from f-secure

A new kind of eBay phishing attempt is going around. It's only going
to fool people who have something for sale on eBay, because it's
disguised as a question from another eBay member about shipping costs
for "your item".

It even includes the boilerplate from a genuine eBay message which
says "Your registered name is included to show this message originated
from eBay", although it does not in fact contain your registered eBay
screen name, for obvious reasons. The phishers only have your email
address, not your eBay screen name. (Of course, they might be the
same, or at least similar. One more reason to invent a truly unique
screen name for all the on-line services you subscribe to.)

The message contains a button to reply to the buyer and, of course,
you must sign in with your name and password to respond.

Because the message contains a number of fingerprints which are
typical for forged messages, both spam and phish, it's already
detected by our existing phishing rules.

This brings up another point, though. The majority of these
fingerprints are based on header analysis. But when we get a spam or
phishing sample, we frequently only get the body of the message (and
sometimes only something like a copy-paste of what the user actually
sees, or even just a screen shot).

In fact, a number of "modern" email clients make it very very hard
indeed to forward a message with the full original headers intact. If
you are connected to an Exchange server, it's not even possible.
(Fortunately, we hear Microsoft is finally working on this.)

An example of what takes in Outlook to send a proper sample is at
http://www.umkc.edu/is/cs/abuse/headers_outlook.htm, but see your own
ISP's abuse pages, they probably have something quite similar ... and
similary complex.

If you want to send us a proper spam or phishing sample, it would
actually be a fairly good idea to install a third-party plug-in to
help extract the full headers. We are aware of such plug-ins for
Outlook and Eudora.

Ironically, those of us who still live in the "stone age" don't have
such problems. In classical email clients such as Mutt and Gnus (and,
${dmr} bless you, Pine, if you configure it correctly) this is not a
problem at all.

Visit my website:
http://www.mzuschlag.com