THE COST OF A STOLEN IDENTITY IS HIGH!

*By Francis Navarro, Komando.com**

**February 13, 2017*

*© Adrian Hughes | Dreamstime.com*

Email spoofing is one of the oldest spam techniques in the book. This is
when the headers of emails are forged to hide the real address of the
sender, with the aim of tricking people into clicking through them,
thinking they're from a trusted source.

Aside from spam and solicitation campaigns, spoofing is also widely used
in phishing and malware attacks so it's one security threat that you
will have to look out for.

Usually, an email service's junk filters do a great job of preventing
spoofed emails and spam from hitting a user's mailbox but of course,
there are various ways spammers will try and circumvent this.

One such technique, specifically affecting Google's Gmail, was recently
demonstrated by Renato Marinho, a security researcher from Morphus Labs.
According to Marinho, although Gmail's junk filter adequately blocks
most of the junk messages it deems as spam, it won't filter out spam
from a spoofed gmail.com address. These emails may appear to be coming
from a valid Gmail address but they are actually originating from
somewhere else.

*How it works*

In a LinkedIn post, Marinho listed the necessary steps his team took for
testing a successful Gmail spoof.

First, the spoofed email needs to appear to be coming from a valid and
working Gmail address, otherwise, it goes directly to the junk folder.
Second, the spammer's email server (the original source of the spoofed
email) must connect to Gmail stating that it wants to deliver a message
from said domain but internally, the spammer switches the sender address
to the fake Gmail address instead.

Gmail then asks the spam email's DNS server (again, controlled by the
spammer) to check if it can send messages on its behalf. The DNS server
says "yes," of course, and according to the security researcher, with
this validation, the spoofed email is delivered to the target's inbox
"with no security warnings, tagged with an important sign (if it's a
usual contact) and with the spoofed sender picture profile, increasing
its legitimacy."

READ MORE:
http://www.komando.com/happening-now/390113/top-story-gmail-spam-filters-fail-to-spot-fake-gmail-com-emails?utm_medium=nl&utm_source=notd&utm_content=2017-02-13-article-title



THE COST OF A STOLEN IDENTITY IS HIGH!
PROTECTION ISN'T:_http://idtJoin.frankcoleman.com
_