News for hackers. Stuff that matters.

A comment on Scammed out of $130K via fake Google call, spoofed Google email and auth sync. Parent comment

Re:Scammed out of $130K via fake Google call, spoofed Google... by traceroute66 on Tuesday September 16, 2025 @01:46PM (#45265419)
> Wouldn't the Apple account reject it because it fails DKIM/etc?

Yeah, I would be curious to see the actual email headers of what was received.

As an aside, fun fact, this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer.

[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by Avamander on Tuesday September 16, 2025 @02:48PM (#45266229)
How would recipients know to expect an S/MIME signature though. It's not like it's enforced by MTAs like DMARC is.
[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by traceroute66 on Tuesday September 16, 2025 @03:38PM (#45266921)
IIRC, if you're using Apple's Mail client it gets validated against the root cert shipped with MacOS/iOS. You get a little black tick next to the sender.

In theory, third-party places like gmail could (should ?) automagically verify S/MIME sigs where a root cert is readily available.

[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by Avamander on Tuesday September 16, 2025 @04:01PM (#45267225)
Support for verification is indeed widespread, but if it's missing there's nothing to verify.

There's no system in place to warn the user when there is no signature and that there should be one.

[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by valleyer on Tuesday September 16, 2025 @11:18PM (#45271232)
> this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer

A few do, but most do not, and certainly Apple's automated-system e-mails do not.

[ Parent | on HN ]