Monthly Archives: August 2019

A Little Blacklist History

History of Blacklists

Blacklist – in the context of technology, a list of items, such as usernames or IP addresses, that are denied access to a certain system protocol. When a blacklist is used for security purposes or access control, all entities are allowed access, minus those actually listed in the blacklist. Moreover, an email blacklist is a real-time database that utilizes criteria to determine if an IP is sending email it considers to be spam. There are many operable blacklists, and each has a unique way of accepting inbound mail and determining if messages are considered spam. Needless to say, blacklists directly impact the deliverability of your company’s emails.

Note: A Whitelist or whitelisting is NOT the opposite of a blacklist. A whitelist is a connection or group of IP addresses that will always be accepted, typically bypassing many other security controls. Do not ask for someone to whitelist you.

The first Domain Name System-based Blackhole List (DNSBL) was the Real-time Blackhole List (RBL) created in 1997 as a Border Gateway Protocol (BGP) list. Interestingly, the initial version of the RBL was not published using DNS, but rather a list of networks transmitted via BGP to routers owned by subscribers so that network operators could drop all TCP/IP traffic for machines used to send spam/host spam supporting services, such as a website. The term “blackhole list” is often interchanged with “blacklist” and “blocklist.”

Overview of Blacklists

Generally speaking, a DNSBL or RBL is an effort to stop email spamming. It is a blacklist of locations on the Internet believed to actively send email spam. The locations consist of IP addresses, which are typically linked to spamming. Most mail server software can be configured to reject or flag messages that have been sent from a site listed on one or more of these lists.

Furthermore, a DNSBL is a software mechanism, rather than a specific list or policy. There are many DNSBLs in existence, which use a wide array of criteria for listing and delisting addresses. For example:

The IP addresses of zombie computers or other machines being used to send spam (some RBLs specialize in spam in different languages)
Internet service providers (ISPs) who willingly host spammers, or those which have sent spam to a honeypot system.
List of the IP addresses of email systems that openly relay mail (which could be used by spammers)
List of dynamic IP addresses at ISPs
List of domain names typically used in spam emails.

In order to operate a DNSBL three things are needed: a domain to host it under, a nameserver for that domain, and a list of addresses to publish.

In addition, based on data received about your IP address, there are three places for your email to end up. If your company is on a blacklist, outbound messages could end up in spam or not delivered. If in good standing, your business emails will be then go through secondary processing by the inbox provider. Most will be delivered and show up in the inbox as intended. Most blacklist services set up their own specific methods, algorithms and honeypots and have websites that detail the reasons for listing along with delisting options. Delisting may be requested or may be automatic in some cases (keep reading). Note: Some less savory blacklists require a payment for delisting; Mxtoolbox does not approve of this type of business model.

What Is an IP or Domain Blacklist Problem?

Most businesses learn that their IP address is blacklisted when a customer reports missing an important email. After multiple reports, someone usually contacts IT who looks into the problem. Without proper monitoring of your blacklist status, your business could be at risk.

MxToolbox to the Rescue

An early innovator in addressing blacklist issues, MxToolbox built started with a free online Blacklist Check tool to help email admins, marketers, and business owners monitor their sending reputation. Since then, we have focused on email delivery solutions, introducing the most comprehensive Blacklist Monitoring service on the Internet and, now, providing DMARC-based email deliver solutions.

The Future of Blacklist Monitoring

MxToolbox believes in continually delivering innovative tools and services to help our customers who face an ever changing email world. Recently, we released Adaptive Blacklist Monitoring, expanding the frontier of blacklist monitoring beyond traditional blacklist monitoring for businesses to answer the following questions:

How do you maintain lists of all internal and external sender’s IP addresses?
How do you update IP addresses being monitored when they change?
How do you monitor cloud email services sending from large pools of IPs?

MxToolbox Adaptive Blacklist Monitoring leverages new technologies like SPF and DMARC to monitor your blacklist status and email deliverability across all of your senders: internal, external and cloud-based.

Automatic Monitoring

MxToolbox automatically detects all your Outbound IP addresses that you actively send email from and monitors them for blacklistings. Add a new 3rd party sender? MxToolbox automatically monitors those new IP addresses as well. With this solution you no longer need to maintain IP lists and update monitoring.

Sender/Cloud Email Reputation

Send email through Office 365 or GSuite, etc.? MxToolbox detects the IP addresses those services are actively using to send your messages and if they are blacklisted. You can even view your sender’s reputation via MxRep to gauge how well their services are functioning.

What is Business Email Compromise (BEC)?

Email fraud targeting companies is a rampant and global problem. According to the Federal Bureau of Investigation (FBI), cybercriminals stole $12.5 billion worldwide from businesses between October 2013 and May 2018 by compromising their official email accounts and using them to initiate fraudulent wire transfers.¹ The Internet Crime Complaint Center (IC3) and the FBI are asking individuals to be aware of scams targeting businesses that work with foreign suppliers.

What Is Business Email Compromise?

The FBI officially defines business email compromise (BEC) as “a sophisticated scam targeting businesses working with foreign suppliers and businesses that regularly perform wire transfer payments.” Formerly known as the man-in-the-email scams, these schemes compromise official business email accounts to conduct unauthorized fund transfers. And, there has been a significant increase of computer intrusions linked to BEC scams in recent years.

How Do BEC Attacks Work?

The most common cons involve fraudsters impersonating high level executives, sending phishing emails from seemingly legitimate sources, and requesting wire transfers to alternate, fraudulent accounts. BEC scams often begin with an online fraudster compromising a business executive’s email account or any publicly listed email they can get their hands on. This is usually done using keylogger malware or phishing methods—where attackers create a domain similar to the target company—or spoofing email that tricks the target victim into providing account details. Upon monitoring the compromised email account, the cybercriminal will try to determine who initiates wires and who requests them. The scammers often perform a fair amount of research, looking for a company that has had a change in leadership in the C-suite of the finance function, companies where executives are traveling, or by leading an investor conference call. The perpetrators recognize and use these as opportunities to execute the scheme.

There are five distinct versions of BEC scams:

Bogus Invoice Scheme/Supplier Swindle: Cybercriminal compromises employee email ► Compromised account used to send notifications to customers ► Payments transferred to cybercriminal’s account ► Cybercriminal receives money
CEO Fraud: Cybercriminal poses as company executive and emails finance employee ► Finance sends funds to cybercriminal’s account ► Cybercriminal receives money
Account Compromise: Compromised employee account used to request money ► Recipients transfer payments to cybercriminal’s account ► Cybercriminal receives money
Attorney Impersonation: Cybercriminal poses as lawyer and emails finance employee ► Finance sends funds to cybercriminal’s account ► Cybercriminal receives money
Data Theft: Cybercriminal compromises employee email ► Compromised account used to request PII of other employees/executives ► PII sent to cybercriminal’s account ► Cybercriminal receives PII, uses it for further compromise attacks

DMARC – Defending Against BEC Scams

To combat BEC scams from affecting your business, DMARC is your friend. Your inbound email servers should be configured to filter email that fails DMARC compliance, especially when it comes to email that purports to being from your own domain.

The DMARC protocol was designed to improve email quality: What should happen to messages that fail authentication and compliance test (SPF and DKIM)? Should you Quarantine, reject, or approve? How do you tell the purported sender that their email is failing compliance checks? With DMARC implemented and correctly configured on your inbound servers, your company will have an advantage in reducing BEC attacks. Even with malware filtering, blacklist filtering and enhanced training/policies, DMARC reduces the threat of BEC attacks to your teams.

But what about your Customers, Suppliers and Partners?

DMARC really shines when it is configured correctly for outbound email as well as used to filter inbound email. Outbound email leveraging DMARC, DKIM and SPF protocols protects your brand from being used in spam, phishing and malware attacks. The key is to work with your internal and external email senders to properly configure SPF and DKIM. Once your legitimate sent email is DMARC compliant, you can instruct recipient organizations to automatically reject non-compliant email. Inbox Providers love DMARC because they can more easily screen for spam, malware and scam emails. Senders love it because Inbox Providers are more likely to prioritize DMARC compliant email.

Aside from achieving DMARC compliance, businesses are advised to stay vigilant and educate staff on how to prevent being victimized by BEC scams and other similar attacks. Cybercriminals don’t discriminate on company size. In fact, it is often easier to scam more small-to-medium companies than a single large organization. Additionally, online fraudsters don’t need to be highly technical as they have access to tools and services that cater to all levels of technical expertise in the cybercriminal underground. Because email is such a vital aspect of business communications, a single compromised account is all it takes to financially damage your company. Here are some tips on how to stay protected and secure:

Carefully scrutinize all emails. Be wary of irregular emails that are sent from C-suite executives, as they are used to trick employees into acting with urgency. Review emails that request transfer of funds to determine if the requests are irregular.
Educate and train staff. While employees are a company’s biggest asset, they’re also usually its weakest link when it comes to security. Commit to training them according to the company’s best practices. Remind all that adhering to company policies is one thing, but developing good security habits is another.
Confirm any changes in vendor payment location by using a secondary sign-off by company personnel.
Stay updated on your customers’ habits, including the details and reasons behind payments.
Verify requests for transfer of funds when using phone verification as part of two-factor authentication (use known numbers).
If you suspect that you have been targeted by a BEC email, immediately report the incident to law enforcement or file a complaint with the IC3.

Conclusion

Unfortunately, cybercriminals are a major threat to your business email. By devising malicious social engineering and computer intrusion schemes to fool employees into wiring money, cybercriminals create a serious risk for business whether large or small. This emerging global risk of business email compromise (BEC) has victimized thousands of companies around the world.

Fortunately, there are technologies, like DMARC, that help secure your company’s email and fight against BEC and other phishing scams. By implementing DMARC and educating employees, the prevalence of online fraudsters and their BEC cons will be minimized. At MxToolbox, our knowledgeable team has over a dozen years helping companies improve their email delivery and protecting companies from email-based threats. Our latest product, MxToolbox Delivery Center, leverages DMARC to protect your brand from fraud and phishing and improve your email deliverability.

¹Information Security Media Group, Corp. https://www.bankinfosecurity.com/fbi-alert-reported-ceo-fraud-losses-hit-125-billion-a-11206

Email on the Cloud: Does it solve your deliveryability issues?

What is “the Cloud”?

“The Cloud” is simply a term for using data storage, email, infrastructure, or applications as a service without the need for installing software and maintaining servers in your own data centers. Cloud-based services were made possible by cheap RAM, multi-cored processors and the easy availability of network bandwidth.

What is Cloud-based email?

Cloud-based email has been around since the early days of the Internet, where individual users could sign up for a Yahoo!, Hotmail or Gmail email account. Now, cloud-based email is associated with the same providers: Google G Suite Business and Office365/Outlook.com. The difference is that businesses, not consumers, migrate email processing for their domains from traditional on-premise email servers to these online service providers. This improves accessibility to email since employees only need an Internet connection to retrieve email (not a VPN to firewall-protected corporate servers) and reduces overhead costs for the company, while also improving email security, because a large team is now dedicated to the topic. One of the many selling points of cloud-based email is that it automatically improves your domain’s email deliverability. However, this is not entirely true. With cloud-based email set to double in size in the next few years¹, managing email deliverability is now even more important.

Email Deliverability with the Cloud

While inbox providers, like Google and Microsoft, dominate cloud-based email, many other cloud services send email from their own servers, for example: CRMs, Marketing Automation, Email Campaign Management, Support systems, ERPs and Order Management/Fulfillment systems. Managing all of these different vendors requires careful thought, information and leveraging email deliverability standards like SPF, DKIM and DMARC. Email deliverability does not automatically improve by migrating to the cloud, but the cloud can help.

DMARC Is Essential

Regardless of what email services you use, adopting DMARC is the single most important step you can take to improving email deliverability. DMARC leverages two important standards, SPF and DKIM, to enable you to delegate legitimate sources of email and cryptographically sign your messages so that recipients know the email is from your domain. When properly implemented and monitored, DMARC helps businesses by:

Improving Email Delivery – Sending email that is DMARC compliant can improve email delivery to your customers because inbox providers prioritize properly compliant emails.
Increasing Email Visibility – Imagine getting feedback on the compliance of your email from recipients? DMARC enables email inbox provider to report on ALL outbound messages sent “from” your company and any third-party providers utilized (Sendgrid, Marketo, etc.)
Identifying Delivery Problems – Gives your business insight into providers and email sources that have email authentication issues with SPF and DKIM that affect email delivery.
Preventing Spoofing/Phishing Attacks – Once properly implemented, DMARC can prevent fraudsters from targeting your customers using your domain reputation.

Even with DMARC, SPF and DKIM implemented you need to continuously monitor the feedback you receive from your email recipients’ inbox providers and act on the data. DMARC reports can be confusing to interpret and they also do not contain information about blacklisting, the most fundamental email hygiene issue.

Adaptive Blacklist: A New Ally

Email delivery is still dependent upon the blacklist status of the sending IP address. Email from an IP address that is blacklisted will typically be blocked even before DMARC compliance checks are made. After you have outsourced email distribution to 3rd parties, how do you keep track of their blacklist status? How do you know these providers are performing?

You need blacklist monitoring for your senders. MxToolbox has developed a revolutionary approach to check blacklist status of 3rd party vendors – Adaptive Blacklist Monitoring. MxToolbox’s Adaptive Blacklist Monitoring leverages DMARC reports to understand what IP addresses your 3rd party vendors are using to send your email and then constantly analyzes the blacklist status of your sending IPs. Adaptive Blacklist monitoring even adapts to the addition of new providers and reports on email threats. With MxToolbox, you get expert insight into your DMARC compliance combined with unique Adaptive Blacklist Monitoring. No other DMARC delivery solution does the same.

Delivery Center Events

At MxToolbox we strive to create features that improve your insight and control over email deliverability. Today, we are pleased to announce a new Events warning system in all versions of MxToolbox Delivery Center. The new Events tab and associated emails provide ongoing updates regarding specific delivery activity. Emails will alert Delivery Center customers to any current email delivery problems. Think of Events as an early warning system that helps your business avoid serious issues with email deliverability and online reputation.

Events will alert you to the following potential issues:

Large Outbound email volume changes (increase or decrease)
Email delivery DNS record issues (SPF/DKIM/DMARC)
Email authentication problems
Potential phishing campaigns posing as your business

Delivery Center provides keen insight into your company’s overall email delivery status and performance. Any activity that has negative email delivery consequences will be detected by Delivery Center and you will be immediately alerted, allowing you to act quickly before issues become major problems.

Alerts can be configured to alert only within the Delivery Center application, and/or via email . This helps you receive vital intelligence, no matter where you are, which could save you from a business email nightmare down the road.

Currently, there are three alert types:

DMARC Record Configuration Problem – A critical alert that means you are missing DMARC delivery information.
Verified Volume Changed – Large changes in email volume can indicate a new campaign, issue with a sender or phishing/fraud being committed using your domain name.
Adaptive Blacklist Alert – Warning that your sending IP addresses have been Blacklisted.

Example 1 – one Active Event (Verified Volume Changed) and two Inactive Events (Adaptive Blacklist—Last 7 Days, DMARC Record) are noted, with a “Critical” designation for DMARC.

Example 2 – Message categories provides a helpful summary of each event’s current standing.

Example 3 – The Date field indicates when the situation was last reported.

Example 4 – There are two option: select either the “Notify in Delivery Center” option or the “Notify by Email” choice.

MxToolbox Delivery Center continuously scans for delivery issues and updates you when your email delivery might be compromised. With Delivery Center, your company stays ahead of bigger issues.

If you are an existing Delivery Center user, be sure to try this new feature!

If you’re not already a Delivery Center subscriber, you can learn more about how Delivery Center will help your business email deliverability.

Stay tuned! More events are coming!

What is Whale Phishing?

The number and type of malicious online attacks seems to be increasing daily. Whaling/Whale Phishing is another in a long line of scams, this time leveraging and targeting senior executives. The term “whaling” was coined because of the magnitude of the targets and attacks relative to those of typical phishing ploys.

What Is Whaling Phishing?

A whaling attack, also referred to as whaling phishing, is a specific form of phishing attack that explicitly targets high-profile employees—CEOs, CFOs, or other executives (known as whales)—in order to steal sensitive information from a company. Executives/Whales can be either the target recipient or the spoofed origin of the phishing emails. Whales are carefully chosen due to their overall authority and access to secure company information. The goal of a whaling attack is to con the executive or employee into exposing corporate credentials, customer information or sending money via wire transfer.

How Do Whaling Attacks Work?

Whaling attacks work on the trust of executives and employees. When spammers impersonate an executive, an employee is unlikely to look deeper into the origin of the email and simply comply with the request. When spammers target an executive as the victim, the goal is to get access to the power of that executive: credentials, authorization of funds, even confidential information that only the executive can access.

Whaling attack emails and websites are highly customized and personalized, and they often incorporate the target’s name, job title, or other relevant information collected from a variety of sources. Due to this level of personalization and their highly targeted nature, whaling attacks are usually more difficult to detect than standard phishing attacks. Whaling phishing attacks rely on the same social engineering methods that traditional phishing uses, but in this highly targeted approach. Attackers will send hyperlinks or attachments to infect their victims with malware or to solicit sensitive information. By targeting high-value victims, fraudsters might also persuade them to approve fraudulent wire transfers using business email compromise techniques. In some cases, the attacker impersonates the CEO or other corporate officers to convince employees to carry out damaging financial transfers.

Examples of Whaling Attacks

Perhaps the most notable whaling phishing attack occurred in 2016 when a high-ranking Snapchat employee received an email from a fraudster impersonating the company’s CEO. The employee was duped into giving the attacker confidential employee payroll information. The FBI subsequently investigated the attack.¹

Another newsworthy whaling scam from 2016 involved a Seagate employee who unknowingly emailed the income tax data of several current and former company employees to an unauthorized third party. After reporting the phishing scam to the IRS and FBI, it was announced that thousands of peoples’ personal data was exposed in that whaling attack.²

How do you protect yourself?

Whaling phishing uses the same entry methods as traditional phishing methods: email, malware infected links and attachments, believable email addresses and well-replicated branding and logos. To protect yourself from whaling, you need to be vigilant with every email and mindful of the financial or privacy implications of any response, even to your CEO. We recommend improving both your information security awareness training and internal policies regarding financial and privacy data handling. For example, add a corporate policy to require verbal authorizations in addition to the original email for financial or privacy transactions. Many companies operate at break-neck speed, to protect your business, you often need to slow down and think through the implications of acting upon every emails.

As a corporate inbox provider, keeping up your incoming spam and malware filtering will help reduce the flow of potentially dangerous email, but it cannot prevent it. Setting up your inbound email services so that they provide DMARC reports on email received to the original senders. This information is invaluable to combating incoming spam and phishing attempts. Also, ensure your that your inbound email services support senders restrictive DMARC policies (Quarantine or Reject) and process non-DMARC compliant email appropriately. Rejecting email that is not DMARC compliant will greatly reduce the amount of spam and phishing attempts that arrive in your inboxes.

How do you protect your brand from being used in Whaling?

The trust your partners, vendors, and customers place in your email is directly related to the value of your email and the amount of spam, malware and phishing attacks that appear to come from your domain. You cannot prevent fraudsters from creating spam and impersonating your domain, but, you can stop the spam and phishing from affecting your reputation. To shutdown phishing that appears to come from your domain, you need to adopt DMARC for your outbound email and manage your DMARC compliance rate for outbound email. Once your legitimate email is compatible, you can start instructing inbox providers to quarantine or reject non-compliant email. At that point, the majority of non-compliant email should be spam and phishing attempts using your brand. Managing your email is not a set it and forget it strategy, but an on-going process that requires regular monitoring and update.

MxToolbox’s Delivery Center

MxToolbox Delivery Center provides you with everything you need to setup, monitor and manage your DMARC compliance. Email deliverability requires constant monitoring and tuning and MxToolbox has over 10 years experience working with companies large and small to improve email delivery. Delivery Center gives you insight into Who is sending email on behalf of your domain, How Much of your email is DMARC compliant, Where email threats are coming from, How to improve your email configuration and When to make your DMARC policies more restrictive to prevent phishing using your domain.

¹https://www.scmagazineuk.com/snapchat-whaled-employee-payroll-released/article/1478171

² https://krebsonsecurity.com/2016/03/seagate-phish-exposes-all-employee-w-2s/

MxToolbox Blog

Email Delivery Experts