How will DMARC stop phishing?

sspade

It's not often that Facebook, Microsoft, Yahoo, Google, et. al team up to do anything together, but apparently they are going to turn their collective attention to stopping phishing. I just looked at my spam folder, and there were dozen of phishing attempts in there, which is a testament to Gmail's spam filter. Domain-based Message Authentication, Reporting and Conformance, or DMARC is intended to stop phishing to point that attempts never even reach the spam folder, which would be a very good thing. Let's face it, while most of the folks here wouldn't fall for it, there are people every day that open up that message that looks like it is from Paypal or whoever, and gladly send off their account information to criminals. How is DMARC going to stop this, and will the "phishermen" find a way around it anyway?

Topic: Security
Answer this Question

Answers

2 total
jimlynch
Vote Up (20)

I think the jury will be out on this for a while. Hopefully it will help, but spammers are quite clever and might find some way around it. Also, let's face it. Some people are just stupid or careless, so I suspect we'll have till have problems even with this new system. You can't really get rid of this altogether given that a lot of it depends on human judgement and some people have very poor judgement indeed.

Here's more info about DMARC:

http://dmarc.org/

"DMARC - What is it?

DMARC, which stands for "Domain-based Message Authentication, Reporting & Conformance", is a technical specification created by a group of organizations that want to help reduce the potential for email-based abuse by solving a couple of long-standing operational, deployment, and reporting issues related to email authentication protocols.

DMARC standardizes how email receivers perform email authentication using the well-known SPF and DKIM mechanisms. This means that senders will experience consistent authentication results for their messages at AOL, Gmail, Hotmail, Yahoo! and any other email receiver implementing DMARC. We hope this will encourage senders to more broadly authenticate their outbound email which can make email a more reliable way to communicate.

Why is DMARC Important?

With the rise of the social internet and the ubiquity of e-commerce, spammers and phishers have a tremendous financial incentive to compromise user accounts, enabling theft of passwords, bank accounts, credit cards, and more. Email is easy to spoof and criminals have found spoofing to be a proven way to exploit user trust of well-known brands. Simply inserting the logo of a well known brand into an email gives it instant legitimacy with many users.

Users can't tell a real message from a fake one, and large mailbox providers have to make very difficult (and frequently incorrect) choices about which messages to deliver and which ones might harm users. Senders remain largely unaware of problems with their authentication practices because there's no scalable way for them to indicate they want feedback and where it should be sent. Those attempting new SPF and DKIM deployment proceed very slowly and cautiously because the lack of feedback also means they have no good way to monitor progress and debug problems.

DMARC addresses these issues, helping email senders and receivers work together to better secure emails, protecting users and brands from painfully costly abuse.

How Does DMARC Work?

A DMARC policy allows a sender to indicate that their emails are protected by SPF and/or DKIM, and tells a receiver what to do if neither of those authentication methods passes - such as junk or reject the message. DMARC removes guesswork from the receiver's handling of these failed messages, limiting or eliminating the user's exposure to potentially fraudulent & harmful messages. DMARC also provides a way for the email receiver to report back to the sender about messages that pass and/or fail DMARC evaluation.

Who Can Use DMARC?

DMARC policies are published in the public Domain Name System (DNS), and available to everyone. It is the goal of DMARC.org to submit the draft specification to the IETF so that it may begin the process of becoming an official Internet Standard RFC - available to everyone for reference, implementation, and improvement."

gusmiles
Vote Up (15)

DMARC has good intentions, but it is human behavior that needs to be addressed and protected against. In today's business world, IT admins need to be more proactive, than reactive. Though DMARC has a lot of proactive traits, more is needed, including proper training and especially, ongoing monitoring.

 

A great company I ran across not too long ago has a very good anti-phishing service; you may want to check out this review and the service: Review of Phishme

 

Gus Miles

Bio / Google+ / LinkedIn

Article: SpyHunter 4 Review

Ask a question

Join Now or Sign In to ask a question.
Attackers deploy Web-based reconnaissance tool to gather information about potential targets in different industries
Europol launched a cybercrime task force Monday to fight online crime in the EU and other countries.
A file-encrypting ransomware program called CryptoWall infected over 600,000 computer systems in the past six months and held 5 billion files hostage, earning its creators more than US$1 million, researchers found.
Former U.S. Secretary of State Hillary Clinton called for a "global compact" on surveillance and the use of collected data, saying the U.S. isn't the only country that does it and American technology companies are unfairly targeted for the government's actions.
Electric carmaker Tesla Motors wants security researchers to hack its vehicles. The Silicon Valley based high-tech carmaker will hire up to 30 full-time hackers whose job will be to find and close vulnerabilities in the sophisticated firmware that controls its cars.
Two recent vulnerabilities are examples of problems that could have been avoided if we had just applied the lessons already learned in similar contexts.
Windows XP users may now download a fourth service pack for the 13-year-old operating system, but it isn't coming from Microsoft.
The growing number of data breaches resulting in massive numbers of payment cards being stolen from retail stores and other businesses is occurring because they're failing to keep up with the Payment Card Industry's data security standard, according to the PCI Security Standards Council.
Email addresses and encrypted passwords of around 97,000 users who tested early builds of the Bugzilla bug tracking software were left exposed for three months following a server migration.
Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

randomness