Fishing for Phishers

mleachpdx writes "This blog entry probes into the details of an online banking phishing scam and suggests some fraud deterrence and detection measures."

Comments

More Info Available here

[LiquidCoooled]

Full article mirror here:
mirror.slashdot .org article

Theres currently a problem with our server, you will have to login again to see the details.

(yes this is only a joke)

Or....

[jmcmunn]

From the article: "The home page of the phishing site looked identical to the actual online banking site. I was impressed. Someone had spent a considerable amount of time mirroring the entire look and feel."

Or they just used the Spiderzilla extension for FireFox and downloaded the entire site. Wow, that scammer went to a lot of work. I have gotten these scams before though, and it is no laughing matter that they go to a lot of trouble to look legit. And I bet the estimate of 15% of people who fall for it listed in the article is actually a little low.

Solution: You authorise the bank first

[Anonymous Coward]

When you sign up, the bank asks you for your 'personalised code', and that will be displayed in every email you recieve from the bank.

If you dont see that code in your email, or it's wrong, you know its fraudulent.

Re:Solution: You authorise the bank first

[BobTheLawyer]

Do any real banks send e-mails to customers? As far as I know, no UK bank does.

Re:Solution: You authorise the bank first

[gl4ss]

the *REAL* solution: don't email the customer EVER.

My bank doesn't even HAVE my email.

Re:Solution: You authorise the bank first

[legirons]

"When you sign up, the bank asks you for your 'personalised code', and that will be displayed in every email you recieve from the bank. If you dont see that code in your email, or it's wrong, you know its fraudulent."

And this code would be sent through which secure email-delivery system exactly? Plaintext SMTP on the internet, like all the other emails from your bank?

Hell, banks don't even sign their emails. Many of them don't even know what PGP is. How many of us have had conversations with our banks along the lines of:?

You: I just got an email purporting to be from you

Bank: Yes, that's right

You: So how do I know it's real without phoning you

Bank: Because it's got our name in the From field

You: Did you ever consider signing your emails

Bank: OUR INTERNET IS SECURE, WE USE HTTPS WEBSITE!!!

Re:Solution: You authorise the bank first

[legirons]

"What the hell has secure-email delivery got to do with it? Unless the phishers have somehow gotten hold of an email from your bank to you, they wont know your phrase, simple as that."

Okay, and how do the spammers get somebody's email address to start with? Oh yes, a virus emails the contents of their inbox to a russian server"

Along with your special code.

And don't pretend that you can just secure your computer -- there have been 5 major windows viruses already this year, and as far as I can tell, nearly every windows user I know has been infected.

As to secure delivery, have you noticed the number of people buying wireless networking kit? Most of those people are transmitting their POP and IMAP connections in cleartext to anyone within range. Dumpster-diving doesn't even require getting dirty any more.

A code could work well, I admit. But it might need some small changes, such as sending a numbered list of codes in the mail, and writing something like "this is email #403 from us and code 403 is blah" in each email. But anything which relies on computers, inboxes, and emails being perfectly secure starts to sound like a bad idea when you mix it with banking.

Re:Solution: You authorise the bank first

[fbjon]

Good point, but suppose this happens:

Your DNS, or the DNS for your area, is hijacked, and everybody who use that DNS is called up and told to log on to their bank in order to do something important?

Second solution is:
One-time passwords. I have a long list of login passwords and confirmation passwords, and a numerical customer ID known only to me. When they start running low, I can easily get a new one (mailed to me). So what if I happen to login to some fake site? The worst that can happen is that I waste some time and a little bandwidth, since they can't do anything with only one part out of three (the ID), and anything I do with the fake stuff won't happen anyway. Besides, I'd be mighty suspicious if the balance of the account(s) isn't correct, since that is what I see the moment I login.

Re:Solution: You authorise the bank first

[gl4ss]

the way it's been done here for almost a decade is this.. you have login and a password(which happen to be numbers) which you use to 'get in'.

then to do any transactions, to open any accounts, to apply for a loan or just about anything other than just checking how much cash you have the system asks a number from a list of one-time passcodes they've sent to you through regular mail(basically "enter the number pair for the number 4323 on your number card").

the card with the one-time-use passcodes is a plastic credit card shaped one, too. easy to have in the wallet, but totally useless without the other codes needed to get into the site.

Re:Solution: You authorise the bank first

[fbjon]

Sure, I'd say that's good enough, but someone could still check you account balance whenever he wants. (I'm assuming the login thing never changes) In my case, you need the one-time pass even before that, and the paper they come on can be folded and put in the wallet too :). After doing your business, you confirm with a pass from a second list, that you can store separately if you want.. you could for example do all money transfers from one location, and then confirm everything from another computer/city/country entirely. I don't know if knowing the balance is a significant risk of anything though..

Re:Nothing to see here...

[clodney]

The FA didn't give any reason for why he thought the phish was targeted at him. Without an explanation, I'm sceptical that it was targeted in any way. I get phishing mails all the time - most commonly aimed at Citibank or Paypal, neither of which I do business with. I don't know why the phisher would bother to target them. Seems like more effort than it is worth.

Customer details

[metlin]

Limit access to customer records. This is pretty much standard practice in the banking industry anyway, but I found it eerie that my phisher knew what institution I did banking with. How did they know this?

Well, I've received several of these mails, but I do not really think they go by any kinda cue -- I've received mails from various banks from around the US, so I think these guys randomly see where you are, make a wild guess at the likely bank and send you one.

For instance, several students at GTech (where I study) have their bank accounts in a certain bank (which we shall call W) -- and a lot of these scams are directed at GT students pretending to be from W.

However, that said -- I'd not be surprised if they acually did some dumpster diving and found out these kinda details. Spooky, man.

They don't know who you are

[Space cowboy]

I must have got a dozen or so of these in the last few days, my spam appears to go in phases... either I'm in dire need of sexually-enhancing drugs, about to die from malnutrition, or they're all just after my CC details...

It's just a blanket 'attack'. Email is cheap, and they're not trying to be smart because they don't need to be.

Simon

ways to prevent online fraud?

[Anonymous Coward]

why not give consumers one time access (through pads)?
This is done in Japan and works well there. Maybe consumers here would lose their card? The card isnt electronic its just card with pin numbers that you scratch off each time you use the PIN number.

Banks should STRONGLY educate consumers to never expect emails from the bank that contain links.

Re:ways to prevent online fraud?

[LiquidCoooled]

I posted a comment a few days ago regarding how my bank secures online access.

The gist of it is a longer code that I arrange with them in person, and when I go online with them, they ask for random portions of that code.

I would have to be scammed multiple times before anyone had access to my banking.

The comment is here: http://slashdot.org/comments.pl?sid=128336&cid=107 16472

How to annoy phishers

[DrXym]

Drown them in noise. Everytime you get one of these emails, visit the site and enter bogus information. That's what I do. It might not be enough to get the scumbags caught but it must certainly be an annoyance to them. And who knows, a few bogus logins might be enough to get alarm bells ringing at the bank.

I reckon banks could do something similar too. Create some honeypot accounts, and track how the criminals attempt to access it. I'm sure they could play a few tricks with a seemingly big fat balance that could make the criminals reveal their hand.

Re:How to annoy phishers

[LiquidCoooled]

Username "PHISHINGSCAM"
Password "QUICKGETEM"
Name "CALL SECURITY"
DOB "01/01/1337"

This would be cool to try.
But tbh, I recon they would just take the list and try those that look legit.

What we could do is simply forward any phishing scam mails to a central phishing clearing house.
The banks could fund a small team to handle collective online fraud.

Re:How to annoy phishers

[LiquidCoooled]

Just below this comment a poster has given a link to a phishing central source :)

Looks like its already in action :)

http://www.antiphishing.org/

Re:How to annoy phishers

[DrXym]

In other words, make them look legit. Enter a well formed but bogus account / credit number, valid sort codes, expiry dates, names, PINs memorable dates etc. If you have an account with the target bank you could even ensure you enter an account number of the correct length and has the first four digits as your own.

The only way they have to separate the wheat from the chaff is to actually try them. If they're really stupid, they (or their underlings) may actually get caught when they attempt to withdraw cash or buy something. Now that would be funny.

Re:How to annoy phishers

[Sepodati]

Drown them in noise. Everytime you get one of these emails, visit the site and enter bogus information.

I've always wanted to find a way to automate that. Have a site where you could submit a phishing site, have it analyzed and then feed it a bunch of noise.

If it's all done from the same computer, smart people could weed out the noise by IP address, so you'd have to account for that somehow, too.

Once you make enough noise in the system, scams like this do not remain economical, I would think.

---John Holmes...

Re:How to annoy phishers

[sonicattack]

Enter a well formed but bogus account / credit number,

Today I got one of these fraudulent "the bank needs your information" E-mails. So, I thought, let's give them some noise to fill their log.

But the credit card number I made up was detected as non-existent - or at least the fake website said so.

Now, is there any way to:

1) Generate fake credit card numbers that pass as "valid"
2) Do this, and be certain that no-one actually owns that particular number, and if so, still not get into trouble?

Re:How to annoy phishers

[throughthewire]

But the credit card number I made up was detected as non-existent - or at least the fake website said so. Now, is there any way to:

1) Generate fake credit card numbers that pass as "valid"

They're probably doing something trivial with Luhn numbers. Trivial to implement, trivial to spoof. Generating apparently valid but fraudulent card numbers is known as carding.

2) Do this, and be certain that no-one actually owns that particular number, and if so, still not get into trouble?

Trouble with whom? The scammers? If you aren't using the number to commit fraud, I wouldn't worry. We want to get the phishers in trouble!

Re:How to annoy phishers

[SomeoneGotMyNick]

Slashdot moderators rejected an article I sent in over a month ago about this very concept.

A lot of times, you can send a URL encoded request (GET Request) to fill in bogus data from the address line. I've happliy sent random values to these seedy servers with a small bash script using lynx.

I suggested that one or more popular websites add a new 'banner ad' whose image location is a properly formed URL to submit a random value to a known phishing server. As people come by the site, a new request is sent to the phishing server on their behalf and floods the phishing server with bogus data coming from many locations. Of course, you may get a red X in the banner image, but who cares. Maybe have it a user optional response. The banner ad could read "Fight Internet Scams, Click here to vote."

Until such a time, I usually have fun overloading the form fields with typographic or unprintable characters well over the string length coded in the form. Hopefully, I cause havoc with their databases when I do that.

check out antiphishing.org

[enbody]

Check out antiphising.org

The wrost ones are...

[ScooterBill]

The EBay request to verify account information. I've received this several times. Perhaps the financial institutions don't do much because a small country in Africa isn't going to let U.S. law enforcement take care of the problem. Too much corruption is usually the case.

The maxim I always use is: The company that holds your account never needs to ask you for your password since they already have it.

Something many probably don't know is that your local police dept. probably has a high tech crimes unit. They will investigate and prosecute illegal activites like snooping around your company network. They can be very helpful.

Re:The wrost ones are...

[jdkane]

The maxim I always use is: The company that holds your account never needs to ask you for your password since they already have it.

I would add: Often the employees of the company don't have access to the password because it is encrypted on their end. But the institution can change or reset your password without knowing the old password. This is usually preceded by a manual check performed by customer service over the phone to ensure you are really you. They might also ask you to come into the bank and provide ID.

Enough Already.

[xanadu-xtroot.com]

Enough already with this "a blog entry says" stuff. Can we please get some ACTUAL news on this site and not just someone's rantings on a BB? Is that too much to ask?

Receiving too

[gmuslera]

in a mailing list I administer, and in my own personal address (time to test the new "report phishing" gmail feature) I received today what could be the same message, but the IP it pointed to resolved as ipvpn101156.netvigator.com (don't look like to be in zimbabwe) port 38, that looked like a Windows 2000/XP with too many open ports.

Probably that message is sent from hacked/owned/not patched windows machines that send the entered info to the real criminal. I suppose that for really knowimg who is him that "infected" machines should be hacked back or that the provider of that internet connection contacts/gives the address of the owner, and check the programs there.

Is it that simple?

[Sarin]

I still don't understand, do these banks just give their customers a login/password for their account?

The bank I use gave me a little authentication device which combined with my bank card, my personal code and a random code provided by the bank site can generate digital signatures. In order to login and in order to make all transactions final I must provide the right code.
I've been using this system for about 10 years now, if those exploitable banks still use a normal password protection it's their fault they're exoploited this way and there's no way customers should be responsible for it.

ROI

[Gary Destruction]

The scammer went to alot of work because the Return on Investment was so high. For a few hours of work, he probably a substantial amount of cash.

I Have Not Seen My Bank's Name in Phishing Scams

[mrs clear plastic]

I have used the same bank for over 15 years for my personal checking account.

I have not gotten one email from that bank (either legitimate email or a phishing scam with that bank's name or fake url.

That bank does have my email address.

I have gotten phising scams that have ebay in them (I do have an ebay account). I have also gotten phising scams with the names of other banks in my area.

I think they go by geographical data for banks. For ebay, it's no problem. They can scan ebay's pages and get seller's ebay account names with no problem.

Damn

[Glonoinha]

I misread the subject line on this article, thought it read Fisting for Phishers.
Now that is a punishment that would work pretty good, once word got out!

The problem is much larger than just banks.

[daperdan]

I work for a company that attempts to protect its customers from this kind of fraud. We monitor domain registrations to locate potential phishing scams. It's interesting to see that it's not only banks that are hit with this kind of scam. These guys will set up an entire shopping cart taking credit cards that mimick an online store like Dell. It's a pretty interesting scam that only seems to be gaining popularity.

It's not a major concern in the 3rd world so these guys have no reason to stop. We've seen scams like this based out of Russia, Brazil, China, and several African countries. It will be interesting to see how this all pans out.

Why is it so hard to catch these criminals?

[Anonymous Coward]

In order for them to get their ill gotten gains, they have to eventually withdraw some money from somewhere. It seems it would be trivial for INTERPOL or some other agency to set up a bunch of bank accounts with a few thousand dollars/euros in them and then start responding to all the phishers. Then just follow the money to the crooks. What's the big deal? Is there just no will to do this or am I missing something?

Cheers,

Re:Why is it so hard to catch these criminals?

[Daedala]

The money doesn't go to the criminals; it goes to a mule who thinks he's processing charity donations. Then it goes to another mule who thinks she's reselling computers. Then someone uses the cash to buy a plasma tv and send it to some other country. Then the recipient sells the plasma tv and wires the money to someone else..... The basic problem is money laundering, and we still don't have a good handle on that.

Re:Nothing to see here...

[Registered Coward v2]

I fell for a phishing scam once. I just hope when Mr Hitler tried to get a new password from tech support they didn't give one out.

Gmail vs. Phishers

[igrp]

It's definitely becoming more of a "mainstream problem". Afterall, the whole identitity theft problem is perfect Dateline/60 Minutes material.

Has anyone else noticed that the folks at Gmail have added a "report phishing" feature? When you view a message, click "More Options" and you'll see it.

Then again, maybe it's been there for some time and I just haven't noticed (it definitely wasn't there when I first got my Gmail account though and it doesn't appear to be listed as a new feature).

Slashdot this

[GQuon]

On a related note:
The lad vampire needs your help

How do you drain an account without a trace?

[npross]

What monetary transaction can you make on an account that leaves no trace?

In every case getting cash out of my account involves paying a bill (to an authorized agent like VISA), or emailing money or transferring money to a 3rd party acct. All of these leave a trail that banks can recognize and plug.

I once changed my buying habits with my VISA card and had to confirm my identity before the transaction could be authorized. Since fradulent VISA transactions cost VISA, it appears that when it affects the bottom line, banks can and do put checks in to stop fraud, but there is no incentive for banks to stop fraudulent bahviour on behalf of their customers. (Of course we are no longer the banks customers, shareholders are the real customers)

Pressure needs to be applied to the banking industry to minimize the average person's exposure to fraud! It is easy to do, for example I should be able to lock transactions from my online banking account to a specific set of recipients and require a face-face visit with a banking representative to change this... Would-be fraudsters that obtained access to my account might be able to overpay my utility bill but that would be about it.

countermeasures?

[doginthewoods]

Just like spam, can we @ /. take any countermeasures? I'm not up on this stuff, so if I make a few silly suggestions, please give me a break. Pick a phisher /spammer and: /. them Send a reply with the name of a pop tune or movie in the title. Send a reply with a big attachment Send a reply with a virus attached If it's possible, think of all of on one day, sending an email with "White Houses" on the title, and a 4 Mb attachment to a spammer / phisher. A toasted server, maybe?

Re:How is it possible to make money?

[stoborrobots]

The only actions allowed are transferring money from one account to another

Like from your account to mine...

Re:Here is a good rule of thumb: ignore them 100%

[gelfling]

Nonsense. Before there were computers there were credit card companies and banks. If they called you up asking you to verify information they're supposed to have you'd be an idiot to give them that info.

There is little new under the sun. Just because we give it an incredibly lame 1337 name; "PHishing" doesn't mean it's not a hundred year old con game.

Re:Transfers are between your own accounts.

[stoborrobots]

Which bank does not allow you to make payments to other people? What is the point of online banking if you can only shuffle money between your own accounts.

Of the four banks with which I have bank accounts, all allow me to make payments to anyone else whose account details I know. I can also make SWIFT (i.e. international) transfers to any account worldwide, by providing branch SWIFT code and account number.

Anti-phishing solution

[overThruster]

This is not true:
>a Gartner analysis is quoted as saying "What's
>really scary about it [phishing] is right now there
> are no back-end fraud detection solutions for it."

Corillian Corporation provides an effective back end solution that is capable of detecting phishing sites as they are being built:
Corillian Fraud Detection System

Re:fake credit card numbers

[rduke15]

1) Generate fake credit card numbers that pass as "valid"

Easy: Business::CreditCard - Validate/generate credit card checksums/names.