Feeds

Google, Facebook, Microsoft in PHISH-FIGHTING smackdown

DMARC Brothers back cross-industry standard

5 things you didn’t know about cloud backup

Google, Facebook and other internet heavyweights are collaborating together to back a standard designed to curtail phishing by improving the collaboration between legitimate senders and receivers of emails.

Microsoft, Yahoo and PayPal are teaming up to push DMARC (Domain-based Message Authentication, Reporting & Conformance), an email authentication specification designed to make it easier to filter and block spoofed messages that attempt to trick users into handing over personal data or passwords to scam sites.

Email senders often use standards such as SPF (Sender Policy Framework) and DKIM (Domain Keys Identified Mail) for authenticating their messages but email receivers have tended not to rely on the technology because legitimate but unauthenticated messages might be sent from a given domain – ie: they are not necessarily spoofed as adoption of standards by senders is so patchy.

DMARC seeks to codify how email authentication can be introduced into a provider's infrastructure. Once DMARC is introduced, a sender could set policies to easily request providers to discard unauthenticated email, getting rid of spoofed-domain phishing emails in the process. The specification also creates a mechanism for email providers to send detailed reports back to email senders, creating a feedback loop that would help catch gaps in authentication systems.

Authentication needs support of both receiver and sender

George Bilbrey, co-founder of email certification firm Return Path, said both the organisation sending the emails and the entity that receives them need to support DMARC. However this is not as much a problem as it might seem. Fifteen per cent of emails received by Gmail, for example, already meet DMARC, a standard that has quietly been rolled out by many firms over the 18 months prior to its public launch on Monday.

Bilbrey said DMARC has a good chance of succeeding where other email authentication approaches have come up short because "it already has an installed base and builds on existing standards and technologies".

"It's not going to eliminate phishing but is still a big step forward, specifically in preventing spoofed email from domains that support DMARC from getting through," he told El Reg.

Return Path is one of 15 early backers of DMARC, a cross-industry standard that its backers hope to eventually hope to release as a draft IETF process.

In the past, spammers have often been early adopters of authentication technology. For example, in the early days of SPF, most of the domains that contained valid SPF records were spammer domains.

However Paul Wood, an anti-spam expert at Symantec.cloud (formerly MessageLabs), said it would be wrong to dismiss the potential of the new standard simply because previous approaches had misfired. He said: "[DMARC] is important because it enables the owner of an email domain to publish a policy that for the first time defines how *they* want emails from their domain to be handled, rather than leaving it up to the receiving servers to make that judgement. It also means that they can request the receiving servers to feedback via a monitoring channel (an email address or URI) to collect the messages that don't meet the policy criteria.

"The idea being that they can then see for the first time a much clearer picture of who is spoofing their domains and on what scale. This feedback loop is really there to help them tighten up their policy and define what to do with non-conforming messages – such as drop them, or report them. They can also define what percentage of their email should be blocked, so initially they may elect this to be a low number, increasing it gradually to 100 per cent over time," he added.

Cost and privacy issues

Wood added a note of caution over the technology, saying that outstanding cost and privacy issues needed to be addressed: "I believe there may be some concerns over the privacy side, particularly when it relates to failed messages being set to an external email address that wasn't the recipient.

"I'm not sure what the best current practice says about this, but I expect as we see more implementation guidelines appearing over the coming months, these sorts of issues can be addressed. There may be costs associated with the setup, but mostly from a configuration and testing perspective. This is likely to put more pressure on ISPs and mail providers to support these technologies in order to safeguard their clients. We certainly welcome this initiative as it is likely to be very effective at stopping spoofing and phishing attacks," he added.

The security expert added that DMARC could easily co-exist alongside other more established groups in this area, such as the Anti-Phishing Working Group.

"This new body is different to APWG and others, as it forms the policy decision on what the senders want receivers to do should their messages fail DKIM/SPF. With the weight of some big early adopters it could really help obvious spoofing attempts, and should be seen as complementary to the APWG and other technology such as SPF and DKIM," he concluded. ®

The essential guide to IT transformation

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?