Email hacking, attacks and defence today

The talk surveys the current email threat landscape, from the attacks that reach inboxes to the authentication standards meant to stop them. The speaker says spam volume has levelled off while phishing, especially targeted and AI-personalised lures, has become the main problem. Business email compromise and stolen Microsoft 365 logins or session cookies are highlighted as common routes into organisations.

A live demonstration types an SMTP session by hand, showing that the envelope sender and the visible From header are separate things. SPF is judged weak on its own because forwarding and mailing lists break it, and large cloud include records can authorise hundreds of thousands of addresses. DKIM protects message content, yet extra signatures can be attached to unsigned headers unless signed-header lists are enforced. DMARC ties the checks together, but a reject policy can drop legitimate mail. ARC is offered as a way for intermediaries to pass results along.

Practical advice covers senders and receivers alike: sign all outgoing mail with DKIM, publish a DMARC policy, consider DNSSEC for the records, and send bulk mail from separate address ranges. Receivers should not depend on SPF alone, should quarantine suspicious mail rather than block it, and should avoid breaking signatures at forwarding hops. The talk ends by pointing to standards groups and operator working groups as places to follow changes, since email still serves as a fallback identity for many accounts.