5

This morning I got a call from a user in a remote office who has received an email that purports to contain a "zix secure email" message. It directs him to a page http://zixmessagecenter.com/s/e which has a place for him to enter his google mail account and password in order to decrypt the email.

Really?!?

I did some research (here, among other places) and it seems that zix is a legit company providing secure email, but I have no way to distinguish between what are their real sites and what is phishing. And "zixmessagecenter.com" certainly isn't "zixcorp.com" so I'm not sure that this is really their web site, or some rogue domain that has the artwork of some legit zix pages downloaded and put into their page.

Also, some offhand remarks and links to some stuff from 2014 suggest that at some point google was integrating zix into google mail, so should he have simply seen a legit zix message in cleartext in his google mail?

So how do I tell if this is phishing or not?

Improve this question
4
  • When I go to the site, it does not ask for my Google credentials. Are you sure you are interpreting the site correctly?
    – schroeder ♦
    Commented Aug 29, 2017 at 17:01
  • Zix also appears to require that you have already set up an account with them. So, a user determines a phishing attempt based on their expectation of the legit domain, just like any other web service.
    – schroeder ♦
    Commented Aug 29, 2017 at 17:04
  • Ah, the user and I both misunderstood the user interface. Clicking the Google link got to a mailbox without any password required.
    – Cathy Fasano
    Commented Aug 29, 2017 at 18:38
  • 1
    Wasn't zix some scammy alternative to WinRar a long time ago?
    – forest
    Commented Jan 5, 2019 at 0:59

2 Answers 2

Reset to default
3

These days it's simple to create a phake email claiming to be from zixcorp with buried links to third party websites that have malware payloads waiting to be accessed and deployed. It's stunning to me that there are companies still using a supposedly secure message system that can be so easily compromised.

But I'm sad to report that it is. My own bank is apparently sending out secure communications via ZixCorp in the form of a crude form letter with links that the user apparently has to click in order to receive the "secure message" from their bank. Amazingly these emails don't even have a digital signature!

So, anyone who wants to get access to a huge treasure trove of usernames and passwords just has to craft a form letter email that claims to have secure messages for the reader with a bit fat button that ostensibly claims to be a link to zixcorp and spam it out to the world. There ya go, job done. Tsk tsk tsk and shame on any financial institution relying on such a flimsy service.

Improve this answer
2

This link is legit. The user interface is probably quite reasonable from the point of view of someone who understands the product and what it does and how it works. For someone who knows nothing about the company or what this is, it triggers a who are you and why are you asking for my email address?!?!?!? reaction. It's a very important problem in user interface design -- since everyone who programs and tests the user interface is intimately familiar with the product, how do you test the site's appearance to an unfamiliar user?

Improve this answer
3
  • I agree that the UI design is awful and confusing.
    – schroeder ♦
    Commented Aug 30, 2017 at 11:36
  • maybe the link is really from Zixcorp, but is Zixcorp legit? they seem to pretend to offer secure email, but in many cases don't have any sort of security (well, maybe availability, but no privacy/authenticy). I feel like PAC's response may be a little closer here...
    – NH.
    Commented Dec 13, 2018 at 20:04
  • Zix Corp is readily found online. It is not easy to determine that zixmessagecenter.com is their valid url. To receive a communication from "zixmessagecenter.com" with no warning is really bad form by the sender. The sender should give ample advance notice to expect communication from "zixmessagecenter.com", and they should specifically point out the exact spelling of the domain. Phishing has become very sophisticated, and if you were a target, using a similar domain, for instance "zixmessagescenter.com", could allow a crafted email to garner the info desired by the bad actor.
    – Mark G B
    Commented Aug 27, 2019 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .