Smack web spoofers with SpoofStick

Identity “phishing” and spoofed websites are a big problem for IT security and brand management these days.  There are several heavyweight technical proposals to make it harder for attackers to steal identity information by faking websites and emails, but the problem will continue to grow until the industry coalesces around some standards.  CoreStreet has come up with a simple way for users to detect when they might be on a spoofed website, and we’re making it available for free.  We call it SpoofStick™

SpoofStick is a small browser extension that prominently displays the domain name of the website you’re currently visiting.  That’s it.  Most current “spoofing” attacks entail tricking a user into following a mislabled link (like this one to http://www.cnn.com/) and then hoping that some percentage of visitors won’t decipher the complex URL to figure out that they’re not in Kansas anymore.  SpoofStick makes it easy to foil this type of attack because it clearly shows you only the most important information about where you are.  Like this:

Instead of trying to figure out if this is a real eBay url:

http://signin.ebay.com/aw-cgi/eBayISAPI.dll?SignIn&UsingSSL= 0&pUserId=&ru=http%3A%2F%2Fcontact.ebay.com%2Fws1%2 FeBayISAPI.dll%3FShowCoreAskSellerQuestion%26requested% 3Ddominicsmusic%26de%3Doff%26iid%3D3711129021%26frm %3D284%26acceptcookie%3D0%26loginconfirmed%3D0%26re direct%3D0%26pass%3D%7B_pass_%7D%26userid%3D&pp=p ass&co_partnerid=2&pageType=711"

Just let SpoofStick do the work for you. 

Spoofstick isn’t a very high-tech, comprehensive solution, but it’s a good start.  The goal was to solve 50% of the problem.  I’m going to install it on my parents’ computer and sleep a bit easier at night.  Instead of learning how to pattern recognize HTTP syntax, all they’ll have to do is check SpoofStick every time they enter any information into a website.

SpoofStick is currently available in BETA form, and only for Mozilla Firefox.  An IE version is around the corner.  SpoofStick is free and currently unsupported.  Nobody at CoreStreet is responsible if anything bad happens while you’re using SpoofStick – or at most other times, for that matter.  Please email comments or suggestions to spoofstick@corestreet.com.

Download SpoofStick v. 0.04 BETA for Firefox here.

[Thanks to my brother, Mark Ayzenshtat for doing most of the heavy lifting on this release.]