I posted this on another thread, which you should 100% read through:
If you have any questions, queries or amendments you'd like, please leave a message here.
I'd like to extend my response to this person and to everyone as to how to protect yourself from phishing on a fundamental level. Going down from simplest, and most fundamental, to trickier and more intricate:
Stay smart, nerds.
No. There is no credential forging going on here.
What is going on here is the following: Emails aren't secure essentially. Most modern computer systems have checks in place to determine whether someone is legitimate or not. Won't go into detail about them here but you can Google various things like email spam verification, etc. In emails you have a bunch of fields composed in a header (most email clients will have a View Source button to show this), including the from header. Much like HTTP, the headers are entirely changeable and settable. This includes the From header. As I mentioned before, many email services have protective measures - but some don't (obviously). On the outgoing side, you'll have a bunch of headers verified - and then again on the incoming side (though it's much harder to check, it's why blacklists are a thing). Essentially changing a single header without credential hacking will allow you to spoof an email, and I encourage you to try it addressing an email to yourself on a custom client (you can write one in a language which sets the From address) to show how they get blocked.
This is an example of one I did a year ago. Unfortunately it sends through your email server, and other various tidbits, and while you can set one up yourself, residential IPs are blocked on a global email blacklist sort of thing. (It's really hard to make one that passes various security checks). This email got blasted as spam.
If you have any questions, queries or amendments you'd like, please leave a message here.
I'd like to extend my response to this person and to everyone as to how to protect yourself from phishing on a fundamental level. Going down from simplest, and most fundamental, to trickier and more intricate:
- Ensure that your private credential-based accounts, logins, etc., are placed across either one or more various private emails. I do not recommend one email but if you really want to, absolutely make sure you have 2FA and even 3FA if your email provider offers it. At a fundamental level your email should be the hardest thing to be hacked as it facilitates the rest of your accounts/logins. I say this because you only want 1 point of weakness, and that's just yourself, socially. You don't want to be putting your attention to both protecting yourself constantly on a digital level AND social level.
- Pay attention to all incoming emails. If you see an email requesting to reset your password or to provide any information whatsoever, be very very wary. Companies typically will never send you reset emails and if they do, they won't include a link or they'll phrase it in an indirect way. This includes if a website gets compromised.
- DO NOT CLICK ANY LINKS IN ANY UNSOLICITED INCOMING EMAILS. EVEN JUST OPENING ONE CAN COMPROMISE YOUR ACCOUNT. DON'T EVEN COPY + PASTE. DON'T EVEN HOVER.
- Pay attention to Tweets, PSAs or other messages sent out by companies. They will list common scams relating to the company (such as supermarkets + scammer gift card requests). The only emails you should receive are updates if anything, or responses for you when you make an email.
- Read, re-read and re-read again all of the email. Should you spot a grammar error, spelling error, or other basic English mistake, please please please put your internal alarm on. Larger companies have editors and other people to read and re-read their external and internal emails and therefore should make very few mistakes. If you have trouble distinguishing between broken and regular English, there are sites you can go to see.
- Click View Source on your email. This only sometimes works because typical phishers can sometimes be stupid enough to make such a silly small mistake. You need to look for return-path, from, and any other various IPs and emails that might show up in the header. It's tedious but if you spot any sort of mismatch, it will absolutely be worth it.
Stay smart, nerds.
Last edited:
