End-to-End Measurements of Email Spoofing Attacks
summary
Blackbox end-to-end tests scan Alexa domains and send 52,500 spoofed messages to measure real delivery and UI cues, focusing on SPF/DKIM/DMARC records and using a tracking pixel plus an MTurk phishing test. Results show 35 popular providers let many forgeries through: Gmail 53% penetration, Yahoo 35%, iCloud 7%, Hotmail blocks all; SPF adoption ≈50% (strict 15%), DMARC ≈5% (strict 1%), 9/35 providers show visual warnings, 408 users yield click rates 26% no-warning vs 17% warning.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:47Real-life Spear Phishing Examples
- 2:20Background: SMTP & Spoofing
- 3:19Existing Anti-spoofing Protocols
- 7:35End-to-end Spoofing Experiments
- 8:41Controlled Parameters for Spoofing Emails
- 11:16Impacting Factors
- 13:08How Do Email Providers Give Warning
- 15:01Phase 1/2: Set Up Deception
- 15:32Phase 2/2: Sending Actual Spoofing Emails
- 16:53Deception User Study: Results
related talks
44mModern Email Security
22mNot that Simple: Email Delivery in the 21st Century
44mSecurely Sending Email in 2024
56mEmail vs Capitalism, or, Why We Can't Have Nice Things
20m"Return to Sender: Bypassing Email Spam & Malware Filters"
31mHow to Write Terrible Emails Well?
12m"I don’t know why I check this...'' Investigating Expert Users' Strategies to Detect...
47mHow to Detect Your Domains Being Abused for Phishing Using DNS