This blog originally appeared in March 2021 on the Area 1 Security website, and was issued in advance of Cloudflare's acquisition of Area 1 Security on April 1, 2022. Learn more.
Dick Vitale impression returning in:
3…
2…
1…
OH MY, WHAT A TOURNAMENT IT HAS BEEN! SOME STUNNING UPSETS! MILLIONS OF BRACKETS BUSTED! IT’S AWESOME (and sometimes awful), BABY!
Whew… Got that out of the way.
So, what have we learned from the first two rounds of the Annual March Hackness phishing tournament?
The COVID-19 pandemic has definitely played into what attackers are using in their business.
The proof? Cinderella runs thus far for some of our (not-so-Sweet) 16 of top-impersonated newcomers: the World Health Organization (which we’ve seen daily in the news); Target (whose online sales surged by $10 billion last year); and DocuSign (whose revenue exploded by nearly 50%, thanks to post-COVID remote business). Reminiscent of Marquette’s 2013 run, in my opinion!
That said, our major players of Microsoft and Google are still accounted for — they remain attackers’ favorite brands year after year. (Case in point: our security research team recently uncovered a highly sophisticated Microsoft 365 phishing campaign targeting financial departments and unsuspecting assistants and CEOs).
But … who honestly could have predicted PayPal getting knocked out in the first round? Our 2019 March Hackness Champion goes home early! Congratulations to them for being Most Improved (aka, less spoofed)!
Remember folks, in our phishing bracket, a first round knockout is actually a badge of honor!
Which brings us into the Not-So-Sweet 16. Can the WHO continue its historic run? Can Twitter upset the Duke-esque status of Microsoft? Will Facebook survive a matchup against Amazon? Only time will tell!
The Madness is setting in!
Let’s check back with Dicky V for analysis of the perfect phishing bracket:
Some takeaways for the Sweet 16?
OH BABY! We’ve got quite a few Juggernaut matchups! Microsoft has that champion pedigree but Twitter is a strong contender!
Facebook vs Amazon! That’s a championship matchup in its own right … expect a lot of fireworks there!
I like Apple’s odds of making it to the finals!
I think our Cinderella, the WHO, might be making it to the ball!
Tune in on April 5th to see who will be crowned our OPHISHAL Champion for 2021! IT’S AWESOME BABY!
And Now Some Additional Analysis
By the way, in case you’re wondering: is email authentication (SPF, DKIM, DMARC) THE winning way to stop brand spoofing and impersonation-based phishing attacks from ever reaching inboxes?
The answer is: No. Over the past year, we’ve blocked 22 million of these types of phishing attacks — and while we know all three standards can help with preventing some forms of phishing, attackers can easily bypass email authentication.
The SPF, DKIM and DMARC standards are certainly useful for validating server and tenant origins, protecting message integrity and providing policy enforcement. However, security professionals should know that:
Anyone can set up emails that pass email authentication.
Email authentication does not inspect content.
Email authentication does not protect against look-alike domains.
Email authentication does not protect against compromised domains.
The vast majority of organizations and domains do not use email authentication.
Email authentication can be difficult to set up properly.
Below is a brief description of what each standard does, what types of threats it can protect against and what types of threats it cannot protect against.
DMARC
(Domain-based Message Authentication, Reporting and Conformance) |
| Purpose |
Providing policy enforcement and reporting for SPF and DKIM
Stipulating what policy to follow if an email doesn’t pass SPF or DKIM authentication (e.g. reject/delete, quarantine, no policy/send)
Reporting function allows domain owners to who is sending email on their behalf |
| Best for: |
Protecting against spoofing of your own domain and brand abuse
(Does not prevent spoofing of another brand’s domain.) |
| Limitations |
Does not prevent spoofing of another brand’s domain
Does not prevent look-alike email, domain or display name spoofing
Domain owners specify what percentage of mail DMARC policies applies to; application percentages of less than 100% are virtually meaningless
Does not protect against attacks using “validated” emails with embedded URLs, malicious payloads or attachments |