Why coronavirus scammers can send fake emails from the WHO

TL;DR

Scammers use WHO domain to send fake emails.

Transcript

Hello? First things first. Check your e-mail. I got one. Fake Dylan at W.H.O. This is the WHO’s real domain, right? W.H.O. dot I.N.T. So Fake Dylan is a internet security researcher that I worked with to send all of our emails a bunch of fake messages. And he was able to send these messages from the real W.H.O. domain. I'm going to say I'm coming t... Read More

Key Insights

• Email spoofing is a significant threat during the coronavirus pandemic, with scammers impersonating organizations like the WHO to deceive recipients.
• The WHO's domain can be spoofed because they haven't implemented DMARC, a free authentication system that helps prevent domain spoofing.
• DMARC is a voluntary system that requires organizations to set up policies to reject unauthorized emails, but many do not participate or set weak policies.
• The foundational technologies of the Internet were built without security in mind, making it easy for scammers to impersonate legitimate entities via email.
• Emails from spoofed domains can contain malware that captures personal information, such as keystrokes and screenshots, posing a significant risk to recipients.
• Despite the availability of tools like DMARC, less than 15% of domains have set their policy to reject spoofed emails, indicating a lack of widespread adoption.
• The WHO's lack of a DMARC policy highlights the challenge organizations face in balancing email deliverability with security against spoofing.
• The White House, despite having a policy directive for DMARC implementation, has not fully enforced it, illustrating the gap between policy and practice.

Questions & Answers

Q: What is email spoofing and how does it relate to the WHO?

Email spoofing involves sending emails from a forged sender address, making it appear as if it comes from a legitimate source. During the coronavirus pandemic, scammers have used the WHO's domain to send fake emails, exploiting the organization's lack of a DMARC policy to deceive recipients.

Q: What is DMARC and why is it important?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that helps prevent domain spoofing by allowing domain owners to set policies for handling unauthorized emails. It is important because it provides a way to verify the legitimacy of emails and protect against phishing and malware attacks.

Q: Why haven't more organizations implemented DMARC?

Many organizations have not implemented DMARC due to various reasons, including the complexity of setting it up correctly, the voluntary nature of the system, and concerns about email deliverability. Additionally, there may be a lack of awareness or resources dedicated to improving email security practices.

Q: How do scammers use spoofed emails to harm recipients?

Scammers use spoofed emails to deceive recipients into believing they are receiving legitimate communications from trusted entities. These emails may contain malware attachments or phishing links that can capture personal information, such as passwords and keystrokes, or install harmful software on the recipient's device.

Q: What role does the foundational technology of the Internet play in email spoofing?

The foundational technology of the Internet was built without security measures, allowing for easy impersonation of email senders. This lack of built-in security has led to vulnerabilities like email spoofing, where scammers can forge sender addresses and send fraudulent emails that appear to be from legitimate sources.

Q: What are the implications of not having a DMARC policy for organizations like the WHO?

Without a DMARC policy, organizations like the WHO are vulnerable to email spoofing, where scammers can easily impersonate their domain and send fraudulent emails. This undermines trust in their communications, poses security risks to recipients, and can lead to the spread of misinformation or malware.

Q: How does the White House's DMARC policy compare to its directives?

The White House has a DMARC policy but has not fully enforced it, with a setting of 'none' that does not reject unauthorized emails. This is in contrast to its directive requiring federal agencies to set a DMARC policy of 'reject,' highlighting a gap between policy and actual practice.

Q: What challenges do organizations face in implementing DMARC?

Organizations face challenges in implementing DMARC due to the complexity of configuring it correctly, the need to balance email deliverability with security, and the potential risk of legitimate emails being rejected if the system is not set up properly. Additionally, the voluntary nature of DMARC means there is less incentive for widespread adoption.

Summary & Key Takeaways

• During the coronavirus pandemic, email spoofing has become a prevalent issue, with scammers sending fake emails from domains like the WHO's. These emails often contain malware or phishing attempts, exploiting the lack of email authentication systems like DMARC.

• DMARC is a free email authentication system that can prevent domain spoofing, but its adoption is low. Many organizations, including the WHO, have not implemented it, allowing scammers to impersonate them easily and deceive email recipients.

• The lack of email security protocols is rooted in the foundational technologies of the Internet, which were not designed with security in mind. While systems like DMARC exist, they are voluntary, and many organizations fail to adopt them, leaving vulnerabilities.