In-Reply-To: <20050325202052.15663.qmail (at) www.securityfocus (dot) com [email concealed]>
Mr Roberto managed to change email headers ? ?from address?.
Security Professionals know the email headers can't be trusted and can be easily forged.
Most Outlook users *do not*.
The ?signed by? and the certificate signer remain valid ? so its issue of educating users to look at the "signed by" field , and not the from address.
This "Feature / Flaw" can be the source of some problematic phishing scams:
if i buy a certificate for some-user (at) company (dot) com [email concealed]
and send a forged email with "from" helpdesk (at) company (dot) com [email concealed], signed by that some-user (at) company (dot) com [email concealed]
I'm sure it can get the passwords from most of the users.
I'm sure some ppl will take this further and we are going to see this trend in phishing evolving quickly.
Mr Roberto managed to change email headers ? ?from address?.
Security Professionals know the email headers can't be trusted and can be easily forged.
Most Outlook users *do not*.
The ?signed by? and the certificate signer remain valid ? so its issue of educating users to look at the "signed by" field , and not the from address.
This "Feature / Flaw" can be the source of some problematic phishing scams:
if i buy a certificate for some-user (at) company (dot) com [email concealed]
and send a forged email with "from" helpdesk (at) company (dot) com [email concealed], signed by that some-user (at) company (dot) com [email concealed]
I'm sure it can get the passwords from most of the users.
I'm sure some ppl will take this further and we are going to see this trend in phishing evolving quickly.
Dori Fisher,
We! Consulting group.
[ reply ]