Slashdot Mirror
The Evolution of the Phisher
gurps_npc writes "An article at CNN discusses the how Phishers have moved beyond the typical email scam. Last month, Secunia (Danish security firm) documented a case where a phisher somehow modified a windows host file so that when you type in the correct url in the address, it redirects you to the phisher site.
Worms and spyware are being built for the purpose of phishing, and it is also believed that phishers are attempting to compromise domain name servers. If one of these go down millions could lose their security instantly, even if they themselves have maintened the security of their computers."
And this is when users need to actually read the warnings about certificates being different than the last time accessing the site...
Again, if common-sense is used, 99% of phishing can be stopped.
wdd
...took an important turn once Native Americans discovered smoking "cannabis" herb.
Oh, that's right, Windows' nearly non-existent privilege system!
Go ahead and whine about how much better traditional Unix privileges could be. It's still better than nothing, which is what most Windows desktops have.
Exactly how is this different from password-harvesting trojans/viruses?
It's not like this is anything new.
Defenestrate Windows...
Simon called Peter, and Andrew his brother, casting a net into the sea: for they were phishers. And he saith unto them, Follow me, and I will make you phishers of men.
Jesus p0wns you.
mirror here
/. linker helper thingy fool you...it's perfectly legit. just register and you'll see the site in seconds ;)
oh, and don't let the lil
Email:
Although I could have written a very complex and well written virus that probably wouldn't work on you operating system I am asking you to reply with you account name, password and any other card numbers you might have.
I further ask that you forward this email message to all your friends and for that matter any one you don't know urging them to send me all your information.
Yours Truly,
Mr Phisher
Did I read that correctly?
A senior employee of an Internet Security firm used to think of Phishers as "petty thieves"? Maybe Paris Trudeau needs to find a new line of work.
Any phishing of that type will result in a certificate error (assuming they don't do some heavy modding of your browser as well), which I can catch. But I'm sure most of us have parents who we've told the common "If you don't understand it say Ok" - ie not the safest thing in the world, but better than being called every 2 hours. Usually this works well, since even relative illiterates understand the idea of software being installed without them specifically wanting it, and can say no. But a certificate error? Quite a few people will shrug and click OK anyway. And moreover, what will this do to the economy, considering that suddenly a far greater level of financial intrusion will now be possible?
Do not confuse "Freedom of Choice" with "Free Will".
Ok Microsoft really needs to pick up the ball on this one. They need to make an extremly obvious security certificate key information. Such that when you log onto any "secure" website it pops up information about the key authority that can be understood by all. Then they need a expansive advertising campain to tell users to look for these signs when entering confidential information, and not enter such information otherwise.
Of course then you would see popups that look identical to the key information, infact I believe I've seen a fullpage website that implemented this trick before. So any ideas on what can be done outside of a box that sits next to your computer that displays said information.
Everyone knows phish evolved into amphibians.
Didn't Jesus say in Matthew 4:19 that if we follow him he'll make us phishers of men?
(Yeah, I know that was bad, but I just couldn't resist!)
If someone says he and his monkey have nothing to hide, they almost certainly do.
Fishermen fish.
Phishermen phish.
It's not "Fishers fish".
Carrying the analogy further, IE becomes a "phishing net" and Windows becomes a "phishing boat". The intarweb may be viewed as the "ocean" and your average AOLer a dumb "phish". Smarter geeks could be viewed as smarter"dolphins".
Interesting, huh.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Another one bites the dust
My questions is who thinks that a message saying all your bank passwords need to be updated on one website is really from the bank. The bank won't even send your pin# and your atm cards to you in the same envelope. They send them a week apart from each other. Now they're asking you to submit everything? At once? Who does that?
"Somehow modified the windows hosts file."
Yes, that's pretty clever of them. Nobody would think of that. It's pretty hard to do. You will need extensive knowledge of a fucking text-editor.
Seriously, where is the news?
This is why we should all stop using DNS and just remember IPs for all our favorite sites. A nice feature for a browser or an extension would be to cache IPs and compare before connecting to a site. Imagine if the IP ever changed for a site, you would be asked immediately if you would like to continue. For sites like no-ip.com it could be annoying, but financial sites would instantly be known to have something wrong going on.
Make your computer faster: rm -rf
Banks need to start charging MS for all the money they have to "return" to customers after thay get caught by a scam like this. It must be costing them millions and alot of it is from people using Windows. I'm sure Bill would get stick his thumb out and get moving if he had several million dollars fines he can't pay in Windows 98 CDs.
I like muppets.
Wow! I had some spyware overwrite the windows etc/hosts file every time I rebooted, and I couldn't remove it. The solution (for me) was backing up the hosts file and surfing under a user account to prevent a similar kind of infection.
If Admins can modify this file willy-nilly, then could be a major problem for users who haven't bothered to create user accounts.
rj
Robert Nagle, Idiotprogrammer, Houston
I would be very concerned if someone who owns/runs a DNS server was not net-savvy enough to avoid phishing scams.
Sometimes, the simplest things you do can make all the difference whether your account gets compromised or not.
OCO is Loco
Car - horseless carraige.
If you give a man a fish, he will eat for a day. If you teach a man to phish, he will steal your money, and buy enough fish to eat for life.
I scrolled down the posts, looking and looking for someone to address the problem of DNS compromise.
You nailed it, thus the +Insightful -- and throw in some +Funny, for good measure.
-kgj
-kgj
I have noticed this lately as well... so now I scrutenize every email I get, hovering over links, and occasionally, entering the first line or so into google. I do consider myself to be pretty good at figuring out if it's a phish or not though. I found a fun little phishing-finding-outting test to take on i-am-bored.com. Try it out and see how well you do!
~/.sig: No such file or directory
Who trusts the Department of Homeland Security to help secure DNS with a task force from their Cybersecurity department?
--
make install -not war
Computers were not made to be safe, much less the internet. Anyone who thinks that by accessing his bank online, they're not risking anything, is just heavily misguided. Anyone who does online banking, shopping and so on, is at risk.
If you don't want those risks, go doing those tasks the traditional way.
The AACS key is NOT 0xF606EEFD628B1CA427BEA93A9CA9773F
Folks, let's do the math:
Phishers do not need to be successful very often. Think sperm here: if conditions are right, most of time only one gets lucky 20% of the time. (Sorry for the anchorman gag)
Consider the facts:
1) Only a few sites transact critical personal data (Credit cards, identity info) without proper security
2) Only a few sites use security certificates that are A) out of date B) for a different site C) otheerwise invalid.
3) only a modest majority of IE users have been trained into clicking "OK" on every security warning they see, especially for sites they know they trust.
If a phisher jacks a DNS, if they're good and have volume, they'll only go for 1); the certification warnings in 2) are worthless. They're worthless for two reasons. First, browser sgives the user the option of proceeding. Second, browsers don't distinguish between unimportant in-the-clear transmissions and stuff that looks like credit card numbers and identity information. Ideally, all browsers should have a cert mismatch not be an "ignorable" offense, but be one that causes the connection to fail.
3) As a backup, any attempt at in-the-clear transmission of numeric data longer than 5 digits should cause a whole storm of scary looking warnings (get rid of the "saturate the user with needless warnings" garbage that does more harm than good) stating that this is a really bad idea if it's anything valuable and to please, for the love of jeebus, reconsider.
I have no doubt they're hammering away at DNSs around the world; and they'll probably get one.
Oh yeah, and Mandatory Email encrpytion should be enabled, dammit.
I am surprised dnssec tsig et al haven't really
taken. The technology's been around for some
time in one form or another but hasn't been
adopted by many if any tlds and the root zone.
That should render DNS attacks ineffective for
phishing attacks provided keys were properly
secured.
I'd like to see a pair of domain names:
a) the real site (e.g. www.bankofamerica.com)
b) its phisher version (probably hosted in a lawless country)
Here's where our laws are truly screwed up.
On the one hand, downloading music from "unauthorized" sources such as P2P networks will get million dollar fines and, if the companies get their way, jail time, when there is actually no evidence that they are causing a loss of revenue (even if they are technically violating copyright law).
Meanwhile, people who write spyware, break into computers and DELETE data, shut down networks, and attack DNS servers in order to disrupt all traffic on the Net (roughly the online equivalent of putting tacks all over a major expressway junction) get.... what? Really, I have no problem with seeing these people get 20-life hard time.
When will the people who [ run the country | have money | bought Congress ] realize who the real threat to the Internet and to their bottom line is? It's not cheap Britney Spears fans. It's the people trying to break the Internet in order to get better advertising.
Oh wait, I forgot. Advertising is always good, because companies do it, so they can't object when someone tries to advertise. Silly me. Greedy SOBs have to stick together.
--GrouchoMarx
Card-carrying member of the EFF, FSF, and ACLU. Are you?
The simply answer: for all places where you have sensitive information, bookmark an SSL-enabled url.
For example, instead of logging into your bank by typing in "www.mybank.com", bookmark their login info like:
https://www.mybank.com/login.bnk?gz=1
Or whatever.
When you visit the https url, even if a phisher has completely altered dns and hijacked your connection, they do not have the private key for the institution.
If you want to be paranoid, save your institutions certificates locally so that even if a hijacked compromised a root server and spoofed a response AND got a cert issued for the legitimate domain (which, as anyone familiar with it knows, is not that hard), they still can't trick your browser.
Really, all institutions containing sensitive data should establish secondary data channels as well - like, any time you log into your bank or brokerage, you should be able to specify an email address...say, of your cell phone.... which will receive an email saying you just logged in. Then someone who manages to get your info still can't effectively use it.
I just keep a copy of the IP addresses to all of the sites that I visit on a piece of paper. Who needs DNS anyway?
Seriously though, any reason why the kernel's DNS-lookup procedure couldn't be changed to verify the IP through N servers instead of just the primary server? Of course, if one of the root dns servers go down, then that's it, but it's more likely that YOUR ISP's box will get rooted.
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
Most phishing sites use images pulled from the real sites, as well as direct people to them when they are done entering their information. Many banks and sites such as paypal could easily track these people by watching their referral logs and looking for foreign referrals to things such as their navigation images. They could then contact the nocs of ISPs who are unknowingly hosting them on hacked machines to get them taken down immediately. Most ISPs are extremely willing to take these down quickly, I've had quite a few respond to me within minutes when I've informed them. Eventually phishers would just grab the whole site and host the images as well, but the increased bandwidth would be more likely to be noticed.
Mail clients should also notify users when the displayed http:// url differs from the actual href.
A better fix would be for banks and other organizations to set up contact addresses for people to inform them. Many of them take days to read feedback I've sent them regarding someone trying to scam their customers.
The senior employee was talking to the general public and how they may have viewed phishers in the past and how they should now view the phenomenon.
The passage you quoted said nothing of his own personal or professional views on the matter.
You. Fucking. Moron.
The article was a little vague on this point, but aren't Phisher scams where you pretend to be a slightly paranoid ex-chess geinus hiding out in Japan?
HA! I just wasted some of your bandwidth with a frivolous sig!
Comment removed based on user account deletion
it is also believed that phishers are attempting to compromise domain name servers.
To: hostmaster@arl.army.mil
From: no_really_i_am_the_management@H.ROOT-SERVERS.NET
Reply-To: somekid@nigeria_or_china_or_bulgaria.net
Subject: Account Maintenance
Dear hostmaster;
We have monitored spam coming from your account, and
you must take immediate action to prevent your account
from being deactivated. Please reply with your account
name and password to ensure continued access to your
account.
Yours Truly,
H.ROOT-SERVERS.NET management
I have online access, but all I can do is transfer between my savings and checking accounts. I told my bank that is all I will do and any other transactions are automatically fraudulant.
I'm typing this in a normal user account in XP with no special privileges. There's no way this account can write to the Windows hosts-file, except for a root-exploit. I've set most files to read-only.
Actually, the XPs security system is more sophisticated than the typical UNIX file-attributes. The only stupid thing is that it's global RW by default, and the installation routine doesn't create an unprivileged account for the people to use.
Of course, it made Microsoft more money to make it easy for people, and now we're all paying the price for the stupidity..
http://www.debunkingskeptics.com/
Since the tactic mentioned involves editing hosts to redirect a site, doesn't that already mean that the system has been owned by a virus/trojan? At that point the game is already lost
Does anybody really think that compromising a root DNS server will suddenly redirect customers of e.g. Citibank to a phishers site and it wouldn't be immediately noticed ? C'mon:
- DNS is distributed and any change in DNS takes a while to propagate (on the order of days). Moreover, more and more sites are switching for digitally signed updates to DNS, so bogus updates have no chance to go through.
- Do you really think that e.g. a bank or eBay would not notice that somebody hijacked their domain? The only think a potential phisher would achieve is to attract a very close attention to himself and very quickly at that.
More credible threat are tricks like changing the hosts file, however with that we are in the domain of common adware/spyware which hijacks the browsers on Windows routinely.
Finally, any bank worth my money does not use just a stupid username/password for authentication! Most European banks have as a standard feature a challenge/response mechanism (in addition to the username/password pair).
Some banks even go that far, that they issue you a smartcard with a pocket "calculator", which generates correct responses to the challenges from the bank. The smartcard is used as a seed for this and is protected with its own PIN that you have to enter before typing in the challenge code from the bank. The codes transmitted are usable just once, so they are completely useless to the phisher. Oh the mindless scaremongering ...
sure enough, we break DOWn, get broadband & a membership (already_gone) on robbIE's blog, & a posting we will goo?
not for long. without even so much as a mynuts won: consitently annoying, we're PostBlocked yet again. makes dialup look ever so much more attractive in relation to freedom of speech/anonymity, etc...
no matter. lookout bullow. the daze of the whoreabull corepirate nazi felon execrable are WANing.
consult with/trust in yOUR creators, using newclear power to rescue the planet/population since/until forever. see you there?
as for robbIE's corepirate nazi suckup blog, phewww!@#$%
Rather than Microsoft and I.E., Mozilla and Firefox.
emt 377 emt 4
Why bother using https at all? How many people do you think actually check for that little lock symbol in their browser.
What's to keep them from sticking in a Verisign graphic just to look safe? Think they're going to be stopped by copyright law?
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Why do you think they're going to use HTTPS? How many people actually look for the lock symbol?
No HTTPS, no prompt whether to accept a new certificate.
If you want to be even nastier I think you can set up Apache so it will use a "null" cipher. I'm not sure whether certificates are even needed in that case, but to anyone who doesn't drill through the "security" dialogs it will look like a genuine site.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
You would have to write a specific library, indeed a specific version of the library - and then you still woulnd't be sure what you'd be fooling.
While you could do that, no-ine has done it yet - whereas in the story it noted a case of the Windows host file being modified already.
I would say modifying a text file is an order of magnitude or two easier than creating a working resolver spoofing library and getting it installed.
On top of all that, you'd only have installed it for one user of the box.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I went to ESPN looking for when they broadcast the X-chess games, but no luck - what channel are these on?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
"somehow modified a windows host file so that when you type in the correct url in the address, it redirects you to the phisher site" I'd say lmhosts file was the somehow. I did the same thing to redirect my boss to a fake spoof website of our company's with Mr T. on it for April Fools last year. ;-)
SecurID helps, but basically you can have the spoof site act as a passthrough and use the information the user is feeding real-time to log the spoofer in behind the scenes - more hands-on for sure though, as you'd have to do whatever you were up to at that time instead of just logging account names and passwords...
Also potentially if you knew the users PIN and a few correct passcodes/times, I think you can crack the token and have your way with the server. I forget how or if that really works though.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
You don't have to compromise a root DNS server to wreak havoc. It would be enough to compromise the DNS servers for a small or medium sized ISP. That way, everyone who used that ISP would get false DNS results.
Buy a Mac.
No help if DNS servers get compromised, but I think that's a lot less likley. After all, they aren't generally Windows boxes.
Sorry, had to be said... while you can do all the things you mentioned I know most people wuld not go that far.
Also, I feel somewhat uncomfortable storing any links to me bank on the computer lest someone steal it. Of course it's not like I always remember to clear out browser history and caches after I visit...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
You are assuming they're running XP or 2000/NT, and as a non-admin user. How many Windows users are still on 9x or ME?
The first Internet worm was long before 32-bit Windows hit the scene. For BillG and co. to release an OS touted as "Where do you want to go today?", while ignoring even basic privileges, was negligent at least, and criminal at worst.
I've always worried about either terrorists or the FBI conducting an attack on the populace where a component of that attack was causing mass confusion and disturbing communication (e-mail and blogs) via a DNS takeover.
DNS is a weak point. Sure, "only" 99% of Internet users rely on one of the main DNS servers, and, sure, like all censorship on the Internet, the Internet will route around it. But confusing/misinforming 99% of the people for an hour, or at least several minutes, would be enough for some purposes.
Cheers.
If the people who aren't bright enough to spot more obvious scams leave the internet - we'll be better off :)
Install a key-logger -- and eliminate the need to have the victim go to a fake site.
Add their own certificates to the root certificates store, so that the victim can be (re)directed to an SSL phishing site without any certificate errors.
Either way, it seems a little pointless to modify the hosts file alone.
The real "Libtards" are the Libertarians!
I've seen this done with a phishing scam on my bank...
s cam.php
You click on the typical link that's for http://www.bank.com.ewroijwer.@somewhere.illegal/
That the returns a page which pops up a toolbarless window saying "Please verify your account information...". It then reloads the main window so it actually displays https://www.bank.com
That way you see your banks homepage, you see the lock icon, the certificate checks out, but the popup window asking for your account information isn't secure and posts information to russia.
I was very very impressed - took me a while to realize what they were doing.
um... three words actually: FUD
I am writing a movie caller The Phisher King. It's about a guy who was scammed out of all his money by a internet conman and goes crazy. He meets up with a slick internet conman on the street and through a bond of guilt/friendship reforms the evil con artist. It's gonna be a tearjerker.
People who bite the hand that feeds them usually lick the boot that kicks them
If the problem gets too serious (and I'm not convinced it has, yet) maybe Banks will have to take a step backwards into the old world of Specialized Apps for online banking.
You go to the Bank, they give you a CD with the "National Bank Online Transaction" application, which you install and it does that one thing. Connects to a specific IP address, verifies the heck out of you, and allows you to do nothing but Banking.
But then you'll have wizeguys distributing hacked CDs....
Everything about phishing comes down to this: The passwords are reusable. If you can just get the password from the user once, you can whatever you want. In scandinavia, all banks use RSA-tokens or lists whith one-time passwords (these are rare nowadays). The file on the token is secret, and the pin that the user puts into the token never have to be plotted into a computer, so that's secret too. The password you get out only lasts for a minute. US banks apparently has the security level of Hotmail. Scandinavian banks (and probably most european) have had this system for like 10 years. Should I laugh or cry?
I love getting phishing e-mails. I dutifully go to the fishing link (from a safe web browser and operating system, of course) and fill out their form:
Name: Phishers R Losers
Address: 123 Get A Life Lane
etc.
Funny, yes, Insightful, no.
You're right. I posted too quickly.
What I really want to know: what about DNS hijacking? What's the threat, what's the answer?
-kgj
-kgj
I know on /. this will probably be a hanging offense,But why are you linux guys so hung up on the admin/user bit?If you stick a monkey(average dumbass)on a internet pc it WON'T matter whether he's the admin because he'll pick the "yes i would like free pr0n button"and the virus/spyware writer will do the rest.I've been running my win2k box on the net for 4 YEARS straight without A SINGLE bug(And yes,I'm running as admin the whole time)
How do I do it?Because I'm not a MONKEY!I ALWAYS put on a firewall before connecting to the net,ALWAYS install the latest AVG antivirus before I do anything else.People need to take care of their own @ss.We don't expect the government to make all roads have 20MPH speedlimits just because morons walk out in front of cars,Why should we expect them to make the net safe for the idiots who click the "yes,i want free (insert cash,pr0n,stuff)button?
The only thing we as a people should worry about is the DNS servers.That would be like letting a robber take over the freeway.As for the rest?Oh,Look-Another monkey got hit by a truck,How sad.If they don't have the brains to use the medium with at LEAST a little bit of sense,Then let the monkies get hit.
ACs don't waste your time replying, your posts are never seen by me.
It's because of all those damned terrorists, the government has to hire lots of people very quickly and can't make a deep background check.
And given the reputation of Sam Fisher, they where bound to hire a crook calling himself Sam Phisher.
"Thanks you, thank you, I'm here all week..."
And who don't have the sense to manually edit the security permissions on the hosts file to "read only", even for administrators. (Which is mostly the same group, I admit.) When I need to hand edit hosts, I change it back for a little bit, and then lock it up again.
Similarly, inserting empty install target directories into /Program Files for the usual spyware suspects and removing ALL permissions from those folders causes most spyware installers to crash nicely. Of course, it's only a matter of time before the spyware writers fix that, and it only works for known install locations, but it's just one more stumbling block to put in spyware's way.
On the other hand, this little trick doesn't WORK in XP-Home... a compelling arguement for upgrading (or sticking with 2K) IMHO.
//Information does not want to be free; it wants to breed.
Gosh darn it! I thought I was the first one to come up with this idea.
Actually I took it one step further. I combined my previous brilliant idea (Controlling Zombies Anonymously Via Google - http://sagar.org/malbot/.
This is what I came us with: Building a Better Phishing Rod (http://sagar.org/malbot/building_a_better_phishin g_rod.pdf)
Sorry it's a PDF, I was in the process of drafting it this week before tweaking to HTML. How could I have known CNN would cover 'my invention'.
This person clearly does not understand how: - Phishing works - Certificates work Yes, users would not gt compromised if they use common sense. Well, they don't. No matter what we say. Phisher hit rates are quite low but they are there.
Of course Linux is fine, but currently not an easy solution for most people.
Two is three, as you will see...
I think you misunderstood (3), here I am saying that I do not bookmark my bank URL's - I type them by hand. Why that is more insecure (assuming DNS is OK) is beyond me. You can manually type HTTPS urls as well you know.
I would say a bookmark would be slightly more risky, if only because in theory a browser compromise could lead to bookmark re-writes (something I wonder I have not yet heard happening in IE yet!). My typing by hand is as secure as DNS, which is about as good as you can get. Even typing in the IP I think could be more dangerous, what if the bank moved the server for some reason and a spoofer managed to set up on he old address after a while? Pretty remote but more likely than DNS being compromised in any lasting way.
And as I said people stealing the computer might be able to get to your bookmarks.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
This is about MONEY. The people committing the crimes are CRIMINALS. Surprised at someone's clue level raising enough to speculate that criminals might target DNS to obtain cash? If the technology can be used as a means to money, it WILL be used, if it isn't ALREADY being used. The only news here is that someone other than the criminal did clue++.
http://shit.slashdot.org/article.pl?sid=05/01/20/2 030201
Watch out for fake caller ID phishers... Imagine getting a call from the police, FBI, Wells Fargo, someone famous, etc.. at least that's what it says on your caller ID.. Its been happening in Denver.. should start getting nasty soon.
As a general rule of thumb, I find the main error in these statements is that people forget to include themselves.
Probably the most important ability to modern humans is to socialize well. Typically, running around calling everyone else "functionally retarded" is...not such a promising sign of great ability in that critical field.
Not to mention that one often fails to realize that those "functionally retarded" people may in fact be extremely skilled, smart, or well-educated, but simply in different fields. Electrician? Chef? Historian? Lawyer? None of them have great need of l33t computer skillz, but dismissing them all as "functionally retarded" is...well, we've discussed that already.
Modern humanity lives in a complex society where it is not optional to rely on and value the differing skills of others. To be unable to realize and do that is to be functionally retarded.
Just sayin'.
...when phishing consisted mainly of dirty dreadlocks, dank nugs, veggie burritos, and lizards?
*tries to set keyboard type to devorak -- ACCESS GRANTED*
Linux also lets unprivileged (guest) users to set the keyboard type to devorak, but not *globally*. Since I had made my account guest I had assumed that I wouldn't not be able to accidently mess up global settings. I was wrong.
Running XP as guest means most applications won't work correctly; You will have to deal with hundreds of popups on startup warning you that various quick start applications can't run; You may not be able to access the "public" documents stored in "All Users"; You will still be able to accidentally screw the machine you are on; as I understand viruses will still be able to root your system.
I don't really see the point of running as "guest" on an XP box.
The idea is that they install their public key as a trusted CA just like verisign. If you don't believe me, open MSIE and go to tools, internet options, content, publishers, trusted root certification authorities and you will see an import button which you can use to add your own public key to the list of trusted root CAs like verisign. Once that is done you can sign certificates yourself just like verisign does and they will be accepted as valid on the system you just imported yourself as a root CA on. If you were to create a worm that installed your public key as a root CA in addition to modifying the hosts file, you could self sign your phishing site and to MSIE it would appear as trustworthy as verisign. Unless the user manually checked the name of the CA and actually called (on the telephone, the worm could redirect access to verisign.com too) verisign (otherwise the worm could just overwrite verisign's public key with it's own) to verify the fingerprint the user would never know.
A lot of people have said "check the certificates". Well, I've seen local (Australian) banks use bad certificates! Yes, the Commonwealth Bank's website has at various times provided invalid certificates, usually due to not updating them quick enough. So, when you go to their secure section, you would get a warning box! Yet it really was the right site.
I've been working on some material to counter-attack email phishers directly at their puny (hopefully) servers. Does anyone know of any new software projects that help feed tons of false information into the phishers' web forms (to their database)? As a Linux mail server admin, I've been getting royally pissed with the amount of email scams that have gotten through my 5-stage spam filter (even though most are stopped; I want *zero* to get through; I might add some detection for this stuff). My guess (correct me if i'm wrong) is that if people like us can dilute the phishing databases (similar to the idea of web honeypots to screw up email bots), hopefully the attackers can become somewhat crippled. Or just post an address like this one on Slashdot ;) (that's one lame phisher's email submission address - looks like it's on a private machine in hong kong) - never underestimate the Slashdot effect; you'll be sorry.
:-/
So the bottom line is that there has to be something that us admins/whitehats/slackers/geeks etc can do -
#Secret Windows Source Code, in MS C% - if (uptime >= "24 hours") then bsod() else print "Windows License Violation!"
Though this may be getting a little offtopic, I think it is a valid question and should be addressed.
But why are you linux guys so hung up on the admin/user bit?
From what I was able to gather from your post, you are trying to convey to everyone that it should not matter if a user runs under a "Limited" account, or an "Administrator" account (using Windows terminology).
Unix was designed with multiple users in mind. In fact, many system services run under their own user account. The one, all powerful account is 'root', and is normally used only under special circumstances (i.e. installing a software package). Most other times, even the sysadmin logs on to a limited user account.
The theory is, a system service can only do so much damage as it's user account permits. Similarly, a user can only do so much damage as his/her account permits. If there is some hole in MySQL server, and an attacker is able to exploit it, they gain all the privilages of the MySQL user account. The rest of the system should theoretically remain unaffected.
What does this have to do with Windows? In my experience in a computer repair shop, I have fixed XP box after XP box brought to it's knees by viruses and spyware. The removal of these malware programs can prove to be a quite tedious undertaking, because the entire family who owns the computer each has their own Administrator logon account. If the RPC service is comprimised (a la Blaster), it was running with Administrator privileges and the whole system is vulnerable. If a web site exploits a flaw in IE, the whole system is vulnerable because the user runs as Administrator.
Windows XP is simply designed to where home users need to have administrator privilages, otherwise many things will not seem to work right. For example, many DirectX games will not load at all unless run as an Administrator.
So to answer your question, a "stupid" user could only do so much damage with a unix-based security model. Lets imagine a family using a Linux computer. Assuming a 13 year old kid installed a program that secretly contained a keylogger, the keylogger would be powerless against the mother and father. The keylogger could not wedge itself deep down in the system files, therefore cleaning it would be a relatively painless task for a moderately competent user.
In conclusion, I would like to say that the fact you have never had any unexpected malware (spyware, viruses, etc) installed on your windows machine whatsoever is unusual. You are either mistaken, haven't used your computer much, or are both smart AND lucky. This is my understanding of the current state of security affairs as far as Windows and *nix are concerned - if anyone has anything to add, I'd like to hear it.
I would hope everyone that visits slashdot probably knows most of this, but may not know how to explain it clearly to a non-savvy relative or friend. I beleive this advice is the best available for such folk, I give permission for it to be copied, pasted, printed, etc, by anyone hoping to help anyone they know avoid being taken in by a scammer.
-----
DO NOT click on links in any email you receive that purports to be from any organization or company that has anything to do with your finances, credit, identity, or security.
If you receive such an email, and you are not 100% sure that you know how to check it for authenticity (which involves checking the full headers of the message, as well as the full source of the message to see the *actual* URL of any included links [which in a phish email, may differ greatly from the URL your end-user email program displays in the message]), then DO NOT CLICK.
If you suspect such a message may really from who it purports to be, then call them directly, and explain that you are concerned about the email and ask that they confirm its content as legitimate (most of the time, that would mean calling them - if the email says not to call, thats a pretty good sign that its fake - no legitimate company would discourage calling to verify the legitimacy of such an email.) It may also be a good idea to suggest that they avoid using email in that manner, to avoid any possibility of their customers falling victim to forgeries.
If the message claims your account or access is suspended, *STILL* DO NOT CLICK. Instead, close the message, open a *NEW* browser window, and TYPE IN BY HAND the normal URL that you use to access that account or site, (and if the site involves money, or SSN's, that URL should start with https://, NOT http:// (note the 's'), and log in normally. If your account works and no notices are shown about it being suspended or whatever, thats a pretty good sign the email was a fake. Again, if you are remotely unsure, *CALL* them and ask. If its a bank, you should have a way to call them.
Two popular targets for the scammers are eBay and Paypal - email from either of those two sites will *always* include your full real name, it will NEVER say 'Dear PayPal user' or 'Deay valued ebay customer', or anything like that. If you are John Henry Smith, the email will say exactly that - 'Dear John Henry Smith'. Any email from either of those that doesnt have your full real name is pretty much guaranteed to be a fake.