973799 - Thunderbird only shows sender's display name set by the sender which might claim to be another identity

Status: RESOLVED WORKSFORME

(Thunderbird :: Security, defect)

Description

[thunderbugs]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20140131092626

Steps to reproduce:

Imagine some spammer sets "Your name" in his account settings to some impersonating string (i.e. Mozilla Security Team). He sends an e-mail to you. You open your inbox with Thunderbird.



Actual results:

As following header is added in the e-mail
From: Mozilla Security Team <spammer-email-adress@provider>

Thunderbird displays the "From" on the inbox page as coming from "Mozilla Security Team" and you will only see the real address, when you preview the mail (which might cause some exploits to be executed).


Expected results:

Thunderbird should have an option to display the sender's e-mail address on the summary page (showing all e-mails in your inbox). It is still easy to claim being another person, but such silly phishing e-mails which are easily detected using another mail client would be then easier to be deleted before even previewing them.

Another option would be to be able to display the sender's e-mail server (might be a bit tricky to differentiate for non-technical-users from mailfiltering-proxies, ... on your side), but it might work well in ESR-releases if the admins are given the opportunity to tell Thunderbird how many steps the sender's email-header is apart from the own mail server's header.

Comment 1

[Jim Porter (:squib)]

Given that most of the spam examples I've seen involving a spoofed display name also spoof the email address, I'm not sure this would help much. Generally speaking, the spammers want you to click on an evil link, and they don't care if you try to reply to the message, so they have no reason to care about having a From address they control.

Comment 2

[thunderbugs]

It is true that spoofing the email address is nearly as easy as spoofing the display name. But imagine the following situation.

Someone is trying to impersonate being from a credit card company. It is easy to stop spoofing addresses like someone@creditcardcompany on the mail server if the company has taken measures like activating Sender Policy Framework, so the server can block those emails, because they don't originate from the right mail server. But I have seen such phishing messages claiming to come from a company in the financial sector in the mail's display name, but having completely other (maybe also faked) email domain. So the SPF/DKIM check on the mail server can't help, it is up the user's mail client to help him to detect the forgery.

If someone uses a SPF/DKIM-enabled freemail address, a mail with spoofed display name and correct freemail domain mail address might be delivered without triggering too much spam rules (so protection on the mail server fails). With other mail clients those mails are easily being deleted even before previewing them (because you see the non-matching email address), but with Thunderbird you have to show the preview to see the sender's email address.

It might be a silly example because everybody should know not to open such emails, but I think Thunderbird's behaviour makes its users more vulnerable to social engineering attacks by showing only the spoofed Display Names. So I don't know why Thunderbird should be worse than other mail clients in detecting phishing mails at the first inbox sight.

To make even better detection possible the option with showing the sender's email server would be an big improvement, but as this might be very tricky having an native option to show the sender's email address would be a necessary step to offer at least the same protection as other mail clients.

Comment 3

[Magnus Melin [:mkmelin]]

For contacts you can tick "Prefer display name over message header" to do that.