Defensive Computing lessons from the SEC e-mail scam

Yesterday morning there were, no doubt, millions of scam e-mail messages sent. But one scam message was written up by the Wall Street Journal, Bloomberg news and the Washington Post. There is a Defensive Computing lesson to be learned from why this message got so much attention.

The message appeared to be from Irene Gutierrez, a lawyer in the enforcement division of the Securities and Exchange Commission (SEC). According to the Journal it "harshly" criticized two high ranking executives at the SEC. The e-mail was sent to several employees at the SEC as well as assorted news organizations. Shortly afterward, the real Ms. Gutierrez e-mailed  that her Blackberry had been stolen and she hadn't sent the first message. Then, it turned out that the Blackberry had only been mis-placed, not lost.

So, if no one but Ms. Gutierrez had used her Blackberry, what explains the initial, phony e-mail?

Frank Ahrens at the Washington Post speculated that the message was typed on a computer, sent to Ms. Gutierrez's Blackberry and then forwarded from her account. He also suggested that Ms. Gutierrez's e-mail account had been hacked.

The truth was simpler, the From address was faked.

When Mr. Ahrens learned that the message was totally fraudulent he wrote "This means that someone with computer programming knowledge was able to change their e-mail address to make it look like the e-mail came from Gutierrez."

In fact, you need no knowledge of computer programming to forge the From address of an e-mail message. It's brutally simple.

Anyone still using AOL software can't do it however, and neither can someone using webmail or the corporate Lotus Notes. But classic e-mail programs such as Outlook, Thunderbird, Outlook Express or Eudora, among others (technically e-mail clients), can easily lie about the sender of a message.

The stories in both the Wall Street Journal and Bloomberg also failed to point out how simple it is to forge the From address. It seems to me, that the authors' ignorance of this, is the only reason this is a story.

Someone who commented on the article at the Journal's website said "why is a crank e-mail news to the WSJ? are you going to report on crank phone calls next?" What else but technical ignorance can explain how this came to be considered newsworthy?

There is no owners manual for e-mail accounts. If there were, the front page would say

NEVER TRUST THE FROM ADDRESS IN AN E-MAIL MESSAGE

Perhaps new e-mail users should be required to write this on a blackboard, over and over and over. It's that important.

When I first broached this subject, I pointed out that even Brian Krebs, who writes the Security Fix column in the Washington Post has warned his readers to treat e-mails differently based on whether they know the sender or not. This assumes, incorrectly, that you can trust the displayed From address.

The Wall Street Journal article mentioned a recent scam where investors were tricked into providing private information about their brokerage accounts by scam e-mail messages purporting to be from the SEC. How can you tell if an e-mail message really came from the SEC? In practical terms you can't. If you get one that looks legit, find the phone number of the SEC in the phone book, call it and try to verify the claims made in the e-mail.

The Wall Street Journal was sent one of the initial scam messages and reported the city where the server that sent the message "appeared" to be. This however, tells us nothing about who actually sent the message, neither their location nor their identity. We may never know who sent it.

Standard Internet POP3 and SMTP e-mail was not designed with security in mind. Messages, for example, are sent in the clear (un-encrypted). To deal with this think of Broadway; don't send anything via e-mail that you wouldn't want to appear on a billboard in Times Square.

If you need both privacy and verification of the sender, there are assorted software solutions, but they tend to be complicated, expensive and/or require you to change the way you handle e-mail. David Strom recently reviewed three e-mail security products for Computerworld.

Hopefully each scammed news organization will use this as an opportunity to educate their readers about the true nature of e-mail.