APWG Expert Says E-Mail Authentication Will Help
Phishing attacks are on the rise, and cybercriminals’ methods are changing. How can the DMARC initiative help to reduce phishing incidents? Paul Ferguson of the Anti-Phishing Working Group explains.
DMARC, which stands for Domain-based Message Authentication, Reporting and Conformance, standardizes how e-mail receivers perform e-mail authentication by providing a uniform reporting practice (see Can DMARC Hook Online Phishers?).
“It’s a very good feedback mechanism,” says Ferguson, vice president of threat intelligence for online security company IID (Internet Identity), in an interview with Information Security Media Group [transcript below].
DMARC uses identifiers, such as DKIM and SPF, which are used to measure certain criteria within an e-mail. “If certain criteria are not met, [it’s] going to reject the message,” he says.
Ferguson says phishing attacks are increasing against PCs, Macs and mobile devices. During the first half of 2012, phishing attacks throughout the world were up 12 percent from the first half of 2011, according to the APWG’s Global Phishing Survey.
DMARC can sufficiently mitigate phishing risks, Ferguson says. “But for it to have more impact on the whole spam and phishing problem, it needs more wide-scale adoption,” he says.
During this interview, Ferguson discusses:
- Challenges organizations and security firms face when it comes to mitigating spear-phishing risks;
- How initiatives such as Domain-based Message Authentication, Reporting and Conformance can reduce phishing;
- Why the growth of social networking has fueled phishing’s success.
At IID, Ferguson monitors online traffic patterns and advises client companies about phishing trends and other threats. As part of the APWG, he works to spread the message about the need for stronger online security to global organizations.
Phishing Attacks Increase
TRACY KITTEN: Back in October, the APWG issued a report about international phishing trends, noting that phishing attacks jumped 12 percent during the first half of 2012, relative to the same period in 2011. Do you expect those comparisons for the second half of 2012, which are still being calculated, to yield similar results?
PAUL FERGUSON: I do expect them to reveal similar results. The threat window – which is the time when the phish are actually active and harvesting credentials from victims that they’re targeting – is actually shrinking. That means the time that the phish are actually active is shrinking, and, overall, the volume of phish seems to be shrinking. But it seems like the victimization is actually growing, and I know that’s kind of counterintuitive. But it just means that – exactly what you referenced – the phishers and the criminals themselves that are perpetrating these schemes are fine-tuning their methodologies. This is primarily low-hanging fruit for them. They’re fine-tuning their methodologies to grow their victim base without using as many resources on their end.
Phishers’ Methods
KITTEN: What are phishers doing to enhance their techniques?
FERGUSON: It’s not necessarily websites themselves, but actually victim PCs, Macs and things that are being used for botnets, called spambots. They’re actually generating the spam. Every day there’s a new campaign using a brand impersonation, like sending spam under the guise of the Better Business Bureau, the IRS, a law enforcement agency, UPS or FedEx; and they happen to find the right times of the year when people are more susceptible to falling for those ruses.
Another part of it is websites. There are some websites that are low-hanging fruit with outdated versions of software that are easily compromised by even the least-sophisticated hackers, and they use those sites to perpetrate other crimes, including spamming and phishing.
Compromising Apple Computers
KITTEN: Are we beginning to see more compromises of Apple computers and i-devices? Aren’t these systems more secure, or is that just a long-standing misnomer?