April is a time for tax-related phishing scams, and we haven’t been let down this year despite the dominance of COVID-19-themed phishing campaigns. DMARC should stop phishing, right? Not unless the targeted domain itself is spoofed.
Security firm Abnormal Security discovered a phishing email giving a single day for the recipient to respond and claim an outstanding tax rebate from HMRC (the UK tax authority) for ‘550.11 GBP’. The email contains an obfuscated link to a webpage masquerading as a Gov.uk page. That landing page requests full card and bank details in order to progress the refund.
The text of the email is not bad as phishing scams go — with just a few grammatical errors and inconsistencies. These could easily be missed by anyone excited by the chance of gaining more than £500 (approximately $625) and activated by the short lead time. Greed and urgency are two of the classic spurs used by scammers.
The landing page is even more convincing than the email; clear, well laid out and exactly what the victim might expect from a government department. If fooled, the victim will not receive a £550 refund, but would likely lose even more.
What is particularly interesting about this phishing attempt, however, is that HMRC is fully DMARC protected — that is, DMARC is implemented at the strongest enforcement level. The purpose of DMARC is to stop phishing — which it clearly has not done in this example. The reason is that DMARC blocks only phishing emails that pretend to come from the genuine domain. This comprises approximately two-thirds of all phishing attempts; leaving one-third unblocked by DMARC.
After implementing DMARC, HMRC Digital blogged in November 2016, “We have already managed to reduce phishing emails by 300 million this year through spearheading the use of DMARC. It allows us and email service providers to identify fraudulent emails purporting to be from genuine HMRC domains and prevent their delivery to customers.” DMARC works where it is designed to work.
The hidden danger, however, is that the phishers will simply put more social engineering effort into masquerading as an associated domain that could be accepted as genuine. In this instance, the email claims to come from ‘Service-Center-Online-Office-Ref-No [email protected]’. The dot-be suffix is a give-away, since the victim should hardly expect a Belgian domain to be involved with UK tax refunds.
Nevertheless, the principle is clear– phishers do not need to spoof the exact domain name if they can use a different domain that might be accepted as reasonable. This may become an unavoidable effect of the increasing use of DMARC to block exact domain name spoofing: criminals will migrate to alternative (but acceptable) domain names that are untouched by DMARC controls.
Related: Threat From Spoofed Emails Grows, While DMARC Implementation Lags
Related: Nearly 1 Million Domains Use DMARC, but Only 13% Prevent Email Spoofing
Related: DMARC Use is Growing, But Difficult to Configure Correctly and Completely
Related: Presidential Candidates’ Use of DMARC Improves, but Short of Optimum
Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.
More from Kevin Townsend
- Threat Actor Abuses SuperMailer for Large-scale Phishing Campaign
- Quantum Decryption Brought Closer by Topological Qubits
- IBM Delivers Roadmap for Transition to Quantum-safe Cryptography
- CISO Conversations: HP and Dell CISOs Discuss the Role of the Multi-National Security Chief
- Court Rules in Favor of Merck in $1.4 Billion Insurance Claim Over NotPetya Cyberattack
- Open Banking: A Perfect Storm for Security and Privacy?
- Apiiro Launches Application Attack Surface Exploration Tool
- Phylum Adds Open Policy Agent to Open Source Analysis Engine
Latest News
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Google Temporarily Offering $180,000 for Full Chain Chrome Exploit
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
