Spoofstick Spoofed

Spoofstick (http://www.corestreet.com/spoofstick/) is a tool with
versions for both IE and Firefox. According to the description on the
website, "SpoofStick is a simple browser extension that helps users
detect spoofed (fake) websites."

Unfortunately, it is rather easy to spoof Spoofstick. A simple entry in
the users host file of an IP address with a spoofed host name will trick
it. For example, an entry in the hosts file of the following will
display www.google.com in the Spoofstick toolbar, but the IP address and
the site is actually www.cnn.com:

64.236.16.20    www.google.com

So, while it may report some helpful information at times, it is also
trivial to spoof it.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
William J. (Bill) Hobson
Network Administrator
Information Security Officer
Network and Computing Support Services
Texas Engineering Experiment Station

--
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an 
Anti-Virus product which automatically notifies the perceived sender of a 
message it believes is infected may well cause more harm than good. Someone who 
did not actually send you a virus may receive the notification and scramble 
their support staff to find an infection which never existed in the first 
place. Suggest such notifications be disabled by whomever is responsible for 
your AV, or at least that the idea is considered.
--