Cloud

3/21/2018
09:30 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Tax Software Providers Not Protecting Emails from Phishing and Spoofing

Half of Top 8 Tax Software Providers Leave Consumers Vulnerable to Email-Borne Attacks That Can Lead to Identity and Bank Account Theft Customers of H&R Block, TaxAct, Turbo Tax and Free Tax USA Most Susceptible

WASHINGTON, March 14, 2018 — Only half of the top tax software providers are using the most basic of email protections to secure communications with customers, according to new research from the Global Cyber Alliance. Tens of millions of American will use tax software to prepare their federal and state taxes, yet some of the industry’s biggest names — H&R Block, TaxAct, Turbo Tax and Free Tax USA — are not preventing their email domains from being hijacked to trick consumers into sharing sensitive data that could include social security numbers, bank account numbers and dates of birth.

In an examination of the top 8 tax software providers, only Liberty Tax Online is using the highest level of email-authentication security — the Domain-based Message Authentication Reporting & Conformance (DMARC) protocol — to prevent delivery of spoofed email. Three others — Credit Karma, Jackson Hewitt and Tax Slayer — are using the second-highest level of DMARC protection that marks spoofed email as spam. TurboTax and Free Tax USA have begun to deploy DMARC, but it is not yet set up to protect consumers from email that pretends to be from the tax providers. H&R Block and TaxAct USA have not initiated any DMARC deployment.

DMARC weeds out fake emails (known as direct domain spoofing) deployed by spammers and phishers targeting the inboxes of any person with an email address.  According to the 2017 Symantec ISTR report, 1 in 131 emails contained malware, the highest rate in 5 years.

The IRS warned tax providers in 2017 that they were “increasingly the targets of national and international cybercriminal rings.”  With the incidents of phishing to continuing to rise, individual consumers are also at risk of being attacked through email which appears to come from their tax software providers.

“Consumers are accustomed to inputting the most sensitive and personal information -- from social security numbers to financial information and health care expenses – into tax preparation software,” said Philip Reitinger, President and CEO of the Global Cyber Alliance. “The very nature of a consumer’s relationship with a tax provider makes it seem legitimate to receive emails that may ask for additional personal information, putting consumers at great risk from phishing scams that appear to involve tax providers. Companies need to provide the maximum protections.  There appears to be a hole in the protections provided by some of the leading tax software providers – a hole that could be fixed by deployment of DMARC at its strongest level.”

Without DMARC protections, hackers can create emails that appear to be from a trusted source but contain malicious links or ask for additional information that could be provided by unsuspecting consumers.

The Data

Using GCA’s DMARC tools, the researchers could determine how far organizations were in the process of implementing DMARC.

 

 

DMARC Count

Effect at this level of implementation

Domains Tested

8

Based on PC Magazine Rankings of the Top 8 Tax Software Providers

Reject

·        Liberty Tax

The highest level of DMARC protection. If reject is in place, incoming messages that fail authentication get blocked.

Quarantine

  • Credit Karma
  • Jackson Hewitt
  • Tax Slayer

 

 

The second highest level of DMARC protection. With quarantine in place, emails that don’t meet the policy are sent to the spam or junk folder.

None

  • Free Tax USA
  • Turbo Tax

None means that the DMARC policy is in place, but the only thing that’s happening is monitoring. No action is being taken to block spoofed emails. 

No Policy

  • H&R Block
  • TaxAct

 

No policy means that DMARC is not in place. 

 

Steps Consumers Can Take to Protect Themselves

Consumers need to remain vigilant to prevent being scammed through email:

1.      Always scroll over the sender’s email address to ensure that the address is legitimate. Often, the address looks correct until you scroll over it with your mouse to reveal a totally different address.

2.      Do not click on embedded links in emails. Type the address into your browser’s address bar if you want to go to a site.

3.      Do not email personal or sensitive information. Your tax software provider will always require you to input the information in secure fashion by logging into your account.

4.      Do not call any customer service phone numbers you see in an email. Go to the vendor’s official site and login and double check the customer service phone numbers.

5.      Install a DNS security solution that will help to block malicious web site links should a phishing email make it to your inbox. One such solution – Quad9 – is free and can be installed in minutes. Learn more at Quad9.net.

GCA has published four reviews of DMARC implementation – two looking at organizations in cybersecurity, one looking at banks, and another examining public and private hospitals.

For more details about DMARC or to check if an organization is using DMARC, visit: https://dmarcguide.globalcyberalliance.org/#/

About the Global Cyber Alliance

The Global Cyber Alliance (GCA) is an international, cross-sector effort dedicated to confronting cyber risk and improving our connected world. It is a catalyst to bring communities of interest and affiliations together in an environment that sparks innovation with concrete, measurable achievements. While most efforts at addressing cyber risk have been industry, sector, or geographically specific, GCA partners across borders and sectors. GCA’s mantra “Do Something. Measure It.” is a direct reflection of its mission to eradicate systemic cyber risks.

 

GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney’s Office, the City of London Police and the Center for Internet Security. Learn more at www.globalcyberalliance.org.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Diversity: It's About Inclusion
Kelly Jackson Higgins, Executive Editor at Dark Reading,  4/25/2018
Coviello: Modern Security Threats are 'Less About the Techniques'
Kelly Sheridan, Staff Editor, Dark Reading,  4/24/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.