You go to your computer, power it up, and open up e-mail. In your Inbox are dozens of messages being sent by somebody named Mailer Daemon, saying the message you tried to send to a particular address is undeliverable. Some of the messages are in French, or Portuguese, or Russian. What's happened here? Are you under attack by a new virus of some sort? Surprise! You've been spoofed!
On the Internet, spoofing is a process whereby someone attempts to gain access to a restricted system by pretending to be an authorized user of that system. It could be as simple as someone utilizing some basic social engineering skills, calling a company's IT department and saying, "I'm John Smith and I've forgotten my password. Can you get that for me please?" It could be as complex as a hacker utilizing software to cycle though all possible permutations of accounts and passwords for a company. Whatever method is used, it means somebody's temporarily stealing your Internet identity for their own purposes. (And you thought identity theft was limited to somebody taking all your financial information!)
When it comes to e-mail, spoofing involves sending out spam e-mail and changing the header of the message so that it appears to have come from someone other than the originator. You've received them before--the notice from eBay that your account will be closed unless you click on a link to update your information; the message from your bank saying somebody tried to access your account and you need to go to this Web site to change your access information. These types of messages are sent out en masse in the hopes that an unsuspecting reader will think it's the real deal and respond, giving up personal information.
"But I'm not eBay, or a bank, or even a big business," you say. "Why would somebody want to use MY e-mail address for something like this?" Because in the cases where these blanket e-mails can't be delivered because an e-mail address is invalid, the mailer daemon has to return the message and notify the sender that it was not delivered. These clowns don't want some government agency tracing their spam back to its source, so they put somebody else's e-mail address in the "From:" field of the header. And that's how you get all their "Return to Sender" messages, even when you're not the sender.
How can you protect yourself from this? You can try notifying your Internet Service Provider (ISP), but there may not be a lot they can do about it. Since current e-mail systems don't have a way to authenticate a message--to verify that the sender is actually who, and where, he says he is--it's practically impossible to prevent someone from using your e-mail address in a spoof attack. The ISP may be able to block the individual IP addresses from sending you e-mail, but since you never know where the return message is coming from, it could be time-consuming and expensive. It could also block legitimate e-mails from individuals and companies that utilize those IP addresses.
What's the solution? If you receive these non-deliverable messages, forward a copy to your ISP to let them know. If you find your email address is continually being used by spoofers, you might consider changing your e-mail address, although that may not be practical for those whose business e-mail addresses are being used. The bottom line is that you might just have to put up with it. Delete the messages, or assign them to your e-mail program's Junk Folder, and go on.
In the anonymous world of the Internet, it's easy to make someone think you're somebody you're not. Spoofing takes advantage of that fact, involving innocent bystanders in their schemes. Until someone devises a way to authenticate the source of those spam messages, we'll have to live with the occasional "temporary identity theft" that spoofers take advantage of. Now don't you feel safer?
tweet this!