Address Spoofing

HowStuffWorks.com
Address spoofing is the most common trick phishers use to gain information.

The more complex a Web browser or e-mail client is, the more loopholes and weaknesses phishers can find. This means that phishers add to their bags of tricks as programs get more sophisticated. For example, as spam and phishing filters become more effective, phishers get better at sneaking past them.
The most common trick is address spoofing. Many e-mail programs allow users to enter their desired information into the "From" and "Reply-to" fields. While convenient for people who use multiple e-mail address, this makes it easy for phishers to create messages that look like they came from a legitimate source. Some e-mail servers also allow computers to connect to the simple mail transfer protocol (SMTP) port without the use of a password. This allows phishers to connect directly to the e-mail server and instruct it to send messages to victims.
Other tricks include:

• Obfuscated links. These URLs look real but direct the victim to the phisher's Web site. Some obfuscation techniques include:
  • Using misspelled versions of the spoofed company's URL or using international domain name (IDN) registration to re-create the target URL using characters from other alphabets.
  • Including the targeted company's name within an URL that uses another domain name.
  • Using alternate formats, like hexadecimal, to represent the URL.
  • Incorporating instructions for redirection into an otherwise legitimate URL.
  • Using HTML to present links deceptively. For example, the link below looks like it goes to a section of "How Spam Works" that explains zombie machines, but it really directs your browser to an entirely different article on zombies. http://computer.howstuffworks.com/spam4.htm
• Graphics. By determining which e-mail client and browser the victim is using, the phisher can place images of address bars and security padlocks over the real status and address bars.
• Popup windows and frames. Malicious popup windows can appear over the site, or invisible frames around it can contain malicious code.
• HTML. Some phishing e-mails look like plain text but really include HTML markup containing invisible words and instructions that help the message bypass anti-spam software.
• DNS cache poisoning. Also called pharming, this is when a phisher (often by speaking to customer service representatives) changes DNS server information. This causes everyone trying to reach the spoofed company's Web site to be directed to another site. Pharming can be hard to detect and can ensnare multiple victims at once.

Phishers can use proxy computers situated between the victim and the site to record victims' transactions. They can also take advantage of poor security at a company's Web page and insert malicious code into specific pages. Phishers who use these methods don't have to disguise their links because the victim is at a legitimate Web site when the theft of their information takes place.

Phishers also use malicious programs in their scams:

• Key loggers and screen capture Trojans record and report information to the phisher.
• Remote access Trojans turn victims' computers into zombies -- machines phishers can use to distribute more phishing e-mail or host phishing Web pages.
• Bots maintain fabricated conversations with victims in chat rooms or coordinate zombie networks.
• Spyware tracks and records users' online behavior, which can help phishers plan other attacks.