How will DMARC stop phishing?

sspade

It's not often that Facebook, Microsoft, Yahoo, Google, et. al team up to do anything together, but apparently they are going to turn their collective attention to stopping phishing. I just looked at my spam folder, and there were dozen of phishing attempts in there, which is a testament to Gmail's spam filter. Domain-based Message Authentication, Reporting and Conformance, or DMARC is intended to stop phishing to point that attempts never even reach the spam folder, which would be a very good thing. Let's face it, while most of the folks here wouldn't fall for it, there are people every day that open up that message that looks like it is from Paypal or whoever, and gladly send off their account information to criminals. How is DMARC going to stop this, and will the "phishermen" find a way around it anyway?

Topic: Security
Answer this Question

Answers

2 total
jimlynch
Vote Up (19)

I think the jury will be out on this for a while. Hopefully it will help, but spammers are quite clever and might find some way around it. Also, let's face it. Some people are just stupid or careless, so I suspect we'll have till have problems even with this new system. You can't really get rid of this altogether given that a lot of it depends on human judgement and some people have very poor judgement indeed.

Here's more info about DMARC:

http://dmarc.org/

"DMARC - What is it?

DMARC, which stands for "Domain-based Message Authentication, Reporting & Conformance", is a technical specification created by a group of organizations that want to help reduce the potential for email-based abuse by solving a couple of long-standing operational, deployment, and reporting issues related to email authentication protocols.

DMARC standardizes how email receivers perform email authentication using the well-known SPF and DKIM mechanisms. This means that senders will experience consistent authentication results for their messages at AOL, Gmail, Hotmail, Yahoo! and any other email receiver implementing DMARC. We hope this will encourage senders to more broadly authenticate their outbound email which can make email a more reliable way to communicate.

Why is DMARC Important?

With the rise of the social internet and the ubiquity of e-commerce, spammers and phishers have a tremendous financial incentive to compromise user accounts, enabling theft of passwords, bank accounts, credit cards, and more. Email is easy to spoof and criminals have found spoofing to be a proven way to exploit user trust of well-known brands. Simply inserting the logo of a well known brand into an email gives it instant legitimacy with many users.

Users can't tell a real message from a fake one, and large mailbox providers have to make very difficult (and frequently incorrect) choices about which messages to deliver and which ones might harm users. Senders remain largely unaware of problems with their authentication practices because there's no scalable way for them to indicate they want feedback and where it should be sent. Those attempting new SPF and DKIM deployment proceed very slowly and cautiously because the lack of feedback also means they have no good way to monitor progress and debug problems.

DMARC addresses these issues, helping email senders and receivers work together to better secure emails, protecting users and brands from painfully costly abuse.

How Does DMARC Work?

A DMARC policy allows a sender to indicate that their emails are protected by SPF and/or DKIM, and tells a receiver what to do if neither of those authentication methods passes - such as junk or reject the message. DMARC removes guesswork from the receiver's handling of these failed messages, limiting or eliminating the user's exposure to potentially fraudulent & harmful messages. DMARC also provides a way for the email receiver to report back to the sender about messages that pass and/or fail DMARC evaluation.

Who Can Use DMARC?

DMARC policies are published in the public Domain Name System (DNS), and available to everyone. It is the goal of DMARC.org to submit the draft specification to the IETF so that it may begin the process of becoming an official Internet Standard RFC - available to everyone for reference, implementation, and improvement."

gusmiles
Vote Up (15)

DMARC has good intentions, but it is human behavior that needs to be addressed and protected against. In today's business world, IT admins need to be more proactive, than reactive. Though DMARC has a lot of proactive traits, more is needed, including proper training and especially, ongoing monitoring.

 

A great company I ran across not too long ago has a very good anti-phishing service; you may want to check out this review and the service: Review of Phishme

 

Gus Miles

Bio / Google+ / LinkedIn

Article: SpyHunter 4 Review

Ask a question

Join Now or Sign In to ask a question.
Now that BlackBerry has fallen significantly behind Apple and Google in the race to offer features and third-party apps for its smartphones, the company is concentrating on providing devices that, it claims, have the strongest available security -- the killer feature for the enterprise.
Today's hotels are unfortunately vulnerable to types of attempted fraud. Here's how to keep data safe when you travel.
U.S. Senator Patrick Leahy has introduced a new version of a bill to rein in the National Security Agency's bulk collection of U.S. phone records in an effort to strengthen legislation that passed the House of Representatives this year.
The IT infrastructure of the National Research Council of Canada was recently compromised by highly sophisticated Chinese state-sponsored hackers, the Canadian government said Tuesday.
The majority of Android devices currently in use contain a vulnerability that allows malware to completely hijack installed apps and their data or even the entire device.
U.S. and EU privacy and consumer groups called on privacy regulators to stop Facebook's plans to gather the Internet browsing patterns of its users while they visit other sites.
A configuration problem in Facebook's popular Instagram application for Apple devices could allow a hacker to hijack a person's account if they're both on the same public Wi-Fi network.
Questions abound over sites authenticating users via identities established through social networks, Yahoo Ponemon Institute survey shows.
Attackers are exploiting a vulnerability in distributed search engine software Elasticsearch to install DDoS malware on Amazon and possibly other cloud servers.
Vulnerabilities in the Tails operating system could reveal your IP address, but you can avoid trouble by taking a couple of precautions.