🚀 go-pugleaf

How common is this attack?

  1:  User on foo.bar.com gets mail from root@foo.bar.com or admin@foo.bar.com
      asking to change his password to "gromitvomit" because root needs to
      [access the account|modify something|find a hacker|(etc.)]

  2:  User changes password to "gromitvomit"

  3:  Hacker who forged the E-mail logs in, changes the password and now
      has the account.

Knowledgable users would be *VERY* suspicious because (to by knowledge)
root **N-E-V-E-R** needs to know a user's password to effect changes
to an account or the system, but this attack could work on novice UNIX
users.

What is the best way to prevent/slow down this form of attack?

-- 
******* ifbb657@ccwf.cc.utexas.edu (Douglas R. Floyd) ******
Disclaimer: I speak for myself.
Win NT:     Another reason to pour salt water on the toroid
            coil of your 21" monitor.