Next Gen Phishing Improves on Simple Spam

An anonymous reader writes "ZDNet has a writeup about the next generation of phishing. According to the article, as anti-spam engines improve and user education levels increase, phishers will find it easier to hack into web servers and deliver password stealing trojans using browser vulnerabilities or Web 2.0 technologies than spam. Tom Chan from Messagelabs is quoted: 'They are trying to compromise poorly protected Web sites — they basically go in and enter their own code into that Web server,' said Chan, who explained that victims of this new phishing era would not have to do anything wrong in order to get hooked. 'You have gone to a legitimate Web site, you have not made a mistake and done everything right, but then your information gets compromised... because [the phishers] have taken over servers that belong to other people.'"

Comments

Inaccurate Term?

[TripMaster Monkey]

Not to be pedantic here, but if a person gains access to users' passwords by hacking the actual site, rather than sending out bogus emails and/or setting up counterfeit web pages, can this activity really be called 'phishing'?

From TFA:

You have gone to a legitimate Web site, you have not made a mistake and done everything right, but then your information gets compromised... because [the phishers] have taken over servers that belong to other people.

And from the 'phishing' entry in Wikipedia:

In computing, phishing is a criminal activity using social engineering techniques. Phishers attempt to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an electronic communication.

This attack does not consist of masquerading as a trusted party...it consists of compromising said trusted party. Thus, this activity cannot accurately be referred to as 'phishing'.

Re:Inaccurate Term?

[thewiz]

I think the new term would be "phucking" as that is what happens to the company and the customer.

Re:Inaccurate Term?

[Fred_A]

The author should have made a new buzzword for it, like "Fishing 2.0".

I hereby propose pharming (to keep a logical progression of stupid buzzwords).

Need a new metaphor

[Moby Cock]

It seems to me that the 'fishing' metaphor is no longer apt in this case. Cracking web servers and installing key logger trojans is plain old balck hat hacking.

Happened to us

[Exp315]

I'd call it hacking, not phishing, but this happened to us earlier this year. Our company web site at was hacked many times over a period of a month to insert code redirecting visitors to a Russian site that attempted to install a trojan. We knew that 's server was compromised because other users of the same server were also complaining about the same thing. 's reaction?: "We are aware of the problem and we are investigating". We abandoned our account there and moved to another web host after repairing our site every day (often several times per day) for a month.

Re:Even the well educated fall for it...

[Billosaur]

I wonder if that has more to do with lack of education regarding bank/web security or have phishers just gotten that much better?

Phishers have gotten better, but the bottom line is: the average on-line banking customer is still pretty clueless. They subscribe to the theory, "if it walks like a duck and quacks like a duck and looks like a duck, it's a duck," which on the Internet is akin to measuring the speed of a bus by being hit by it and seeing how much it hurts.

My maxim has been: if it's actually from my bank, then I should be able to take a copy of the email to my local branch or call the bank and ask if the information in it is correct, i.e. have they lost all my data? The answer in 99.9% of cases will be no; of course there are increasingly less rare occasions where the bank has lost your data or let it get out into the wild. In those cases, the bank isn't generally going to admit it until some plucky person figures it out and makes them own up to it.

Interesting theory but....

[Ash Vince]

The first thing to take into account is that this article seemed to be written by a "security expert" who skimped on a few key details.

The first is that no web site should ever be able to execute code on your PC without your express permission. If it can then the browser being used to access that site needs fixing.

Now there will still be cases where the user has to give permission to execute code locally in order for the site to work properly but these should be very very rare. Most code that is executed such as ActiveX or Javascript should be excuted in a sandbox environment where no access is given to local PC resources. If a local resource is needed it should be asked for specifically and the accepted or denied permission by the user.

What does need to happen is that users need to be educated into a state of mind where they deny everything and then only go back the accept permission to access a local resource if something doesnt work properly and it make sense for the web site to be accessing the resource in question. For instance, if a web site wants access to my /etc/passwd or /etc/shadow file under linux (poor examples as they are locked while linux is running) I would deny it.

These problems all seem to stem from most PC users being lazy and not wanting to know these things. What they want is to have everything complicated hidden from them and everything to "just work". This might be possible with a pencil or other simple device but with things as complicated as PC's or Motor Vehicles it will not. Ever.

I really think that for people to expect to use a machine as complicated as a PC, they must understand the basics of how to operate it safely. This is no different to expecting drivers to undertake a test of competance. Without a driving licence I am not able to drive on the road although I can drive round my own back yard to my hearts content. Using a computer should ideally be the same where users are forced to undertake a basic competancy exam before they can allow their computer to interact with the web.

Until this happens you will always have users who allow their PC to be hijacked by malicious software and then carry on using it without calling for help. This is no different to forcing drivers not to drive with faulty breaks or severely worn tires.

Now how you would enforce this is a little complicated but it must still be possible with legislation. This is no different to a car salesman wanting to see a driving licence and proof of insurance before I buy a car. He wouldn't do that by choice (He would probably much rather make a sale regardless) but can be forced to by law.

What the article lacked...an example

[jnaujok]

For everyone screaming "If you hack the server..."

I've already seen this "next generation phishing" method used. I was on e-bay looking for a piece of autographed memorabilia. I noticed one auction and clicked on it. The E-Bay login screen popped up. I was about half-way through typing my password when it suddenly occured to me, "Wait a second, why do I have to enter my account to view an auction."

Careful review showed me that opening the auction had triggered some embedded javascript that opened a frame within the e-bay window that covered the whole base page, but presented a spoof of the e-bay login screen. The title bar still read as a legitimate e-bay address, the screen was a perfect dupe of the e-bay login screen. In short, it looked totally legitimate.

Now, they didn't have to hack e-bay's servers, nor did they have direct access to anything on e-bay's site. All they had to do was embed some javascript into an otherwise "secure" site.

I think that's what this article is talking about.

Oh, and I was running firefox with a javascript blocker, but since I've allowed scripts on e-bay (you can't even view most of the auctions without it) it happily ran the phishing script without even a warning.

Re:What the article lacked...an example

[aliendisaster]

E-Bay really did that to themselfs by allowing outside code on the auctions. I guess a prettier auction is more important than security for the millions of e-bay users.

Next Gen Phishing?

[MojoBox]

Sorry, but as a Nintendo fan, I can only accept New-Gen Phishing.