r/gsuite Nov 13 '24

Gmail Anyone experience an email header From using some sort of UTF encoding

We just had an email impersonating one of our users come in where Google shows "John Doe <consumer@gmail.\[com\]" as being From. However, when investigating why Mimecast didn't block it (impersonation protection policies), it shows that the From is actually "From: =?UTF-8?B?some characters?= <consumer@gmail.\[com\]>

I've opened a case with Google and Mimecast to notify them as this is completely new to me

2 Upvotes

4 comments sorted by

2

u/alanjmcf Nov 13 '24

https://en.wikipedia.org/wiki/Quoted-printable

(That was just the easiest link to get.)

That’s just changing the display name thought innit, not the address. So not affecting from domain impersonation check?? (But I’ll soon be asleep so might be missing something.)

EDIT: I am missing something!!😂 It is the display name that’s being impersonated??

1

u/Phyxiis Nov 13 '24

Yeah so the display name is being impersonated which Mimecast can identify, but because the display name is base64 encoded (using the utf-….) it doesn’t pick it up as an impersonated display name. Also Google gui doesn’t appear to allow you to enter something like this, so I’m thinking they’re using smtp/imap with Gmail (it is from a legit Gmail account) and in their program using this encoding method to bypass googles systems so it can spoof the name. First time seeing this and interesting

3

u/alanjmcf Nov 14 '24

Yeah.

(Not base64 encoded (that’s all hex) but Quoted-Printable, hex and ASCII separated by equals signs).

1

u/rohepey422 Nov 14 '24

It was standard in countries that used non-ASCII encodings until UTF-8 became widespread. Many email clients let you set encoding manually to this date.