Thwart attackers’ search for info by ditching out-of-office notifications

When it comes to successfully defending organizations from targeted attacks, IT administrators must be aware that attention to every detail – no matter how small – will pay off.

One of these details is the oft used “out-of-office notification”, a great feature that can, unfortunately, be also very helpful to attackers.

Experienced hackers know that the quality of the information collected during the first phase of attack – commonly referred to as reconnaissance – will directly influence its final outcome, and so they invest considerable time and effort in finding out everything that can be discovered about the organization and its employees.

The aforementioned notifications are just one of the many, many ways to unearth useful details, as it usually contains an explanation of why the person in question is out of the office; the name and contact details of another employee that can help with urgent requests; the date of the person’s return to work; and possibly even the person’s email signature.

This information can come in hand when mounting spear phishing campaigns, and what better time for collecting it that the upcoming holidays?

“Based on our research into spear-phishing, the e-mail addresses of about half of all spear-phishing recipients can be found online using Google,” Trend Micros researchers shared.

“In many cases, corporate e-mail addresses follow a predictable firstname_lastname@companyname.com format as well; this makes many addresses ‘known’ so long as an employee’s name is known.”

Fortunately, there are things that IT admins can do to thwart the collection of this information – they can set email server software to show one notification to people within the organizations and another to those outside of it, or make it impossible for employees to send out-of-office notifications to external domains or domains not contained in specific whitelists.

“Users may also want to consider limiting the information that they include in notifications: for example, instead of saying who to contact, the message may say instead to notify ‘my manager’ or ‘my subordinates’. (The sender would presumably know who these people are.) Users may also opt not to use the feature at all, instead sending an email manually saying they’re out of the office to likely correspondents,” the researchers suggested.