There’s spam going around where a “security researcher” will try to claim a security bounty due to you not having a reject dmarc record per below<\/p>
<\/p>
Greetings Team,<\/i><\/b><\/p>
I hope this finds you well!<\/i><\/i><\/b><\/p>
I am a professional freelance security researcher. I have taken the liberty of performing a cursory audit of your website’s public security configuration (the public-facing information for domain.com<\/strong><\/i>\u00a0and associated services), and have discovered a vulnerability that I believe you would appreciate being made aware of.<\/i><\/i><\/p> \u00a0<\/i><\/p> In the spirit of responsible disclosure, I have included a report for one of the issues below, detailing the exact nature of the vulnerability, and would greatly appreciate consideration for a bounty reward from your department if such is available. If I do not receive a response I may attempt to contact you again once or twice in an effort to ensure my message has reached you.<\/i><\/p> \u00a0<\/i><\/b><\/p> DESCRIPTION<\/i><\/b>:<\/i><\/b> DMARC record lookup and validation for domain.com\u00a0<\/i><\/i><\/p> \u00a0<\/i><\/p> “No DMARC Record found”<\/i> \u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Publish DMARC Record. (If not already published)<\/i><\/p> \u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Enable DMARC Quarantine\/Reject policy<\/i><\/p> \u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Your DMARC record should look like<\/i><\/p> “v=DMARC1; p=reject; sp=none; pct=100; ri=86400; rua=mailto:<\/i><\/b>info@domain.com<\/i><\/b>“<\/i><\/b><\/p> \u00a0<\/i><\/b><\/p> This can be done using any PHP mailer tool like this,<\/i><\/p> \u00a0<\/i><\/p> <?php<\/i><\/b><\/p> $to = “VICTIM@example.com<\/a>“;<\/i><\/p> $subject = “Password Change”;<\/i><\/p> $txt = “Change your password by visiting here – [VIRUS LINK HERE]”;<\/i><\/p> $headers = “From:\u00a0<\/i>info@<\/a>domain.com<\/a><\/i><\/b><\/p> mail($to,$subject,$txt,$headers);<\/i><\/i><\/b><\/p> ?><\/i><\/b><\/p> \u00a0<\/i><\/p> Impact<\/i><\/b>:<\/i><\/b> In the end, kindly keep me informed if you require me to send a forged email just when you relieve any doubts.<\/i><\/p> In addition to this<\/i><\/b>, let me tell you that this is not a scam,\u00a0and please don’t narrate this with fishing tactics, I am here suggesting certain changes that will save you from numerous forgeries.<\/i><\/p> \u00a0<\/i><\/b><\/p> Conclusion<\/i><\/b>:<\/i><\/b>\u00a0Wishing to receive a bounty for this responsible disclosure as a reward and I would like to serve you further reports in the near future if only you also wish the same.<\/i><\/p> There’s spam going around where a “security researcher” will try to claim a security bounty due to you not having a reject dmarc record per below Greetings Team,I […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3787,916],"class_list":["post-5649","post","type-post","status-publish","format-standard","hentry","category-research","tag-dmac","tag-spam"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t
<\/i><\/b>The issue I\u2019m going to discuss here is\u00a0<\/i>Domain Impersonation (Email- Spoofing)<\/i><\/b>. To demonstrate the authenticity of the issue I just sent a forged email to\u00a0<\/i>etestingconsultancy@gmail.com<\/a>\u00a0<\/i>that appears to originate from<\/i> info@domain.com .\u00a0<\/i><\/b>I was able to do this because of the following:<\/i><\/i><\/b><\/p>
And \/ Or
\u201cDMARC Quarantine\/Reject policy not enabled”
<\/i><\/p>
Recommended Fix:<\/b><\/i><\/p>
<\/i>These attacks may be used to launch phishing attacks so as to get information from users. In addition, these may be used to spam users with emails. Spoofed emails are also used to carry infections like Trojans to do harm to victim systems.
You can check your DMARC record at:\u00a0\u201chttps:\/\/mxtoolbox.com<\/a><\/b>\u201d\u00a0If you need any reference link to support this reported vulnerability, let us know and I will share It with you.
<\/i><\/p>
Many thanks!<\/b><\/i><\/p>