20 years on and email impersonation remains rife

Did you know that every October we celebrate the birthday of the original email? In October 1971, computer engineer Ray Tomlinson successfully managed, after several months of trying, to get an email message to send from one computer to another sat beside it via ARPANET, a network of computers that served as a precursor to the internet.

While email turns 46 years old this month, it was not until the commercialization of the internet in the mid-90s that it truly took off as one of the world’s preeminent communications tools. Unfortunately, its meteoric rise also spawned massive misuse as over-zealous marketers followed by unscrupulous scammers began peddling unwanted wares, bogus communiqués and even computer viruses, to the masses.

Yes, email scams are more than 20 years’ old. In fact, phishing scams — long associated with email — actually began a few years’ earlier via AOL instant messaging, with attackers posing as AOL staff and demanding that users verify their accounts by handing over passwords or billing information.

However, as email took over as the preferred means of customer/organization engagement, the scammers quickly switched over to exploit this channel. egold, a digital gold currency founded in 1996, was one such target for phishing exploits and financial malware while email scams were in their infancy. Attacks against the company culminated in a major phishing scam in June 2001 targeting members of its mailing list, followed post-9/11 by a second round of phishing, disguised as ‘identity checks’ following the attack on the Twin Towers.

Financial institutions were always an obvious target for the scammers; these organizations not only held rich datasets on their customers, but, if they could get hold of the customers’ account details, they could steal from them directly. No surprise then that the technique used in the e-gold phishing scam was quickly adopted for use against customers of other financial institutions.

eBay and PayPal were two other companies that found themselves on the wrong end of email scams a decade ago, and which are still battling it out to rid themselves of email impersonation today. Back in 2006 it was revealed that 75% of all phishing scams were focused on eBay and Paypal, with phishing emails taking recipients to imitation websites of eBay and Paypal, and using their login details to commit identity fraud.

Another popular victim of the email scam was HMRC. Not only was it a ‘trusted’ entity in the eyes of email recipients, but it could legitimately demand specific pieces of personal or financial information from recipients. It took HMRC until 2007 to publish its first guidance regarding phishing emails and bogus communications, which came in response to a spate of fraudulent emails advising recipients that, ‘After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of £210. Please submit the tax refund request and allow us 6–9 days in order to process it.’ (https://1.bp.blogspot.com/_PB5-El7se4s/R0RzpeQsCVI/AAAAAAAAESk/hi-rxA_KzUg/s400/scamhmrc.png)

The tactic adopted by these scammers was markedly different to some of those gone before; instead of scaremongering, the authors attempted to induce recipients into parting with their details based on the promise of a financial rebate. It was a highly successful change of approach that let to a major upsurge in HMRC-related scams, to the extent that by 2016, a Which? survey found that 40% of adults had received phishing emails purporting to be from HMRC.

In response to this, HMRC deployed email authentication protocol DMARC (Domain-based Mail Authentication and Reporting Conformance), which is globally acknowledged as the only way to guarantee the legitimacy of email ‘from’ addresses. In the same year as the Which? survey, HMRC was able to stop 300 million emails in 2016 simply by achieving DMARC protection.

So where does this leave us in 2017? Well, email security providers continue to try and block fraudulent messages from false domains that purport to be from some of our well-recognized companies, as well as attempting to identify more personalized, targeted attacks that seek out known customers of other, perhaps less prominent, organizations. But where these systems fail is in clamping down on email impersonation from legitimate email domains. www.gov.uk may now be safe from spoofing thanks to DMARC deployment, but the same cannot be said for the majority of legitimate private sector domains. 46 years since the first email, and more than 20 years from the first email scam, this blind spot in organizations’ email security defenses remains worryingly exposed.