A majority of the 2020 U.S. presidential campaigns are vulnerable to sophisticated email attacks as they have failed to implement DMARC and advanced security systems, according to a study conducted by email security firm Agari.
The company has analyzed the websites of Republican and Democrat candidates and found that most of them allow malicious actors to send out emails impersonating their campaigns. The study also found that a majority of them have failed to deploy advanced email security solutions, relying almost exclusively on the security features provided by service providers such as Microsoft and Google.
An analysis of all the campaign email domains showed that only 1% have fully implemented DMARC and only 8% of the top candidates — the 12 candidates with polling averages above 1% — have done so.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication, policy, and reporting protocol designed to detect and prevent email spoofing. Organizations can set the DMARC policy to “none” to only monitor unauthenticated emails, “quarantine” to send them to the spam or junk folder, or “reject” to completely block their delivery.
In the case of political campaigns, the lack of DMARC can allow malicious actors to send out fake emails to donors, voters and the press in the name of the targeted candidate. Agari said these impersonation attacks can “crush a candidate’s reputation, their fundraising ability, and their electoral viability.”
Agari’s study also showed that only 3% of all 2020 US presidential candidates rely on third-party email security solutions. In the case of the top 12 candidates, Agari found that only two use advanced email security solutions.
The company says the security features provided by service providers such as Google and Microsoft can in many cases detect and block phishing and other email-borne threats, but they are often no match for sophisticated, targeted attacks, which dedicated email security solutions are more likely to catch.
Agari found that only Democratic candidate Elizabeth Warren has implemented DMARC (with a reject policy) and deployed advanced email security solutions. Republican candidate Bill Weld uses advanced email security, but his domain does not use DMARC. Democratic candidates Cory Booker, Julian Castro and Amy Klobuchar, and the current president, Donald Trump, have DMARC records assigned to their domains, but they have failed to set a reject policy.
Agari believes the risk of attacks is high — as demonstrated by the attacks against the 2016 Clinton campaign — and has pointed out that 96% of corporate data breaches begin with an email.
The analysis of the 2020 presidential campaigns is part of Agari’s Email Fraud and Identity Deception Trends report for Q2 2019, which the company published on Tuesday.
In 2017, the U.S. Department of Homeland Security (DHS) ordered government agencies to secure their email and web assets, including by implementing DMARC, but many organizations failed to meet the October 2018 deadline.
“To its credit, the US executive branch is now one of the leading industry verticals in the adoption of DMARC. But so far at least, no such directive has been set for the federal government’s legislative or judicial branches, let alone for the chaotic operations of congressional and presidential election campaigns,” Agari said in its report.
UPDATE. Anti-phishing company Valimail told SecurityWeek that its data shows 8 of 16 campaign domains (including donaldjtrump.com) are using DMARC, and the domains of Joe Biden and Tulsi Gabbard are also protected against spoofing by DMARC. The firm provides an online tool that allows anyone to check the status of any domain.
On the other hand, some experts believe that while DMARC is a good tool for improving email security, there are some important aspects that need to be taken into consideration.
“[DMARC] only protects against attacks that spoof the domain, not against attacks that use previously compromised accounts or use a different domain,” Virus Bulletin’s Martijn Grooten told SecurityWeek. “Most recipients don’t check if the domain of a sender matches exactly. (Note that DMARC wouldn’t have stopped the hacking of John Podesta’s email in 2016.).”
“Secondly, a strict DMARC policy may have consequences for the delivery of legitimate emails, so it’s important for a domain owner to make an informed choice, not to just apply a p=reject policy,” Grooten added.
Related: DMARC Not Implemented on Most White House Email Domains
Related: DMARC Use is Growing, But Difficult to Configure Correctly and Completely
