Feeds

Google, Facebook, Microsoft in PHISH-FIGHTING smackdown

DMARC Brothers back cross-industry standard

Next gen security for virtualised datacentres

Google, Facebook and other internet heavyweights are collaborating together to back a standard designed to curtail phishing by improving the collaboration between legitimate senders and receivers of emails.

Microsoft, Yahoo and PayPal are teaming up to push DMARC (Domain-based Message Authentication, Reporting & Conformance), an email authentication specification designed to make it easier to filter and block spoofed messages that attempt to trick users into handing over personal data or passwords to scam sites.

Email senders often use standards such as SPF (Sender Policy Framework) and DKIM (Domain Keys Identified Mail) for authenticating their messages but email receivers have tended not to rely on the technology because legitimate but unauthenticated messages might be sent from a given domain – ie: they are not necessarily spoofed as adoption of standards by senders is so patchy.

DMARC seeks to codify how email authentication can be introduced into a provider's infrastructure. Once DMARC is introduced, a sender could set policies to easily request providers to discard unauthenticated email, getting rid of spoofed-domain phishing emails in the process. The specification also creates a mechanism for email providers to send detailed reports back to email senders, creating a feedback loop that would help catch gaps in authentication systems.

Authentication needs support of both receiver and sender

George Bilbrey, co-founder of email certification firm Return Path, said both the organisation sending the emails and the entity that receives them need to support DMARC. However this is not as much a problem as it might seem. Fifteen per cent of emails received by Gmail, for example, already meet DMARC, a standard that has quietly been rolled out by many firms over the 18 months prior to its public launch on Monday.

Bilbrey said DMARC has a good chance of succeeding where other email authentication approaches have come up short because "it already has an installed base and builds on existing standards and technologies".

"It's not going to eliminate phishing but is still a big step forward, specifically in preventing spoofed email from domains that support DMARC from getting through," he told El Reg.

Return Path is one of 15 early backers of DMARC, a cross-industry standard that its backers hope to eventually hope to release as a draft IETF process.

In the past, spammers have often been early adopters of authentication technology. For example, in the early days of SPF, most of the domains that contained valid SPF records were spammer domains.

However Paul Wood, an anti-spam expert at Symantec.cloud (formerly MessageLabs), said it would be wrong to dismiss the potential of the new standard simply because previous approaches had misfired. He said: "[DMARC] is important because it enables the owner of an email domain to publish a policy that for the first time defines how *they* want emails from their domain to be handled, rather than leaving it up to the receiving servers to make that judgement. It also means that they can request the receiving servers to feedback via a monitoring channel (an email address or URI) to collect the messages that don't meet the policy criteria.

"The idea being that they can then see for the first time a much clearer picture of who is spoofing their domains and on what scale. This feedback loop is really there to help them tighten up their policy and define what to do with non-conforming messages – such as drop them, or report them. They can also define what percentage of their email should be blocked, so initially they may elect this to be a low number, increasing it gradually to 100 per cent over time," he added.

Cost and privacy issues

Wood added a note of caution over the technology, saying that outstanding cost and privacy issues needed to be addressed: "I believe there may be some concerns over the privacy side, particularly when it relates to failed messages being set to an external email address that wasn't the recipient.

"I'm not sure what the best current practice says about this, but I expect as we see more implementation guidelines appearing over the coming months, these sorts of issues can be addressed. There may be costs associated with the setup, but mostly from a configuration and testing perspective. This is likely to put more pressure on ISPs and mail providers to support these technologies in order to safeguard their clients. We certainly welcome this initiative as it is likely to be very effective at stopping spoofing and phishing attacks," he added.

The security expert added that DMARC could easily co-exist alongside other more established groups in this area, such as the Anti-Phishing Working Group.

"This new body is different to APWG and others, as it forms the policy decision on what the senders want receivers to do should their messages fail DKIM/SPF. With the weight of some big early adopters it could really help obvious spoofing attempts, and should be seen as complementary to the APWG and other technology such as SPF and DKIM," he concluded. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New twist as rogue antivirus enters death throes
That's not the website you're looking for
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.