A correspondent recently brought a peculiar email to my attention. And I thought it important enough to share with you.

This email purported to be from E-Gold, a financial service used by many people who wish to protect their privacy, and who simply prefer cold, hard cash. This email attempts to spoof the recipient into logging into what he believes to be E-Gold and giving his account number and password.

The Warning

This is not legitimate!

The message you might receive looks like this:

The text appears to be real. The links appear to be real. They are not. Disregard this message. Do not click the links. The real E-Gold site has a notice to report possible spoofing to them at: ddu@e-gold.com.

The Details

This spoof exploits email clients which display HTML code. The visible text of the hyperlinks is correct for E-Gold, but the underlying HTML code actually links to a different site. Specifically, clicking the links in an HTML-enabled email program will direct you to www.e-gold.cc versus the correct E-Gold site which is www.e-gold.com. If you use MS Outlook, float your mouse pointer over hyperlinks without clicking; you'll get a pop-up flag that will display the actual coded URL. If it doesn't match the text, you have problems.

I highly recommend that you disable HTML in your email program. It makes you vulnerable to this type of spoofing, and also allows hostile scripts and programs to execute automatically; this is how the Klez worm propagates, for instance. (Make sure you have a good anti-virus program, too.)

This spoof report also relates to web browsers. When I investigated the fraudulent site, using Opera 6.01, my browser detected a flaw in the site's certificate chain. My correspondent reported that MS Internet Explorer 6, with all updates, did not alert him.

Protecting Yourself

So how do you avoid these problems?

Email

Don't use MS Outlook in any of its incarnations.
Whatever client you use, disable HTML.
Be suspicious whenever someone wants personal data, especially if it involves passwords and/or money.

It also wouldn't hurt to be aware of email headers. The spoof email appeared to be from E-Gold. That's what the From: field said. But...

Here's a message that appeared in my In-Box as I prepared this article:

Wheee! Sounds good, doesn't it? Too bad it isn't real; I sent it to myself, faking some of the header data, which most folks set their clients to ignore. Take a look at the headers on this bit of wishful thinking:

The return path and from fields still appear to be from ol' Dubya. But take a closer look at the Received field, third line down. Says there that this message originated from surfbest.net. How likely is it that the White House is using that commercial mail server?

Of course, spammers routinely spoof that field, too. You can generally spot that by looking at the IP address in brackets (in this case: [68.130.119.81]). If the field had been spoofed, you'd probably see something like this:

Generally speaking, if the address domain name doesn't match the SMTP domain name, you might want to be careful. But...

Many people, myself included, use an email redirect service. I use bussjaeger@free-market.net as my permanent address; mail coming in to that address gets redirected by the Free-Market server to whatever account In-Box I find convenient at the time. I can change ISPs and mail accounts at will without having to change my address. A mail from me will have a header of this sort:

So mismatches aren't always nefarious. I could set my client to show the "real" address associated with that account, but when I was configuring the program, it was convenient to cut and paste the Free-Market address in both fields.

Web Browsers

Be aware of the URL displayed in your browser's address field. Is it showing what you expected? In this spoof, the .com was replaced with .cc; that makes a world of difference.
If you're visiting a site which should be secure, is it? Most browsers use a little padlock icon to indicate the security level. In Opera, floating your mouse pointer over the padlock will give you information on the certificate and encryption. In IE, right click on the web page, select properties, and click the Certificates button.

Common Sense

Most of all, to protect yourself, you just need to follow normal precautions. If someone called you on the phone claiming to be from your bank, you wouldn't give him your account number and debit card PIN. If you hopped into a taxi and asked to go to East Peach Street, you'd notice if the cabbie headed toward West Peach, right? Exercise the same kind of care on-line. You don't need to be paranoid, just be aware of oddities.

Don't get spoofed.