Slashdot Mirror
Phishing Steals Spotlight at MIT Conference
Bob Brown writes "Companies are coping with spam, but phishing is another matter altogether, according to researchers at the annual MIT Spam Conference this week. From the article: "The response rate for phishing e-mails is much higher than for spam, says Paul Judge, CTO of messaging security maker CipherTrust. So while spammers have to send more and more unsolicited e-mail these days, as anti-spam filters get better at identifying and blocking spam, phishing attacks are well enough disguised that a higher percentage get through such filters, and more recipients click on them, he says."
If you're stupid enough to fall for these scams, tough shit.
Unlike viruses which waste bandwidth, further spam via spam zombies, and endangers the internet due to their destructive nature, phishing is one thing I really could give two rats' asses about.
Next you're going to want me to get all up in arms about Nigerian 419 emails. Fuck it, I've got important things to worry about.
The response rate for phishing e-mails is much higher than for spam, says Paul Judge, CTO of messaging security maker CipherTrust.
Gee, I wonder why...
Which would you click on? (Under the assumption you're a BoA customer)
Cl1ck H33RE F0R S|0ft V1A_GR_A!!!!!
or
Click here to update your account information.
Its a matter of logic. You can expect people to fall for things that look legitimate, not the things that just look utterly retarded, like most spam these days.
First phishing steals identities and now its stealing spotlights, too? And not just any spotlights, either - but MIT spotlights! This has got to stop...
Hexy - a strategy game for iPhone/iPod Touch
I rank 'em right up there with the spyware guys - send all the rats to this site
Username: [-----------]
Password: [-----------]
[Submit]
Proof by very large bribes. QED.
http://reportphish.org/
Also, those of you who use GMail, there is a "Report Phishing" option under "More Options"
I keep getting chase banking emails, even though I don't have an account with chase.
The emails say something to the effect of "bla bla, because of recent security issues, you have to reset your password or your account will be closed within 24 hours."
The thing is, these emails I've been getting lately look professional and legit. If I was a grandma or ininformed parent I would have clicked on them and likely have my credit account wiped. The email address states "blabla@chase.com" and even the spoofing address looks legit.
Don't know what we can do about it other than educate people to call their banks and confirm, log onto the banks real address, and not click on any address in an email.
From the article: Among these were a proposal to improve Bayesian filter accuracy, a system for generating temporary e-mail addresses so that a person's preferred address doesn't have to be given out, spam filters based on adaptive neural networks, a new message-verification platform. (emphasis added)
This is called "keyed e-mail". I have used a keyed email system from Zoemail in the past and it works very, very well for this purpose. There is some extra time required for managing the keys, but the idea works great for me. (and no I do not work for them... I just think the technology works.)
$nice = $webHosting + $domainNames + $sslCerts
I guess one thing phishing sites get is accurate information. After all, if you're computer-savvy you might not enter information into the site. But if you're not, you're likely to enter correct information.
/user(name)?/ and /pass(word)?/ and submit values accordingly.
Perhaps someone can create a charity web site, where you submit the URL of a phishing site, and then it goes and submits millions of randomly generated username/password combinations to the phishing site?
Would be relatively simple to create, just web-scrape for the words
At least then the phishers won't altogether have a super simple ride.
Perhaps a bunch of volunteers could run such a website for counter-attacking phishers.. at least until the feds shut each phisher down.
The cure for phishing is very simple - Don't use an email client that supports HTML in email. Read all emails as text only.
This has the following advantages:
1) There's no clicking on links - if you want to go to a referenced website, you have to think a little.
2) Links to phishes are very obvious when you see the whole URL.
3) Most Phishes sent as multipart alternative don't even have a
phish attempt in the text-only part.
In addition, because you're not loading any images referenced in HTML, the whole WebBug thing doesn't work.
HTML in email was a terrible idea. It's time to stop.
Especially if they catch you off guard. I consider myself as savvy as most on /. but even I've done double-takes on some of the better phishing schemes...esp when they catch me at a particularly hectic moment AND the email comes from some place I had been dealing with that very day.
I've never fallen for one obviously, but just the fact I have to stop and check things out for Kosherability shows how insidious phishing has become. There is just no way someone like my wife who is just savvy enough to browse the web and read email could spot the difference (which is why i severely restrict her browsing/email habits, but not every newbie is so lucky to have the surf-nazi on their back!)
There is a LOT of potential here for the unscrupulous. I don't even think phishing has even remotely reached its peak yet.
Random_Amber
Web page of the conference
If you visit a website and initiate an SSL session, the public-private key cryptography (along with the public root certificates imbedded in your browser) will verify that the website you're visiting is really who they say they are. (Or at least that Verisign thinks they are legit.)
I don't see why companies don't make a similar effort to cryptographically authenticate their e-mail. People use PGP for security advisories etc......, but I don't understand why all e-mail coming from my bank, coming from Paypal etc... shouldn't be signed.
If there was a portion of your e-mail window at the bottom right hand of your screen that said stuff like:
"This is an authentic e-mail from BankOfBlanBlah signed on 3/31/06 at 3:52PM" or "This is an unsigned e-mail. It is possible that this e-mail is fraudulent." or "This e-mail has an incorrect signature. It is highly possible that its contents are fraudulent."
My rough guess that e-mail authentication isn't done because (1) programmers are lazy and sending plain text is easier to program and (2) The way you do e-mail auth in e-mail clients is all different and a huge mess from a usability standpoint.
It might put at least a dent in some of this phishing stuff if people expected all e-mail from e-bay, paypal, their bank, amazon etc... to be signed.
I've gotten a few phishing emails, and man...when they guess a bank/credit card I actually use, my heart just jumps. I mean...I'm aware of phishing, and I know how to safely confirm whether the email is legit or not if I can't tell by looking at it, but there's always that second or two of real panic when I read the part about "problem with my account" and worry that it could be real. Spam I can safely ignore: even if some spam offers are legitamately good deals, they're still mostly just trying to sell me things I don't need to buy. I can safely ignore a regular spam and not worry I'm going to regret it later. But I can't do that if the message says my bank account has a problem. I have to deal with it right then and there...even if dealing with it just means proving to myself the email is bogus. So putting myself in the shoes of a less internet savy type who may not have heard of "phishing", I'm not the least bit surprised phishing emails get more hits.
DON'T CLICK ON BANK OF AMERICA EMAIL! ITS A SCAM!!!!
because the moron sent their warning out to the entire company. It's like an idiot test.
Phishing is easier than spam to combat because it is constrained by the requirement to look authentic. And that can be used to virtually eliminate it.
Well, excuse me if I can't keep all your fscking domains straight, Citibank! How am I supposed to spot a phishing attack when you have 18 URLs on your list of valid ones? I think you could do a lot to help folks spot phishing emails if you would restrict yourself to your citibank.com domain. Then folks could remember, "You want citibank? Go to citibank.com."
"Avoid employing unlucky people - throw half of the pile of CVs in the bin without reading them." -- David Brent
Again, I shall plug my own anti-phishing Firefox extension: http://www.maryanovsky.com/sasha/smokedsalmon/.
It currently does the following:
It's not particularly useful at the moment though, because the database is empty :-)
The phishing scam works because people are stupid. There is no amount of technology you can employ to save an idiot from himself. This is the sad reality.
The best way to deal with this is to promote a healthy dose of cynacism amongst the populace.
Well, another way is to force ISPs to filter port 25 traffic on broadband and eliminate the value of zombie PCs being part of the scam network.
I just got the third in a week. First two were from the same Phisherman posing as an eBay buyer (precisionlaptops4u).
Got another yesterday posing as a paypal email.
To try to expose these clowns, I do a reverse DNS lookup, a WHOIS lookup, and Google on key words, and publish the results on my Blog. http://mrlinuxhead.blogspot.com/
The IP address, port scans, who the domain owner is, the street address, email address and phone numbers, whatever I can find out about them I publish for the local authorities to deal with.
Even if the web server administrator is blameless, they will get enough attention to take action. One common infection I have notice across all of the servers is a W32.MyDoom infection. Anyone else see that?
I may be bad with names, but I'll never forget your IP address
Aside from the email-protection activities, what the banks, paypal, etc. also ought to be doing are active poisoning attacks on phishers - when somebody gets an obvious phish from examplebank.phishersite.com and forwards, Examplebank ought to click on the links in the mail, put in a fake credit card number, and then nail anybody who tries to use the card. Once phishers start getting 99% of their phished credit card numbers being invalid and 1% leading to successful prosecutions, there'll be a lot less phishing. It won't kill it all, but if you get rid of the low-hanging fruit, you can at least cut back on a lot of the spam and discourage the dumber half of the phishing business.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
It was related to my Yahoo! account. It was like 3:30 AM in the morning and I was half asleep. A friend of mine IM'ed me to check out his Web site. It took me to some Yahoo! looking site. Stupid me wasn't paying attention to the URL and stuff. It required me to log in like Yahoo! always does. So I did and it didn't work. I tried again. Then, I got disconnected from Yahoo! Messenger. I couldn't log back in. At first, I thought it was just a mainteance time.
In the day time, I tried to connect, but failed. Then, it hit me. I got TRICKED! Damn social engineering. I also found out my other friends got the same IMs from my friend and me. Damn phishers.
So pay attention even if you're super tired. They're getting you at your weakness! Good thing this account was only for IM and Launch.com.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
https://cpolst.belvoir.army.mil/public/resumebuild er/builder/Logon
When I ssh to an unknown host, I get a minor warning. (could be a typo) When I ssh to a supposedly known host and get a crypto response that doesn't match up with the past, I get a major warning. I don't have to screw around with keys. The server admin doesn't have to screw around with a certificate authority.
Porting this to the email protocols...
When somebody emails me, the headers should include both a signature and their public key. At first it means nothing. If they email me again with the same public key and a good signature, I see a green check mark next to the email. If I get an email claiming to be from them but with a wrong or missing signature, then I get a warning that there might be a forgery or that they just got a different account. Once I verify the truth (make them pass a Turing test), I'll know what to do.
The bigger problem is that infected Windows boxes are untrustworthy. They'll sign phishing spams! This is where lots of neat security ideas break down. Spam is coming from your friends and family members. Spam comes from your boss. Spam comes from your customers and suppliers. Spam can be signed as well as any other email coming from those systems.
Phishing is fraud, the consequences of it are severely negative for individuals victimized and for the web of trust on which society depends, and the penalty for it should be about 1000 years in jail.
Why is this not a high priority of the FBI, Interpol, etc.? Does anyone really believe they couldn't catch some of these bastards if some resources weren't applied to the task?