|
|
|
| "Phishing attacks involve the mass distribution of 'spoofed' e-mail messages with return addresses, links, and branding which appear to come from banks, insurance agencies, retailers or credit card companies. These fraudulent messages are designed to fool the recipients into divulging personal authentication data such as account usernames and passwords, credit card numbers, social security numbers, etc. Because these emails look “official”, up to 5% of recipients may respond to them, resulting in financial losses, identity theft, and other fraudulent activity. " Read all about the Anti-Phishing organization www.antiphishing.org and the important work being done to stop this criminal activity.
2/27/04 It was a Tuesday afternoon, bright and sunny, and the elderly lady who lived down the street wasn't expecting any visitors. A knock at the door alerted her to an unexpected thrill - a very nicely dressed, clean-shaven man in a suit standing outside with an official looking briefcase. His shoes were shined, his suit impeccable, so she opened the door. "Good afternoon Mrs. Jones, my name is Inspector Hatten and I am from National City Bank. May I talk to you for a few minutes?" Mrs. Jones was startled that anyone from the bank, much less an inspector, would show up at her door. The man looked very sincere and spoke politely, so she let him in. Shortly, Mr. Hatten led her to believe that a problem at the bank may have led to some account irregularities, so he was asking for her help in correcting the problem and finding out who was responsible. Somewhat flustered, but eager to help, Mrs. Jones went with Mr. Hatten to her branch to withdraw the rather large sum of 20,000 dollars from her savings. When the money was withdrawn, Mr. Hatten asked to see the money so that he could count it and make sure it was both correct and to record the serial numbers. Mrs. Jones sat at one of the unoccupied tables the bank had in the lobby while Mr. Hatten went to see the manager and finish the transaction. After 20 minutes, Mrs. Jones got worried. She asked to see the manager, since Mr. Hatten had been gone for a while. She then found that no such test or inspection had been underway, Mr. Hatten was not a bank employee, and finally her money had been stolen. The story related above is an example of the popular (with con artists) "Bank Examiner's Fraud" that has been occurring with some regularity for many years. There are endless variations using a telephone, wire transfer, insurance - but the theme is the same. The victim wishes to help clear up a problem or assist authorities, and in all cases the victim loses their money, dignity, and rarely is the perpetrator caught. Now, however, there is an updated Digital Age version of this con game using computers, web sites, databases - but the results are identical if not even more damaging. These attacks are called "spoofing" or "phishing" attacks. Phishing is the latest big thing in criminal online activity and a sizable amount of it is being conducted by former Soviet (Russia, Ukraine) block and eastern (China) country malicious hackers. The name comes from fishing for passwords or credit card details, spelt in the malicious hacker (illiterate) style. It seems to date from 1996 when criminals were stealing AOL account names and passwords from gullible new users, with a hacked account known as a "phish". Now it has spread from stealing access to someone's e-mail to stealing their credit card details, PayPal balance or even the contents of their bank account. Following is an example of "phishing" (click to enlarge):
Now let's look at some of the source code: ------------988453712075B50 Two sections of code have been highlighted because they illustrate what clicking on the button leads you to. The button is linked to a site at 198.173.234.225: [billk@penguin billk]$ nslookup 198.173.234.225 Doing a whois on 198.173.234.225 yields: [asdfk@linux asdfk]$ whois 198.173.234.225@whois.arin.net Verio is a perfectly legitimate ISP, but this site is definitely not EBay! Other spoofs that have come across are from sites in South Korea, Italy, France, China, Germany, UK, Russia, Ukraine, etc. You get the point: The phishing expedition is targeting unsuspecting Ebay and other institution's customers with an attempt to get the victim to follow the link to another site. At the remote site a look-alike page will attempt to steal account IDs, passwords, financial information - whatever the criminal may find useful to purchase goods or perhaps to simply clean out an account. Particularly humorous in this attack is the phrasing "EBay never asks for your credit card number, pin code or any of your passwords (sic)". However that's exactly what this site does. The author has gone to the trouble of copying EBay's privacy statement and other legalese to attempt to make the site look real. It is important to understand that EBay, Amazon, PayPal, banks, and other financial institutions will not send you an email of this type - ever. They know that criminals are spoofing their sites, so they are going to some significant effort to protect their customers. Let's look at another example:
This is a classic example of using an "account problem" to lure the unsuspecting to follow a link where their account name, password, and other data can be stolen. In this case the following source code was used: To update your eBay records click here: <br><p> You can bet the account management will thank you if you follow that link. 207.182.246.69 traces out to: [asdfk@linux asdfk]$ nslookup 207.182.246.69 Which sure isn't EBay! What do the perpetrators gain from these sorts of attacks? Typically the scam involves the following:
What does the thief do with the data?
How do you avoid getting ripped off? There are some simple rules to avoid falling for this sort of scam. First, never to click on a link in an e-mail, even if it looks OK. It is safer to type it in yourself or to cut and paste it from the e-mail into your web browser. If you have clicked on the link inadvertently, close the browser, run a spyware detection program like the excellent AdAware or SpyBot Search and Destroy to remove any possible keystroke loggers, and then when you re-launch your browser only type the name of the site directly in the address bar. It is best to manually remove any cookies or files that may still be there (in Internet Explorer use Tools / Internet Options / Delete Cookies and Delete Files to remove anything that is left). By and large, companies like eBay and PayPal do not send out e-mails asking for details, they wait for you to log in and then tell you there is a problem. They are not being lazy or careless, they don't want to train you to be lured into a trap. And banks do not ask for customer passwords in e-mails. Finally, ask yourself - if a stranger showed up at the door, would I give them this information? All email is simply a message from a stranger until and unless there is a way to verify the source of the message. Don't fall for one of the oldest con games in its new disguise, the Phishing Scam.
|
