@remit/mailbox-service 0.0.47 → 0.0.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.47",
+  "version": "0.0.48",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/heuristics/classifyByHeaders.ts

@@ -95,7 +95,11 @@ export const classifyByHeaders = (parsed: ParsedMail): Category => {
 	if (matchesPrecedence(headers)) return MessageCategory.automated;
 	if (isMachineSender(parsed, lines)) return MessageCategory.automated;
 
-	if (fromDomain && dkimMismatchResult(headers, lines, fromDomain).mismatch) {
+	if (
+		fromDomain &&
+		pickAlignedOrFirstMismatch(extractDkimDomains(headers, lines), fromDomain)
+			.mismatch
+	) {
 		return MessageCategory.automated;
 	}
 
@@ -126,15 +130,12 @@ export const extractAuthenticity = (
 	const dkimDomains = extractDkimDomains(headers, lines);
 	if (dkimDomains.length === 0) return null;
 
-	const result = dkimMismatchResult(headers, lines, fromDomain);
-
-	// Pick the reported domain: first mismatching one on mismatch, first domain otherwise.
-	const reportedDomain = result.mismatchingDomain ?? dkimDomains[0];
+	const picked = pickAlignedOrFirstMismatch(dkimDomains, fromDomain);
 
 	return {
 		fromDomain,
-		dkimDomain: reportedDomain,
-		dkimMismatch: result.mismatch,
+		dkimDomain: picked.domain ?? undefined,
+		dkimMismatch: picked.mismatch,
 	};
 };
 
@@ -296,38 +297,34 @@ const domainMatches = (
 };
 
 /**
- * Check whether DKIM signing domain(s) align with the From domain and
- * return a structured result so both the category heuristic and the
- * authenticity extractor share the exact same alignment logic.
- *
- * Alignment: signing domain equals From domain, or one is a subdomain of
- * the other (parent/child). Any single aligned domain is enough to consider
- * the message non-mismatching — a legitimate re-mailer signing under a
- * subdomain is not suspicious.
- *
- * On mismatch the first non-aligned domain is reported so the UI can show
- * "signed by relay.example.net, claims example.com".
+ * Whether a signing domain aligns with the From domain: equal, or one is a
+ * subdomain of the other (parent/child). A legitimate re-mailer signing under
+ * a subdomain is not suspicious, so either direction counts as aligned.
  */
-const dkimMismatchResult = (
-	headers: Headers,
-	lines: HeaderLines,
+const domainsAligned = (signingDomain: string, fromDomain: string): boolean =>
+	signingDomain === fromDomain ||
+	fromDomain.endsWith(`.${signingDomain}`) ||
+	signingDomain.endsWith(`.${fromDomain}`);
+
+/**
+ * Pick the domain to report out of a list of candidate signing domains: the
+ * first one aligned with the From domain, so a legitimate signature is never
+ * shadowed by an earlier unrelated one. When none align, the first is
+ * reported as the mismatching evidence — the UI can then show "signed by
+ * relay.example.net, claims example.com". Shared by the category heuristic
+ * (rule 9, which reads only `.mismatch`) and the authenticity extractor
+ * (which also reads `.domain`), so the two can never disagree.
+ */
+const pickAlignedOrFirstMismatch = (
+	domains: string[],
 	fromDomain: string,
-): { mismatch: boolean; mismatchingDomain: string | null } => {
-	const dkimDomains = extractDkimDomains(headers, lines);
-	if (dkimDomains.length === 0)
-		return { mismatch: false, mismatchingDomain: null };
+): { mismatch: boolean; domain: string | null } => {
 	let firstMismatching: string | null = null;
-	for (const d of dkimDomains) {
-		if (
-			d === fromDomain ||
-			fromDomain.endsWith(`.${d}`) ||
-			d.endsWith(`.${fromDomain}`)
-		) {
-			return { mismatch: false, mismatchingDomain: null };
-		}
+	for (const d of domains) {
+		if (domainsAligned(d, fromDomain)) return { mismatch: false, domain: d };
 		if (!firstMismatching) firstMismatching = d;
 	}
-	return { mismatch: true, mismatchingDomain: firstMismatching };
+	return { mismatch: firstMismatching !== null, domain: firstMismatching };
 };
 
 const extractDkimDomains = (headers: Headers, lines: HeaderLines): string[] => {

package/src/heuristics/senderMismatch.test.ts

@@ -87,6 +87,28 @@ describe("classifyDisplayNameCorrespondence", () => {
 			DisplayNameCorrespondence.Unrelated,
 		);
 	});
+
+	// Live phishing shape: a short, valuable brand name embedded as a
+	// coincidental substring of a longer, attacker-chosen domain. "ing" sits
+	// inside "secureingverify" the same way "irs"/"dhl"/"ups"/"kpn" sit inside
+	// countless lookalike domains — none of that is the domain naming the
+	// brand.
+	it("does not match a short brand name that is merely embedded in a longer domain label (ING)", () => {
+		assert.equal(
+			classifyDisplayNameCorrespondence(
+				"ING Fraudedesk",
+				"secure-ing-verify.tk",
+			),
+			DisplayNameCorrespondence.Unrelated,
+		);
+	});
+
+	it("still matches a short brand name against its own real domain", () => {
+		assert.equal(
+			classifyDisplayNameCorrespondence("ING", "ing.nl"),
+			DisplayNameCorrespondence.Corresponds,
+		);
+	});
 });
 
 describe("extractOffDomainLinkDomains", () => {

package/src/heuristics/senderMismatch.ts

@@ -90,11 +90,22 @@ const lookalikeThreshold = (length: number): number => {
 /**
  * Whether the From display name corresponds to the From domain.
  *
- * Containment decides: the normalised name, or any word of it, appearing inside
- * the registrable domain or one of the domain's labels. `GitHub` sits inside
- * `notifications.github.com`; `InfoMedics` sits nowhere inside
+ * Containment decides: the normalised name, or any word of it, containing an
+ * entire domain candidate. `GitHub` contains the label `github` from
+ * `notifications.github.com`; `InfoMedics` contains no label of
  * `serviceupdatebank.atlassian.net`.
  *
+ * Only that direction counts — a domain candidate containing the (shorter)
+ * name does not. `ING Fraudedesk` is not a match for `secure-ing-verify.tk`
+ * just because the three-letter word "ing" sits inside "secureingverify":
+ * that is a coincidental substring of a longer label the domain owner chose,
+ * not a domain that names the brand. The direction this drops is exactly the
+ * one a short, valuable brand name is deliberately embedded into a longer,
+ * unrelated-looking domain to exploit — the live Dutch-bank shape this was
+ * fixed against (`ING`). A real short brand over its own domain (`ING` /
+ * `ing.nl`) still matches: name and label are then equal, and equality
+ * satisfies containment in either direction.
+ *
  * A bounded edit distance is the secondary test, and only reaches names that
  * nearly match a label — `InfoMedics` against `1nfomedics.nl`. It cannot promote
  * an unrelated name on its own.
@@ -117,7 +128,7 @@ export const classifyDisplayNameCorrespondence = (
 	const terms = [name, ...words(raw)];
 	for (const term of terms) {
 		for (const candidate of candidates) {
-			if (candidate.includes(term) || term.includes(candidate)) {
+			if (term.includes(candidate)) {
 				return DisplayNameCorrespondence.Corresponds;
 			}
 		}