Rietta.com Security logo
You are reading The Rietta Blog, a publication about the web since 2005.

Saying No to PayPal Phishing Attacks

Users on my mail server, well at least the ones with domains subscribed to the filtering service, no longer receive PayPal spoofs unaltered! The trick to catching this vermin is both simple and accurate.

An e-mail is certainly a phishing attack when all three of the following conditions are met:

  • The From address claims to be paypal.com
  • The Received header, which indicates the address of the computer from which the e-mail was actually received, is not paypal.com
  • A paypal.com URL is mentioned in the body of the e-mail
Similar rules can be applied to ebay.com, suntrust.com, and any of the other brands that are spoofed. The code has already been written and these rules are easily implemented with SpamAssassin and available at http://www.rulesemporium.com.

Instead of the offending message being delivered unmarked to users who may be tricked by the scams, the users receive an e-mail stating that the message is suspected spam, giving enumerated reasons. Users can of course still see the original e-mail that is attached to the explanation message.

I wonder why the “Anti-Phishing Working Group” does not provide useful information like this. I suspect the next useful feature would be automatic reporting to spoof@paypal.com or similar addresses that may be maintained by organizations who are victims of phishing scams.

About Frank Rietta

Frank Rietta's photo

Frank Rietta is a web application security architect, author, and speaker. He is a computer scientist with a Masters in Information Security from the College of Computing at the Georgia Institute of Technology. He speaks about security topics and was a contributor to the security chapter of the 7th edition of the "Fundamentals of Database Systems" textbook published by Addison-Wesley.

If there is a topic you would like us to cover,