China solar cell makers seek Taiwan partnerships http://t.co/p5Hh7kJD
21 minutes ago by Export2China on twitterZDNet / Techguide / Internet Security
A practical example of why HTML e-mail is a bad idea
Summary
Viewing e-mail messages without rendering HTML formatted content can be a simple, easy, and effective security technique.
Topics
spam email, science and technology, paypal, technology, computer technology, computer security, crime and law, identity theft, crime, computer crime
Events
Echelon 2012
June 11 and 12, 2012
University Cultural Centre, National University of Singapore
Startup Asia Jakarta 2012
June 7 and 8, 2012
12th Floor, Annex Building, Wisma Nusantara Complex, Jl. M.H. Thamrin No. 59 Jakarta 10350, Indonesia
MMA Forum Singapore
April 23-25, 2012
Grand Hyatt Singapore
I received a phishing e-mail the other day, and it reminded me why I use mutt as my mail user agent.
The headers and text of the email look like this:
Delivered-To: unknown
Envelope-to: me@example.com
Delivery-date: Wed, 11 Feb 2009 09:45:07 -0700
Reply-To:
From: "service@paypal.com"
Subject: Account Expired ! Please renew your account !
Date: Wed, 11 Feb 2009 11:48:20 -0500
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
X-OriginalArrivalTime: 11 Feb 2009 16:45:05.0698 (UTC)
FILETIME=[17964020:01C98C68]
X-user: ::::0.0.0.0:host.example.net::::::
<html>
<head>
<meta http-equiv="Content-Language" content="en-us">
</meta><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title></title>
</meta></head>
<body>
<font face="Arial, Helvetica, sans-serif" size="2">Dear Member,<br />
<br />
Your PayPal account has expired. <br />
You must renew it immediately or your account will be closed. <br />
If you intend to use this service in the future, you must take action at once!<br /> To continue <a href="http://example.org/files/liaz/index.php">click
here</a>, login to your PayPal account and follow the steps.<br />
<br />Thank you for using PayPal!<br />
The PayPal Team<br />
<br />
</font><font face="Arial, Helvetica, sans-serif" size="2">Please do not reply
to this email. This mailbox is not monitored and you will not receive a respons.
For assistence, log in to your PayPal<br />
account and click the Help link located in the top right corner of any PayPal
page.</font><font face="Arial, Helvetica, sans-serif" size="2"><br />
<br />
PayPal Email ID PP3573</font>
</body>
</html>
Obviously, I have changed all the domain names and IP addresses (other than PayPal's domain name) to protect my privacy and to protect any of you from accidentally visiting a phishing site. I don't want my readers getting infected because of my articles, after all.
The highlighted snippet contains a link. If you look at it closely, you'll notice that's not a PayPal URL in the link--something you wouldn't necessarily notice if you viewed the e-mail with HTML rendered, which would just look like this:
This isn't exactly the cleverest phishing attempt in the world. It contains spelling errors, and targets something that most security-aware people will immediately recognize as a common subject of phishing e-mail messages. A more well thought out attempt might fool someone who doesn't habitually look at the plain text of e-mail, however.
In general, legitimate e-mail messages with HTML formatting come with a plain text version as well these days. When signing up for mailing lists and other mass-notifications, it is almost always possible to choose whether you get e-mail in plain text or HTML form. The exceptions are almost always phishing e-mail.
Some people may get more HTML formatted e-mail than others, of course, but for most of us there really isn't any need to render HTML for all e-mail messages. In my case, in fact, HTML formatting is a very accurate predictor that an e-mail I receive is unwanted, and I use HTML formatting as part of my spam filtering criteria.
In my list of basic e-mail security tips from almost a year ago, I mentioned that one should avoid letting HTML render in your e-mail client. Take this as an object lesson in the kind of threat HTML e-mail can present.
Chad Perrin is an IT consultant, developer, and freelance professional writer. He holds both Microsoft and CompTIA certifications and is a graduate of two IT industry trade schools.
Resource Centre Useful content from our premier sponsors
Internet Security TechGuides
Putting passwords out: Identity behaviour and identity authentication
Mozy online backup service: Privacy does matter
IT security strategies for mitigating Web-based risks
Cybercrime and the problem of online identity verification
Be careful not to incur security debt
Psychology provides clues in handling invisible threats
How to sell information security to management
Controlling your network using Network Access Control
Selling or donating equipment? Don't forget to wipe it clean
Implementing multi-factor authentication: What to consider
ZDNet Asia Live
Big data acquisitions pave way to fast, effective innovation http://t.co/hdiEfBsz via @zdnetasia
21 minutes ago by jowoodley on twitter
Integration, focused investments to propel Windows Phone: By Kevin Kwang , ZDNet Asia on May 23, 2012 (2 hours a... http://t.co/E7tsZbHJ
1 hour ago by Easyforexdotcom on twitter
Integration, focused investments to propel Windows Phone http://t.co/u9TqjQ8C
1 hour ago by ashvin_9 on twitter
AsiaClassifiedToday. Integration, focused investments to propel Windows Phone - ZDNet Asia: S... http://t.co/47tdjZyG #asia #google #biz
2 hours ago by ChemarieMonica on twitter
Malaysian organizations are apathetic about information security and fail to realize they are potentially under... http://t.co/XeuvbXrs
3 hours ago by SalesInAsia on twitter
Big data acquisitions pave way to fast, effective innovation - ZDNet Asia News http://t.co/vDZpl0lu
5 hours ago by servicemarq on twitter
"Big data acquisitions pave way to fast, effective innovation" including @Vivisimo_Inc (client) in @ZDnetAsia http://t.co/yNSdPqbb
5 hours ago by FreestylePR on twitter
Homegrown smartphone OSes gaining favor in China: 59 Jakarta 10350, Indonesia Locally-made mobile operating syst... http://t.co/BruP98Es
6 hours ago by SmartPhoneHonch on twitter
RT @MDMGeek: Big data acquisitions pave way to fast, effective innovation - ZDNet Asia http://t.co/ky8YgPAn #Bigdata #analytics via @ciropuglisi
6 hours ago by data_nerd on twitter
Integration, focused investments to propel Windows Phone http://t.co/6JkDa9sB
6 hours ago by bestwaytoinvest on twitter
RT @AsianFashionLaw: Malaysia offers some manufacturing benefits over China http://t.co/bMquIFiX
6 hours ago by Serend1p1ty9 on twitter
Acquisitions in the Big Data market increasingly important to enterprises… http://t.co/Br4BkXyZ
6 hours ago by iProConLtd on twitter
Experience trumps content in apps monetization http://t.co/iaCY5ebX
6 hours ago by monetize_me on twitterSo much as we know , MTK6575 extremely integrated frequency1GHz ARM Cortex-A9 processor, the superiority of 3G / HSPA Modem, and help the...
1 day ago by y15822137359 on 5 SaaS adoption speed bumps to avoidI reckon your view: "CRM is strategy, not software", if a company replicating the approach uses in ERP implementation into CRM, what they...
2 days ago by wykoong on Gartner: Mobile CRM gives better ROI than socialThis video will teach you about the Excel fill handle but also provide you with a workook to download... http://www.youtube.com/watch?v=...
3 days ago by TradeBrother on A quick fill handle trick for Microsoft Excelwaiting...
5 days ago by eapete on What should count in a company's market value?Boy, you've opened a can of worms now.
Wait for the rants & raves.
I was puzzling before this whether to replicate the success formula we executed for a financial institute, and come out with a standard s...
5 days ago by wykoong on Drop the egos, copy ideas, then innovateKeep up with ZDNet Asia
Facebook 
RSS Feeds 
Newsletters 
Twitter Whitepapers
Understanding Awareness in Mixed Presence Collaboration
A Taxonomy of Cross Layer Routing Metrics for Wireless Mesh Networks
SUSE Linux Enterprise Server on the IBM PureFlex System
Businesses are ready for a new approach to IT
The Value Proposition for IBM PureFlex System: Case for IBM PureFlex System for Cloud-Enabled SAP Enterprise Environments
Downloads
Internet Security News
Inside ZDNet Asia
Sponsored
Threats and malware know no boundaries. Neither should your web security. See how far Blue Coat Unified Web Security goes to protect your network.
Echelon 2012 - The Awesomer Tech Event in Asia
Echelon 2012 – SEA’s longest running tech startup event goes Awesomer. Catch 50 of Asia’s most promising startups & over 40 international speakers on June 11-12.
Startup Asia Jakarta showcases new product-ready tech startups. Plus: hackathon, exhibition, and speakers. Use promo code CBSi50 for 50% discount.
ZDNet Asia Intelligent Singapore video series
Featuring inteviews with CXOs who define "intelligence" in their markets and reveal how their companies drive business efficiencies through ICT.
A practical example of why HTML e-mail is a bad idea
erm....these are now easily detected automatically in any popular html email client available today.....