Dick Vitale impression returning in:
OH MY, WHAT A TOURNAMENT IT HAS BEEN! SOME STUNNING UPSETS! MILLIONS OF BRACKETS BUSTED! IT’S AWESOME (and sometimes awful), BABY!
Whew… Got that out of the way.
So, what have we learned from the first two rounds of the Annual March Hackness phishing tournament?
The COVID-19 pandemic has definitely played into what attackers are using in their business.
The proof? Cinderella runs thus far for some of our (not-so-Sweet) 16 of top-impersonated newcomers: the World Health Organization (which we’ve seen daily in the news); Target (whose online sales surged by $10 billion last year); and DocuSign (whose revenue exploded by nearly 50%, thanks to post-COVID remote business). Reminiscent of Marquette’s 2013 run, in my opinion!
That said, our major players of Microsoft and Google are still accounted for — they continue to remain attackers’ favorite brands year after year. (Case in point: our security research team recently uncovered a highly sophisticated Microsoft 365 phishing campaign targeting financial departments and unsuspecting assistants and CEOs).
But … who honestly could have predicted PayPal getting knocked out in the first round? Our 2019 March Hackness Champion goes home early! Congratulations to them for being Most Improved (aka, less spoofed)!
Remember folks, in our phishing bracket, a first round knockout is actually a badge of honor!
Which brings us into the Not-So-Sweet 16. Can the WHO continue its historic run? Can Twitter upset the Duke-esque status of Microsoft? Will Facebook survive a matchup against Amazon? Only time will tell!
The Madness is setting in!
Let’s check back with Dicky V for analysis of the perfect phishing bracket:
Some takeaways for the Sweet 16?
- OH BABY! We’ve got quite a few Juggernaut matchups! Microsoft has that champion pedigree but Twitter is a strong contender!
- Facebook vs Amazon! That’s a championship matchup in it’s own right … expect a lot of fireworks there!
- I like Apple’s odds of making it to the finals!
- I think our Cinderella, the WHO, might be making it to the ball!
Tune in on April 5th to see who will be crowned our OPHISHAL Champion for 2021! IT’S AWESOME BABY!
And Now Some Additional Analysis
By the way, in case you’re wondering: is email authentication (SPF, DKIM, DMARC) THE winning way to stop brand spoofing and impersonation-based phishing attacks from ever reaching inboxes?
The answer is: No. Over the past year, we’ve blocked 22 million of these types of phishing attacks — and while we know all three standards can help with preventing some forms of phishing, attackers can easily bypass email authentication.
The SPF, DKIM and DMARC standards are certainly useful for validating server and tenant origins, protecting message integrity and providing policy enforcement. However, security professionals should know that:
- Anyone can set up emails that pass email authentication.
- Email authentication does not inspect content.
- Email authentication does not protect against look-alike domains.
- Email authentication does not protect against compromised domains.
- The vast majority of organizations and domains do not use email authentication.
- Email authentication can be difficult to set up properly.
Below is a brief description of what each standard does, what types of threats it can protect against and what types of threats it cannot protect against. (You can also download a handy Email Authentication Cheat Sheet, here).
(Sender Policy Framework)
Validating server origin (i.e., validates where a message originates from)
Defining which email servers and services are allowed to send messages on a domain owner’s behalf
|Best for:||Preventing spoofing of a legitimate email’s return address domain, i.e., the “Reply to” email address or return-path domain|
(Domain Keys Identified Mail)
Providing tenant origin validation (i.e., checks that an email was sent/authorized by the owner of the domain via a digital signature)
Ensuring email is not altered while transferred from server to server; protecting message integrity
|Best for:||Preventing spoofing of the “Display From” email address — the address usually shown to the end user when an email is opened|
(Domain-based Message Authentication, Reporting and Conformance)
Providing policy enforcement and reporting for SPF and DKIM
Stipulating what policy to follow if an email doesn’t pass SPF or DKIM authentication (e.g. reject/delete, quarantine, no policy/send)
Reporting function allows domain owners to who is sending email on their behalf
Protecting against spoofing of your own domain and brand abuse
(Does not prevent spoofing of another brand’s domain.)
Kevin Wilson is a Sr. Product Manager at Area 1 Security. Throughout his 14 years in Cyber Security, Kevin has been an Analyst and Engineer in various organizations such as the U.S Navy, First Data, and Lowe’s. Previously he served as the Global Information Security Officer at Guess? Inc as well as a Product Manager for McAfee.