How did the UPS SPF scam work and what vulnerabilities did it exploit?

The UPS SPF scam was a multi-faceted attack that exploited vulnerabilities across several email authentication protocols. The core issue was UPS's overly permissive SPF record, which allowed Microsoft 365 users to send emails appearing to originate from @ups.com. This was compounded by Microsoft's failure to adequately verify domain ownership and prevent abuse. Gmail's display of BIMI logos based solely on SPF passing provided a false sense of security, while relaxed DMARC settings (or misconfiguration of DMARC alignment) allowed spoofed emails to bypass DMARC validation. The return path configuration, using a Microsoft IP covered by UPS's SPF record, further contributed to the success of the scam. The incident highlighted a known flaw in DMARC's reliance on SPF alignment and that the UPS security lapse happened despite repeated warnings about DMARC vulnerabilities. Fixes were swiftly implemented by both Gmail and UPS to address the exploit. Poorly implemented SPF records, generally, create easily abused mechanisms and should be avoided. DMARC relies on correct SPF and DKIM setup to be effective otherwise spoofing can happen.

The UPS SPF scam worked by exploiting a combination of factors: UPS had an overly permissive SPF record, allowing Microsoft 365 users to send emails appearing to be from @ups.com. Gmail displayed BIMI logos even when only SPF passed, which gave the spoofed emails a veneer of legitimacy. This, combined with relaxed DMARC settings, allowed phishers to send authenticated emails impersonating UPS. Subsequently, both Gmail and UPS implemented fixes to address the vulnerability.

The UPS SPF scam worked by exploiting several vulnerabilities. Microsoft's failure to prevent customers from using domains they don't own was a key enabler. UPS had an overly broad SPF record. This, combined with relaxed DMARC settings and how the return path was configured (using a Microsoft IP covered by UPS's SPF record), allowed spoofed emails to pass DMARC validation. Experts had warned about this DMARC hole for a while, but their warnings were ignored. Poorly implemented SPF records are a significant risk, and DMARC relies on proper SPF and DKIM setup; otherwise, it can fail to prevent spoofing. It was also lucky it was not worse.

The UPS SPF scam exploited vulnerabilities in email authentication protocols. While strong authentication aims to identify and stop spam and build trust, it was bypassed. The key issue was that DMARC checks were passing despite the spoofing. DMARC builds upon SPF and DKIM, but its effectiveness hinges on proper implementation. An overly broad SPF record at UPS allowed unauthorized servers to send emails as if they were from UPS. A narrower SPF record would have prevented the hack. The incident highlights a flaw in DMARC's implementation when SPF alignment is too relaxed, as detailed in IETF RFC 7489.