Slashdot Mirror
The Golden Hour of Phishing Attacks
Orome1 writes "Trusteer conducted research into the attack potency and time-to-infection of email phishing attacks. One of their findings was that 50 per cent of phishing victims' credentials are harvested by cyber criminals within the first 60 minutes of phishing emails being received. Given that a typical phishing campaign takes at least one hour to be identified by IT security vendors, which doesn't include the time required to take down the phishing Web site, they've dubbed the first 60 minutes of a phishing site's existence is the critical 'golden hour.'"
Delay all email deliveries for one hour. What could possibly go wrong?
How is this YRO? Thanks CmdrTaco!
This is up in lala land.. but you really can’t cure stupid.
What we need to do is make phishing attacks useless. Obviously a lot harder to do than say.
The best I could come up with is some kind of challenge response system, possibly with the aid of a key token, with the user’s IP address factored in. That is:
You are at the login screen.. and presented with a challenge. On the server the challenge is tied to the IP that requested the login screen. You punch the challenge into some device, it gives you a response. You then plug the response into the login dialog (possibly with some other traditional password). The server validates that the IP logging in matches the IP associated with the challenge, and if so (and if the response is correct of course), lets the user log in.
Obviously this is way too cumbersome to work.. and the users who fall for phishing attacks tend to be the same ones who have PINs of 1234 and resent having to enter _that_ in. But I think something like this where it is impossible to “tell” someone your credentials is the solution.
Nitpic: what's this got to do with my rights?
So what we need is a way to scrub those websites within the critical time period, yes? A cleaning program? A sort of "Golden Shower"?
-- "Oh. This guy again."
Educating people about computer scams seems to be the best way to combat this problem. Otherwise, we can just provide an IQ test as part of the Windows boot process.
He who knows best knows how little he knows. - Thomas Jefferson
Since we are currently in an economic downturn, and many many tech folks are "on the beach" so to speak, i.e. not working, and perhaps collecting unemployment. why not let the "programmers" in the USA counter attack the overseas attacks on our internet. We invented the thing (Internet), we need VIGILANTE forces that can attack and destroy enemy targets on the web. WHY IS THIS ILLEGAL? This is a job Americans will do!!!!
"Any sufficiently advanced technology is indistinguishable from magic." - Arthur C. Clarke
The 15 minutes it takes the cops to respond to a robbery have been dubbed "The golden quarter-hour of robberies." I would expect the majority of successes to occur before security mechanisms have started, what with them being security mechanisms and all.
I live in constant fear of the Coming of the Red Spiders.
I never answer e-mail within an hour of receipt. I'm too busy trying to make first post.
Have gnu, will travel.
Erh... two reasons.
First, it's illegal. Duh.
Second... well, the enemy has the bigger guns.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The most scamming is successful before the Antivirus screams bloody murder when you open the mail. No, really? Duh. That's not what surprised me.
But who would have guessed that so many people actually use antivirus tools that it matters this much how fast the AV vendors react to it?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Jagatic and others saw this in 2007 in their work on social phishing at Indiana University.
We saw the same in our PhishGuru work at Carnegie Mellon, on training people not to fall for phishing scams in 2009.
As an aside, I know many slashdotters don't believe you can train people to protect themselves from phishing. That is the standard conventional wisdom in computer security. However, we've actually demonstrated that you can, if you make it fun, timely, and relevant. We're commercializing some micro games for security training and a service for simulated phishing attacks based on research we did at Carnegie Mellon.
NEW DISCOVERY! It can take up to several hours to understand a joke on slashdot! A solution presents itself, th-....
Joe job
Smart people can fall for phishing attacks as well. The counter is knowledge, not intelligence. The more people know about how phishing scams work, the better prepared they are to identify phishing attacks.
that the golden hour for phishing was right before dawn.
(rimshot)
(smattering of applause)
Thanks, I'll be here all week.
This just in! Criminals are more effective while they are unknown to whoever is fighting crime! More at 11.