Protecting against spoofed email in alias/phrase field

Question

We have fully configured SPF, DKIM and DMARC policies (100% reject) for our email domain (e.g. spoofed.com), which is managed by gmail, but we have recently started seeing spear phishing emails with the following format (our email addresses/names have been sanitised):

From: Bob Smith Bob@spoofed.com <admin@inter-corp.net>
Date: Wed, Aug 26, 2020 at 10:02 AM
Subject: External legal counsel.
To: <tim@spoofed.com>

tim,

I am contacting you regarding a sensitive operation that I have approved and for which I need you to manage it, has Adv.Thomas Legler informed you about this case?


Best Regards,
Bob Smith

Sent from my iPhone

The email From: header is:

From: "Bob Smith Bob@spoofed.com" <admin@inter-corp.net>

So we can see that the Bob@spoofed.com "faked" email address that the phisher is trying to imitate is part of the email alias/phrase field. Such From headers might incorrectly lead recipients to believe the email has genuinely come from Bob@spoofed.com when in fact it's from admin@inter-corp.net.

Are there any further best practice protections we can put in place to avoid spoofed email addresses being included in the email alias in this way?

If any further headers are required please let me know.

Answer 1

DMARC (and SPF and DKIM, though those aren't strong enough to block with without DMARC) key solely on the domain in the address, not the free-form field known as Friendly From or Display Name (or Alias or Phrase). There is no such equivalent for Friendly From spoofing. (BIMI is an attempt at corporate logos, but that's again not Friendly From.)

For mailboxes you control, you can write a filter that kills these. I don't know GMail's options (start by enabling Gmail's advanced anti-phishing and malware settings), but using the F/OSS SpamAssassin software, you can write a rule like this:

header    MF_SPOOFED_SPOOFED_COM  From:name =~ /\@spoofed\.com\b/i
describe  MF_SPOOFED_SPOOFED_COM  https://security.stackexchange.com/a/237604/42391
score     MF_SPOOFED_SPOOFED_COM  10

I'm using the prefix MF_ because your Stack Exchange handle implies those are your initials. It's always good to take credit so you and your peers can troubleshoot what's going on when there's an issue.

For mailboxes you do not control, there's unfortunately nothing you can do to stop forgeries of your domain that do not use your exact domain in the From header address.