A guide to detecting DMARC problems using the pentesting techniques
by DuoCircle
While DMARC has proven its ability to keep spoofing and phishing attacks at a distance, DMARC records can have errors and misconfigurations. So, if you are seeing multiple instances of false positives, false negatives, delivery issues, etc., then it’s suggested that you check your DMARC record to see if it has issues. This can be done by running your DMARC TXT record through an online lookup tool. You can also come across errors and misconfigurations using penetration testing.
DMARC is based on three policies: none, quarantine, and reject. As a domain owner, you have the choice to apply one of these three policies for illegitimate emails sent from your domain. However, sometimes, receiving servers don’t respect the policy you applied; they adjust the policy according to what seems to be better for the emails sent from your domain.
Microsoft’s recent updates empower domain owners to combat modern phishing attacks using DMARC
by Duocircle
Microsoft has always encouraged domain owners to deploy DMARC to improve email deliverability and prevent spoofing. It has also been part of industry groups that aim to improve email security standards, demonstrating its endorsement of DMARC as part of the future of secure communication.
We’re back with the latest cybersecurity updates to inform you about recent threats and help you stay protected. This week, we’ll dive into how hackers are exploiting Versa Director through a critical vulnerability, the supply chain attack linked to Hezbollah device explosions, a zero-click vulnerability in MediaTek Wi-Fi chipsets, Transport for London’s (TfL) data breach affecting 5,000 customers, and the latest campaign by the North Korean-linked group Gleaming Pisces using poisoned Python packages to deliver backdoors. Let’s explore the news descriptions provided below!
Deciphering DMARC reports is complex as it requires understanding the XML structure and key components within the report. You have to analyze the IP address and understand the failures. Here’s a step-by-step guide on how you can go about it.
Understanding the process and importance of hashing in DKIM
by Duocircle
DKIM was created in 2005 to help recipients determine if someone has tampered with the email content in transit. The protocol is broadly based on the concept of cryptography, which ensures the authenticity and integrity of an email message by using a public key to sign the outgoing emails for your domain. In DKIM, hashing is an important step in creating a secure signature for email integrity and authentication. Let’s see how hashing works.
Lately, DMARC adoption has been reflecting an upward trend, underscoring the increasing awareness about email security, especially after Google and Yahoo’s announcements. Roughly 20 million domains are already using DMARC, although many users are still stuck at the p=none policy, which is like moving two steps forward and one step back.
Did you know how cyberspace unfolded this week? Here we are to inform you about this week’s most talked-about news and updates, curated and designed for you. We have covered topics around cybersecurity attacks, advisories, and other security-related updates. Some of these topics are related to leveraging cloud solutions in creating and maintaining access control, the FOCAL plan of CISA to safeguard an organization’s security posture, Chrome users being targeted to reveal account credentials, CISA’s addition of two new CVEs to the list, Fake and fraudulent live streaming websites exposed, and many more.
Phishing attack on 23rd US-Taiwan Defense Conference averted!
by Duocircle
In a recent turn of events, threat actors have been trying to target a US-Taiwanese defense conference. The meeting is going to be held in Philadelphia’s Logan Square neighborhood. Press entry will not be allowed in the meeting. Eminent speakers from different sectors, such as commerce, defense, academia, and government, will be attending the 23rd defense conference. The agenda of the meeting is to discuss the ‘future of US defense cooperation with Taiwan, the defense procurement process, and Taiwan’s defense and national security needs.’
Best practices for sending bulk emails on Gmail: A detailed guide
by Duocircle
Reaching out to your target audience in today’s highly competitive time requires not only great skills but a fail-proof strategy as well. Sending bulk emails is one such surefire strategy that enables you to reach out to a large audience with your brand message. However, if you fail to adhere to Gmail policies and local regulations, your emails can soon turn out to be spammy. When you follow the right practices, it guarantees that your emails will reach the right inboxes and resonate with your audience. Also, you won’t be easily marked as a spammer!
We are excited to announce that DuoCircle has acquired Maysoft’s SpamSentinel and Verisend products, a trusted name in email security for over twenty years. This partnership represents a new chapter for Maysoft’s customers, bringing an exciting upgrade in email protection and access to DuoCircle’s world-class customer support and services.
At DuoCircle, we have built a strong reputation for helping businesses stay secure with advanced email filtering and phishing protection. By welcoming Maysoft’s customers into the DuoCircle family, we are thrilled to provide the same level of care, combined with enhanced security features, ensuring your continued email protection is stronger than ever.
What This Means for Maysoft Customers
24/7 Technical Support: Maysoft customers will now benefit from DuoCircle’s renowned 24/7 technical support. Our team is available at any time to help with any questions or concerns, providing you with uninterrupted service and peace of mind.
Enhanced Phishing Protection and Email Filtering: As part of DuoCircle’s platform, Maysoft customers will enjoy upgraded email filtering and advanced phishing protection. This upgrade will bolster your defenses against email threats like phishing, spam, and malware.
Seamless Migration to Cloud Services: Maysoft’s on-premise customers will have the opportunity to transition to DuoCircle’s secure, cloud-based infrastructure. Our goal is to ensure that this migration is smooth, providing enhanced long-term security with minimal disruption.
A Partnership Built on Trust and Proven Solutions
Maysoft has been diligently testing DuoCircle’s platform over the last six months to ensure that this transition is seamless and beneficial for all customers. The result is a solid partnership that blends Maysoft’s trusted service with DuoCircle’s robust technology, offering you even greater protection and reliability.
We are committed to upholding the values and trust that Maysoft has established with you over the years, while also delivering the added benefits of DuoCircle’s enhanced security platform. We look forward to serving you as part of the DuoCircle family, with even stronger email security and support.
Stay tuned for more updates, and welcome to DuoCircle!
With the passing of time, cybersecurity threats are getting more sophisticated. That’s exactly why businesses and individuals must understand the nuances of cybercrimes closely. The two most common forms of cyberattacks are phishing and spoofing. In layman’s terms, people often overlap the two. However, each has a set of distinct characteristics and methods of operation.
Mustang Panda Exploits, White House Roadmap, Scaling Compliance Reciprocity- Cybersecurity News [September 09, 2024]
by Duocircle
Let’s talk bout this week’s most talked-about cybersecurity news and updates, crafted to keep you updated on recent happenings. We have covered topics around cybersecurity attacks, advisories, and other relevant updates. These topics consist of the Chinese APT groups leading espionage campaigns, an initiative taken by White House to safeguard internet routing security, a suggestion to streamline compliance across global industries, Apple’s latest launches and AI-driven updates, and last but not least, Google Maps’s new feature to blur your home images online.
DKIM is a cryptography-based email authentication protocol that ensures that only authorized people send emails on your behalf and that nobody changes the content of the message in transit. Salesforce highly encourages its users to deploy SPF, DKIM, and DMARC to protect their domain and email receivers from getting duped. Salesforce has also made it quite straightforward to integrate and configure DKIM so that most of your outgoing emails land in the inboxes of recipients and not their spam or junk folders. With DKIM, the chances of your emails getting marked as spam go down significantly.
Phishing attacks are gradually becoming commonplace. This is evident from the fact that around 94% of firms experienced phishing attacks in 2023. With time, threat actors have been able to make these attacks more sophisticated and credible. FBI’s Internet Crime Center gets the highest number of complaints of phishing attacks every year.
TLS, which is short for Transport Layer Security, is an email security protocol based on cryptography. It facilitates the end-to-end security of data transmitted between applications over the Internet. Most people know it as the padlock icon that appears in web browsers when a secure session is established. But there is more to it—it’s also used in emails, file transfers, video and audio conferencing, instant messaging, and voice-over IP. The overall aim of the TLS is to add an extra layer of security, preventing threat actors from hijacking connections between internet-enabled devices. It lets you know whether the person you are communicating with is actually who they are claiming to be.
With an ROI of $36 for every $1 spent, email marketing’s benefits are clear. Despite this, less than a quarter of marketers would say their email marketing strategy was “very successful.”
OTP Theft Guilty, Social Media Exploits, APT29 Targets Mobile – Cybersecurity News [September 02, 2024]
by Duocircle
We’re back to provide you with the latest cybersecurity news of the week, designed to keep you informed and secure against evolving threats. This week, we highlight the final verdict of an OTP theft case relating to 1-Time Passcode, a loophole in the financial system aided via social media platforms, Android and iOS users attacked by Russian hackers, a more personalized approach towards social engineering techniques, the role of CISOs in curating business strategies and finally the concerns associated with encryption policies amidst Telegram founder’s indictment.
Troubleshoot DMARC problems for Google Workspace domains
by Duocircle
Google Workspace encourages domain owners to use the three email authentication protocols, SPF, DKIM, and DMARC, to ensure outgoing emails are properly authenticated. This reduces the security gaps; otherwise, threat actors can exploit them to send phishing and spoofing emails from your domains. Moreover, from February 2024, Google has mandated DMARC deployment for regular and bulk email senders, urging domain owners or administrators to create a DMARC record in their DNS settings and specifying policies to handle emails that fail SPF and/or DKIM checks.
How do you receive DMARC reports on external email addresses?
by Duocircle
While most domain owners prefer receiving DMARC aggregate and forensic reports on internal email addresses, some want to have them in external inboxes. Internal email addresses refer to those belonging to the same domain for which the DMARC record is created. For example, if your organization’s domain is example.com, then an internal domain email address would be something like employee@example.com. On the other hand, external email addresses are the ones not belonging to that domain. For example, department@otherdomain.com.
![Versa Networks Flaw, Hezbollah Supply Chain, MediaTek Wi-Fi Vulnerability – Cybersecurity News [September 23, 2024]](https://www.duocircle.com/wp-content/uploads/2024/09/spf-validator-8.jpg)
![Operational Cybersecurity Alignment, Chrome Credential Threats, CISA CVEs Update – Cybersecurity News [September 16, 2024]](https://www.duocircle.com/wp-content/uploads/2024/09/spf-permerror-7.jpg)
![Mustang Panda Exploits, White House Roadmap, Scaling Compliance Reciprocity- Cybersecurity News [September 09, 2024]](https://www.duocircle.com/wp-content/uploads/2024/09/spf-permerror-4.jpg)
![OTP Theft Guilty, Social Media Exploits, APT29 Targets Mobile – Cybersecurity News [September 02, 2024]](https://www.duocircle.com/wp-content/uploads/2024/09/spf-permerror-1.jpg)
