Identifying "Spoofed" Websites
By Vince Barnes originate from:
http://www.htmlgoodies.com/
Are you certain that the site you are looking at
is what it appears to be? Is it coming
from the company it claims to?
The Crime
You click a link on a page or in an email you have received. And why not? The email is from the bank, it has their familiar logo and all their usual wording in it. The clicked link takes you to a page with the usual account login fields for you to put in you username and password. The URL up in the address bar is the usual URL for your on-line banking and so you're pretty comfortable. You type in your username and password but for some reason it doesn't take. You try again and you're logged in in the usual fashion and see all your account details. Everything is as it should be. Or is it?
Unfortunately, it is very possible that you have just become a victim of a crime involving a "spoofed" website address and the contents of all your bank accounts are now at risk. How does it work, and what can you do to protect yourself? Let's take a look.
The criminal starts by obtaining a legitimate email from the bank in question. This could have come from an actual account they or one of their associates opened, or it may have come from the email program in a lost or stolen notebook or home computer. They also copy the login page from the bank. Using phony ID they set up a site on a hosting company somewhere and put up the copy of the login page, but with some code written into it to capture the entered username and password and transfer the visitor to the legitimate login page.
Next, they send out the emails with some pretext that requires you to login and check something on your account. The emails have spoofed sender and return addresses so that they look like they came from the bank. The link in the email uses another spoofing technique to display the legitimate website address in the address bar and status bar of your browser while actually displaying the fake page. You click it, it takes you to the fake page, but everything looks normal to you. You type in your username and password; the fake page captures your identification and sends you over to the legitimate login page. Depending on the way the bank's site (or auction, or web payment or any other financially useful page) is constructed, it might also be possible for the fake page to pass your identification over to it so that it logs you right in without you having to type it a second time.
Article: Recognize phishing scams and fraudulent e-mail
Linear Mode
