Feeds

Google, Facebook, Microsoft in PHISH-FIGHTING smackdown

DMARC Brothers back cross-industry standard

The essential guide to IT transformation

Google, Facebook and other internet heavyweights are collaborating together to back a standard designed to curtail phishing by improving the collaboration between legitimate senders and receivers of emails.

Microsoft, Yahoo and PayPal are teaming up to push DMARC (Domain-based Message Authentication, Reporting & Conformance), an email authentication specification designed to make it easier to filter and block spoofed messages that attempt to trick users into handing over personal data or passwords to scam sites.

Email senders often use standards such as SPF (Sender Policy Framework) and DKIM (Domain Keys Identified Mail) for authenticating their messages but email receivers have tended not to rely on the technology because legitimate but unauthenticated messages might be sent from a given domain – ie: they are not necessarily spoofed as adoption of standards by senders is so patchy.

DMARC seeks to codify how email authentication can be introduced into a provider's infrastructure. Once DMARC is introduced, a sender could set policies to easily request providers to discard unauthenticated email, getting rid of spoofed-domain phishing emails in the process. The specification also creates a mechanism for email providers to send detailed reports back to email senders, creating a feedback loop that would help catch gaps in authentication systems.

Authentication needs support of both receiver and sender

George Bilbrey, co-founder of email certification firm Return Path, said both the organisation sending the emails and the entity that receives them need to support DMARC. However this is not as much a problem as it might seem. Fifteen per cent of emails received by Gmail, for example, already meet DMARC, a standard that has quietly been rolled out by many firms over the 18 months prior to its public launch on Monday.

Bilbrey said DMARC has a good chance of succeeding where other email authentication approaches have come up short because "it already has an installed base and builds on existing standards and technologies".

"It's not going to eliminate phishing but is still a big step forward, specifically in preventing spoofed email from domains that support DMARC from getting through," he told El Reg.

Return Path is one of 15 early backers of DMARC, a cross-industry standard that its backers hope to eventually hope to release as a draft IETF process.

In the past, spammers have often been early adopters of authentication technology. For example, in the early days of SPF, most of the domains that contained valid SPF records were spammer domains.

However Paul Wood, an anti-spam expert at Symantec.cloud (formerly MessageLabs), said it would be wrong to dismiss the potential of the new standard simply because previous approaches had misfired. He said: "[DMARC] is important because it enables the owner of an email domain to publish a policy that for the first time defines how *they* want emails from their domain to be handled, rather than leaving it up to the receiving servers to make that judgement. It also means that they can request the receiving servers to feedback via a monitoring channel (an email address or URI) to collect the messages that don't meet the policy criteria.

"The idea being that they can then see for the first time a much clearer picture of who is spoofing their domains and on what scale. This feedback loop is really there to help them tighten up their policy and define what to do with non-conforming messages – such as drop them, or report them. They can also define what percentage of their email should be blocked, so initially they may elect this to be a low number, increasing it gradually to 100 per cent over time," he added.

Cost and privacy issues

Wood added a note of caution over the technology, saying that outstanding cost and privacy issues needed to be addressed: "I believe there may be some concerns over the privacy side, particularly when it relates to failed messages being set to an external email address that wasn't the recipient.

"I'm not sure what the best current practice says about this, but I expect as we see more implementation guidelines appearing over the coming months, these sorts of issues can be addressed. There may be costs associated with the setup, but mostly from a configuration and testing perspective. This is likely to put more pressure on ISPs and mail providers to support these technologies in order to safeguard their clients. We certainly welcome this initiative as it is likely to be very effective at stopping spoofing and phishing attacks," he added.

The security expert added that DMARC could easily co-exist alongside other more established groups in this area, such as the Anti-Phishing Working Group.

"This new body is different to APWG and others, as it forms the policy decision on what the senders want receivers to do should their messages fail DKIM/SPF. With the weight of some big early adopters it could really help obvious spoofing attempts, and should be seen as complementary to the APWG and other technology such as SPF and DKIM," he concluded. ®

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.