Mossad Email Spoofing Exposes Widespread Israeli Government Security Flaws
A security flaw allowed researchers to receive spoofed emails from the Mossad due to missing DMARC protections. Audits reveal half of Israeli government domains lack basic email authentication.
A serious security flaw allowed a researcher managing the vx-underground platform to receive spoofed emails from official domains associated with the Mossad, raising initial fears of a major breach. However, technical analysis revealed that no systems were actually compromised. Instead, government servers failed to enforce basic email authentication standards, specifically SPF, DKIM, and DMARC.
The Vulnerability and the Prank
The incident came to light when an email was sent from the spoofed address [email protected] offering a rare collector's item: 47 nail clippings of Prime Minister Benjamin Netanyahu for 8,000 shekels or a firstborn son. While International Cyber Digest initially suspected a hacked government account, further investigation proved it was email spoofing enabled by a total lack of DMARC and SPF verification records on the government server.
"Ahhh, that explains it. So technically anyone can currently successfully spoof the Mossad and be marked as un-spoofed. Cool," the vx-underground operators commented humorously.
Widespread Government Flaws
A security audit conducted by Cybersyber Labs researchers on a sample of 18 domains under the gov.il umbrella revealed that half of them fail to properly enforce email protections. Alongside the Mossad domain—which was promptly fixed—other major ministries, including Finance, Foreign Affairs, Health, Interior, Education, Energy, and the Tax Authority, lacked strict rejection policies for unverified messages.
The National Digital Agency stated that it is working closely with government offices to implement blocking mechanisms without disrupting critical infrastructure, noting that the fix is technically complex. Nevertheless, cybersecurity experts emphasize that government bodies have had nearly a decade to finalize these essential security configurations since guidelines were first published in 2017.
