Government Email Defenses Compromised, Exposing Sensitive Agencies
Translated & summarized from Ice by baba
A severe security vulnerability has been discovered in Israeli government ministries, allowing for the spoofing of official emails due to a failure to implement basic authentication defenses like DMARC. The issue was highlighted when the Mossad's email was impersonated in a mock sale of Prime Minister Benjamin Netanyahu's nail clippings. A survey revealed that half of the tested government domains lack proper email authentication, a problem security researchers state ministries have had nine years to fix. The National Digital Directorate is working to rectify the issue, acknowledging its complexity.
The story in 5 lines · by baba
- Israeli government ministries are failing to implement basic email security defenses, allowing for spoofing of official communications.
- The Mossad's email was impersonated in a mock sale of Prime Minister Benjamin Netanyahu's nail clippings due to these security lapses.
- A survey found that half of tested government domains under Gov.il lack crucial SPF or DMARC authentication records.
- Government bodies have had nine years to implement these essential cybersecurity measures, according to researchers.
- The National Digital Directorate is addressing the issue, citing technical complexity and potential disruption to existing systems.
A significant security lapse has been uncovered in Israeli government ministries, where basic email authentication defenses were found to be improperly implemented, allowing for the spoofing of official email addresses. The issue came to light when a security researcher managing the vx-underground research site received emails purportedly from the Mossad, Israel's intelligence agency. Initially, there were concerns of a server breach, but it was revealed that the emails were sent because state networks failed to enforce fundamental email protections designed to block forged messages.
In 2017, the National Cyber Directorate, now the National Cyber Directorate, issued clear guidelines for government bodies to implement three key authentication mechanisms: SPF, which designates authorized sending servers; DKIM, which adds a digital signature to verify message integrity; and DMARC, which monitors SPF and DKIM and instructs recipient mail servers on how to handle unauthenticated messages. Without enforced DMARC policies, spoofed emails can reach recipients' inboxes.
While this incident specifically affected the Mossad and the Prime Minister's Office, the lapse is widespread across many government ministries. A screenshot circulating online showed a mock email sent from a seemingly official Mossad address (collectibles@mossad.gov.il) to the vx-underground administrator, offering a "rare collector's item", 47 nail clippings of Benjamin Netanyahu with a "Mossad-forged" authenticity certificate, for 8,000 shekels or the recipient's firstborn son.
International Cyber Digest initially reported the incident as a breach but later technical analysis revealed the absence of SPF or DMARC records on the government server. This lack of basic defenses allowed an attacker to easily forge the sender's address without needing to breach the Mossad's servers. The administrators of vx-underground humorously noted that this means anyone can currently spoof the Mossad and be marked as "not spoofed."
A recent survey by CyberCyber Labs of 18 domains under Gov.il found that half are not properly managed. Beyond the Mossad's domain, which has since been corrected, the main Gov.il domain and those of the Finance, Foreign Affairs, Health, Interior, Education, Energy, and Tax Authority ministries also fail to reject unauthenticated messages. The National Digital Directorate, under the Prime Minister's Office, stated it is working with ministries to implement these blocks without disrupting critical infrastructure, acknowledging the complexity and potential impact on existing systems. However, security researchers emphasize that government bodies have had nine years to implement these necessary adjustments.
This vulnerability comes as a new phishing campaign is circulating in Israel, impersonating the Tax Authority and falsely claiming recipients are under investigation for tax offenses, threatening legal action if they do not comply within 72 hours.
Mentioned
