Spoofing

Spoofi ng is sending email that appears to come from one sender but has actually been sent by another.

If a company’s mail server allows connections to the SMTP port, anyone can connect to that port and send email that appears to be from an address on that site; the address can be a genuine email address or a fi ctitious address. This is called “spoofi ng”.

Spoofi ng can be put to a number of malicious uses.

Phishers, criminals who trick users into revealing confi dential information, use spoof sender addresses to make it appear that their email comes from a trusted source, such as your bank. The email can redirect you to a bogus website (e.g. an imitation of an online banking site), where your account details and password can be stolen.

Phishers can also send email that appears to come from inside your own organization, e.g. from a system administrator, asking you to change your password or confi rm your details.

Criminals who use email for scams or frauds can use spoof addresses to cover their tracks and avoid detection.

Spammers can use a spoof sender address to make it appear that an innocent individual or company is sending out spam. Another advantage for them is that they are not inundated with non-delivery messages to their own email address.

You can avoid spoofi ng in various ways.

You can confi gure your mail system to prevent anyone from connecting to your SMTP port.

You can also use encryption to send authenticated email. This ensures that messages come from the senders they appear to be from, and that the message has not been modifi ed.

Ensure that your mail delivery system allows logging and is confi gured to provide suffi cient logging to assist you in tracking the origin of spoofed email.

Consider a single point of entry for email to your site. You can implement this by confi guring your fi rewall so that SMTP connections from outside your fi rewall must go through a central mail hub. This will provide you with centralized logging, which may assist in detecting the origin of mail spoofi ng attempts to your site.

Sophos.com