Slashdot Mirror
The Evolution of the Phisher
gurps_npc writes "An article at CNN discusses the how Phishers have moved beyond the typical email scam. Last month, Secunia (Danish security firm) documented a case where a phisher somehow modified a windows host file so that when you type in the correct url in the address, it redirects you to the phisher site.
Worms and spyware are being built for the purpose of phishing, and it is also believed that phishers are attempting to compromise domain name servers. If one of these go down millions could lose their security instantly, even if they themselves have maintened the security of their computers."
And this is when users need to actually read the warnings about certificates being different than the last time accessing the site...
Again, if common-sense is used, 99% of phishing can be stopped.
wdd
Simon called Peter, and Andrew his brother, casting a net into the sea: for they were phishers. And he saith unto them, Follow me, and I will make you phishers of men.
Jesus p0wns you.
Email:
Although I could have written a very complex and well written virus that probably wouldn't work on you operating system I am asking you to reply with you account name, password and any other card numbers you might have.
I further ask that you forward this email message to all your friends and for that matter any one you don't know urging them to send me all your information.
Yours Truly,
Mr Phisher
Everyone knows phish evolved into amphibians.
Fishermen fish.
Phishermen phish.
It's not "Fishers fish".
Carrying the analogy further, IE becomes a "phishing net" and Windows becomes a "phishing boat". The intarweb may be viewed as the "ocean" and your average AOLer a dumb "phish". Smarter geeks could be viewed as smarter"dolphins".
Interesting, huh.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Another one bites the dust
I was going to mod you off topic...
But I'll bite - attacks on DNS servers will direct everyone to the wrong site, Windows, Linux, UNIX, and Amiga users.
Sorry.
Get your Unix fortune now!
Here's where our laws are truly screwed up.
On the one hand, downloading music from "unauthorized" sources such as P2P networks will get million dollar fines and, if the companies get their way, jail time, when there is actually no evidence that they are causing a loss of revenue (even if they are technically violating copyright law).
Meanwhile, people who write spyware, break into computers and DELETE data, shut down networks, and attack DNS servers in order to disrupt all traffic on the Net (roughly the online equivalent of putting tacks all over a major expressway junction) get.... what? Really, I have no problem with seeing these people get 20-life hard time.
When will the people who [ run the country | have money | bought Congress ] realize who the real threat to the Internet and to their bottom line is? It's not cheap Britney Spears fans. It's the people trying to break the Internet in order to get better advertising.
Oh wait, I forgot. Advertising is always good, because companies do it, so they can't object when someone tries to advertise. Silly me. Greedy SOBs have to stick together.
--GrouchoMarx
Card-carrying member of the EFF, FSF, and ACLU. Are you?
Most phishing sites use images pulled from the real sites, as well as direct people to them when they are done entering their information. Many banks and sites such as paypal could easily track these people by watching their referral logs and looking for foreign referrals to things such as their navigation images. They could then contact the nocs of ISPs who are unknowingly hosting them on hacked machines to get them taken down immediately. Most ISPs are extremely willing to take these down quickly, I've had quite a few respond to me within minutes when I've informed them. Eventually phishers would just grab the whole site and host the images as well, but the increased bandwidth would be more likely to be noticed.
Mail clients should also notify users when the displayed http:// url differs from the actual href.
A better fix would be for banks and other organizations to set up contact addresses for people to inform them. Many of them take days to read feedback I've sent them regarding someone trying to scam their customers.
Oh, that's right, Windows' nearly non-existent privilege system!
Hmm... lets see.
*runs regedit, tries to modify system registry keys -- ACCESS DENIED*
*runs setup.exe, windows prompts for administrator password, I don't provide it -- ACCESS DENIED*
*try to delete or modify a file on C:\Windows, or C:\Program Files\ -- ACCESS DENIED*
*go into Hardware > Device Manager , tries to change hardware settings -- ACCESS DENIED*
etc...
I dunno... seems to be working pretty well from here.
Don't confuse users choosing to run as root as having a failing privilidge system. Remove your account from the Administrator group and into the User group, and you'll see how extensive the privilidge system is. Conversely, use root as your daily linux account and see how much protection that gives you.
Now, you have the situation where a hostile stranger poses as a man in the uniform asking joe citizen to do what he's been trained all his life to -- show his papers, give his numbers, sign right here... are you surprised at the results?
Computers are useless. They can only give you answers.
-- Pablo Picasso
I recently opened a new account and they told me "oh, by the way, online banking is free! All you have to do is XYZ to start using it." It turns out my account was already open to all comers if they happened to know my account number and part of my SSN. So I was FORCED to at least set a password. No, I haven't yet written a letter to the bank, because I don't think it will really do any good.
Eventually, as banks find higher profit in not providing physical branches, most people will be forced to do their banking online. In ten years I think we'll find there's not much choice. We'll actually have to pay extra fees NOT to do it that way.