Slashdot Mirror
Honeynet Revealing Actual Phishing Techniques
edsonie writes "CircleID is reporting on the recent Honeynet Project, 'Know your Enemy: Phishing', aimed at discovering practical information on the practice of phishing. The study reports on a number of real world examples of phishing attacks and the typical activities performed by attackers during the full lifecycle of such incidents. The research also suggests that phishing attacks "are becoming more widespread and well organized". Also with regards to the speed of such attacks, "phishing attacks can occur very rapidly, with only limited elapsed time between the initial system intrusion and a phishing web site going online with supporting spam messages to advertise the web site, and that this speed can make such attacks hard to track and prevent." Check out the full report here presenting actual techniques and tools used by phishers."
Europe
Greece - http://honeynet.phrapes.net/
Romania - http://honeynet.iasi.roedu.net/
Croatia - http://honeynet.lss.hr/
France - http://honeynet.startx.fr/
Germany - http://honeynet.fh.net/
Germany - http://honeynet.spenneberg.org/
Germany - http://project.honeynet.de/
Ireland - http://honeynet.heanet.ie/
Italy - http://honeynet.securityinfos.com/
Netherlands - http://honeynet.hackers.nl/
Netherlands - http://honeynet.evilcoder.org/
United Kingdom - http://honeynet.ntcity.co.uk/
Asia
India - http://honeynet.tiet.ac.in/
Phillipines - http://honeynet.opensourcecommunity.ph/
Singapore - http://www.security.org.sg/honeynet/
Korea - http://honeynet.secuwiz.com/
Malaysia - http://honeynet.0ni0n.org/
China - http://honeynet.xfocus.net/
South America
Brazil - http://mirror.honeynet.org.br/
North America
Canada - http://honeynet.ihackedthisbox.com/
USA, NY - http://www.clientbox.net/
USA, TX - http://honeynet.5dollarwhitebox.org/
USA, OH - http://mirror.clevelandhoneynet.org/
USA, VA - http://honeynet.streetchemist.com/
It's not a dupe, you dupe. Your 'original' is actually a different paper altogether.
According to this Gartner study (warning: PDF), the success rates for phishing are between 3-6%, similar to those for spam. It's a volume business.
#!
"Do we need honeynets to tell us there are stupid people out there?"
Good god. You use a computer a lot, and that makes a lot of people stupid BUT you? Question: Did you believe in Santa Claus growing up? Would you appreciate me calling you stupid about it?
Yeesh. Anyway, to answer your question: If Honeynets are revealing specific ways of screwing people, then specific warnings can be given out to help minimize the risk. You've never noticed how Paypal tries to very clearly explain to people not to click on paypal links in their email?
"Derp de derp."
"I looked at the first one and realized it's sophisticated enough to need to look at the source first."
Exactly the point of the test, I should think. Given that the average user isn't likely to look at source, or perhaps may not even know how to look at source, asking to judge what is a phish and what isn't purely by visual inspection helps to highlight why it is these things so often work against the unsophisticated computer user.
Well check here instead to see how they do.
> Interesting you should mention that. I've been looking to open a new money market account. There are five banks within a few blocks of my house and I figured one of them would have decent online banking. Three of them will not even load the online banking in anything but IE
Then switch banks. Wamu, Wells, and Citi all have zero problems with firefox. Call the bank and tell them why. Don't come off like some smug platform evangelist, just say "your internet banking doesn't work with my computer and theirs does". Let them wonder why.
I am no longer wasting my time with slashdot
> 1. Most people wouldn't give out a credit card number randomly over the phone
You'd be very surprised. Phishing is a variation of a scam that has been around as long as the telephone. Ever heard of the "bank examiner scam"? Hell, some brave souls were probably even doing it door to door before then, though it's easier to do charity scams that way.
I am no longer wasting my time with slashdot