apwg ecrime2014

Unifying theGlobal Responseto Cybercrime

Evaluating Phishing Attacks:

DMARC and non-DMARC

Intelligence

Robert HolmesReturn Path


“From” [email protected]

“From” [email protected]


What is DMARC?

• Domain-owner announces policy in the DNS

• Receivers check:• SPF passes AND SPF domain is aligned with RFC5322.From

domain (in strict or relaxed mode, as specified in the policy)

• DKIM passes AND DKIM domain is aligned with RFC5322.From domain (in strict or relaxed mode, as specified in the policy)

• Email failing both conditions has policy applied

• Receivers send reports to domain-owners

IETF draft

https://datatracker.ietf.org/doc/draft-kucherawy-dmarc-base/


DMARC Adoption

• Receivers:• 85% US consumer mailboxes (MAGY)

• 60% global consumer mailboxes

• Email security filters

• Senders:• 80,000 sending domains (source: Gmail)

• 1,575 of top 10,000 sending domain (source: Return Path)


What Percentage of Attacks are Domain-

based?• DMARC.org

• OTA

• Anecdotes

• Data analysis


• Seed list:• 11 large financial institutions

• US & UK brands

• Have not achieved DMARC “reject” policy

• Source data:• Trap, spam, complaints messages

• > 300M messages per day

Seed & Source Data


• Narrow search strategies to eliminate noise

• Data pulled from over 60 days

• False positives removed

• Collapsed by campaign…

Methodology


Analysis Results

Campaign definition Count of campaigns(across 11 brands)

Domain-based campaigns(average % across 11 brands)

Header from | Subject | Date 10,823 26.66%

Header from | Subject 8,347 25.46%

Display name | Header from domain | Subject 6,770 25.45%

Header from domain | Subject 6,316 26.04%

Sending IP address | Subject 12,124 30.18%

Average 8,876 26.76%


Variability by Brand

Brand Domain-based campaigns(Sending IP address | Subject)

Brand 1 1.06%

Brand 2 8.47%

Brand 3 76.53%

Brand 4 3.22%

Brand 5 27.81%

Brand 6 43.80%

Brand 7 18.21%

Brand 8 66.39%

Brand 9 38.46%

Brand 10 1.18%

Brand 11 46.90%

Average 30.18%


• Large but not comprehensive data set

• No reason for bias in source data towards/against domain-based threats• Domain-based threats more difficult to identify and report

• Brands analysed hadn’t achieved a reject policy

• False positives/negatives…?

Confidence Considerations


• DMARC will block 25-30% of campaigns (average)• Value of DMARC will vary greatly by brand

• We predict adoption will accelerate domain-based attacks will decline

• DMARC won’t eliminate phishing, but it will push fraudsters to the margins• Reducing the credibility and therefore impact of attacks

• Protecting brand mail streams

DMARC Conclusions


• Is this analysis interesting?

• Is this analysis valuable?

• How could we improve the analysis?

• What other questions should we attempt to answer?

Questions

apwg ecrime2014

Internet