well, although unfortunately most classification systems I've seen with good MUA integration are very expensive.

No, this is what OpenPGP signed mail is for.