this year's election is going to be a close one. however, if you decide to contribute to one candidate or another, watch out for scams. in a july 17th, 2004 pc magazine article on political spam, anne bonaparte, mailfrontier president and ceo of mailfrontier commented that "though we haven't seen it yet, this could open up a whole new avenue for e-mail fraud.". well, it has happened.

the phish:
we received a message claiming to be from presidential hopeful john kerry's brother, cam kerry, asking for donations. the e-mail was from [email protected] . the original e-mail came with a photo of cam, and graphics that were linked back to kerry's official web site. the problem: it's a fake. if you clicked on any of the links, you were taken to a web site hosted in a domain "". the domain was registered to a person by the name of kothari, out of jaipur india. the page was a copy of john kerry's real donation page, with a couple of exceptions.

how to recognize it:
the e-mail is from an address at (note the s). a real message would be from (no 's'), such as "kerry-edwards 2004 [[email protected]]" . the phish made no attempt to spoof the address, which actually is good, since it was easy to spot. when you clicked through to the donation page (figure 4) , it had the address: . while the e-mail says "click here for a secure transaction", the page is not a secure (https) web site. additionally, the links on the page for "donate by phone" and "by postal mail" were both broken.

Figure 4. Bogus contribution form

however the biggest difference was that the phisher asked for a debit card, rather than a normal credit card. it also asked for both the cvv and the pin number for the card. while some sites do ask for the cvv to guarantee that a purchaser actually has the card in hand, rather than an old receipt retrieved from a dumpster diving expedition, no legitimate sites will ever ask for the pin number. on kerry's official web site, the online donation page asks for a credit card, like visa or american express (figure 5) . in addition it is a verisign secured site.

Fiugre 5. Real Kerry contribution form

how kerry's site dealt with it:
by sunday, the webmaster on the official site had replaced the image of kerry's brother with one that stated a warning that if the e-mail was from any address that included (note the s), it was not real. so, when a user opened the html phishing e-mail, they saw the warning message rather than the photo of cam kerry (figure 6) . Figure 6. Warning image

advice for webmasters
linking back to a legitimate web site for graphics is a common technique for phishers. while it lends authenticity to a spoofed site or e-mail, it gives an advantage the legitimate site can use to fight back. a webmaster that receives traffic reports and checks the referring site, and most popular page/images can determine if a specific image or page is being viewed from an unusual reference. an ebay seller we know discovered his copyrighted animated images were being used by a competitor this way.

though a large site might need the assistance of some analytical software, checking logs often can give a heads up to a potential problem. if it turns out that an image or content is being linked to from an undesirable source, you can do like kerry's site did, replace the original image with another that warns people. of course, you have to change the real references, or your own site will display the warning.