Slashdot Mirror
Phishing Steals Spotlight at MIT Conference
Bob Brown writes "Companies are coping with spam, but phishing is another matter altogether, according to researchers at the annual MIT Spam Conference this week. From the article: "The response rate for phishing e-mails is much higher than for spam, says Paul Judge, CTO of messaging security maker CipherTrust. So while spammers have to send more and more unsolicited e-mail these days, as anti-spam filters get better at identifying and blocking spam, phishing attacks are well enough disguised that a higher percentage get through such filters, and more recipients click on them, he says."
The response rate for phishing e-mails is much higher than for spam, says Paul Judge, CTO of messaging security maker CipherTrust.
Gee, I wonder why...
Which would you click on? (Under the assumption you're a BoA customer)
Cl1ck H33RE F0R S|0ft V1A_GR_A!!!!!
or
Click here to update your account information.
Its a matter of logic. You can expect people to fall for things that look legitimate, not the things that just look utterly retarded, like most spam these days.
If you need cash in an unfamiliar city, how can you make the difference between a real ATM machine and a machine which just stores your PIN and eats your card? You can't. You rely on people to quickly identify scams like this and have the local police take the scam machine down.
Phishing fighting is the Internet equivalent of this.
The cure for phishing is very simple - Don't use an email client that supports HTML in email. Read all emails as text only.
This has the following advantages:
1) There's no clicking on links - if you want to go to a referenced website, you have to think a little.
2) Links to phishes are very obvious when you see the whole URL.
3) Most Phishes sent as multipart alternative don't even have a
phish attempt in the text-only part.
In addition, because you're not loading any images referenced in HTML, the whole WebBug thing doesn't work.
HTML in email was a terrible idea. It's time to stop.
If a real bank sent me an e-mail stating that my account would be closed in 24 hours I would have them on the phone in no time and closing all accounts and move to another bank.
I know people do not think but does it really take that much?
Especially if they catch you off guard. I consider myself as savvy as most on /. but even I've done double-takes on some of the better phishing schemes...esp when they catch me at a particularly hectic moment AND the email comes from some place I had been dealing with that very day.
I've never fallen for one obviously, but just the fact I have to stop and check things out for Kosherability shows how insidious phishing has become. There is just no way someone like my wife who is just savvy enough to browse the web and read email could spot the difference (which is why i severely restrict her browsing/email habits, but not every newbie is so lucky to have the surf-nazi on their back!)
There is a LOT of potential here for the unscrupulous. I don't even think phishing has even remotely reached its peak yet.
Random_Amber
Phishing is easier than spam to combat because it is constrained by the requirement to look authentic. And that can be used to virtually eliminate it.
Well, excuse me if I can't keep all your fscking domains straight, Citibank! How am I supposed to spot a phishing attack when you have 18 URLs on your list of valid ones? I think you could do a lot to help folks spot phishing emails if you would restrict yourself to your citibank.com domain. Then folks could remember, "You want citibank? Go to citibank.com."
"Avoid employing unlucky people - throw half of the pile of CVs in the bin without reading them." -- David Brent
I think you're missing the point of having a public encryption key: it's supposed to be, you know, public. In other words, you assume that everyone has access to it. Treating it as a private key defeats the whole point of public-key encryption. Your system would require every user to have a separate public key for every financial institution, unless you're willing to risk allowing all of them to be compromised by a single security breach. In other words, N users and M banks would require N * M secret keys. Ordinary public-key systems, however, would only require one public/private key pair for each individual (N + M key pairs).
What you need here is a local database of trusted public keys, one of which would be the one for Chase Bank (added from their (SSL) web site when you set up the account, for example). When you get an e-mail from "Ch4s3 B4nK", it will have a perfectly valid public key, but that key will not be trusted for authentication purposes because it isn't in the database (it will only ensure that the message was not altered during transit). This is exactly the way that GPG's "web of trust" system works, and it wouldn't be all that difficult (technically speaking) to make SSL certificates work the same way. All it needs is better integration with the various e-mail clients and web browsers.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat