Slashdot Mirror
Phishers Hone Skills, Craft More Impressive Attacks
CWmike writes "Recent break-ins at high-profile targets like the International Monetary Fund demonstrate just how proficient hackers have become at so-called spear phishing, researchers said on Tuesday. 'Today's spear phishing is not only more prevalent but also much more technically proficient,' said Dave Jevans, chairman of the Anti-Phishing Working Group. 'They're not going for a password, anymore; they're getting people to install crimeware on their computers.' The trend highlights the need for defenses against such targeted threats, requiring companies to look beyond security strategies focused purely on dealing with traditional network threats, analysts said. Increasingly, companies also need to focus on approaches such as continuous monitoring of networks, databases, applications and users, outbound traffic filtering and whitelisting."
The Art of Deception. By Kevin D. Mitnick. It's worth reading.
Life is not for the lazy.
Really??? So have I!! And friends and relatives. All you need to do is provide some credit card details, and bam! your machine is instantly remotely cleaned up. It's good to see MS taking such a proactive stance.
...to stop employing people who are so clueless when it comes to IT. Personal computers have been commonplace for more than twenty years now, it's time people started learning how to use them correctly.
I'm still coming across businessmen of a certain vintage (typically 50+) for whom it's a matter of pride that they "don't know anything about computers". FFS, it's 2011. Get a grip or retire.
worldmobilenet.com -- World Prepaid Wireless Internet plans
No, I think the best is to provide super-special sandboxing for them. One could even periodically send "test probes" to random people on one's network to better judge their level of acumen vs. current phishing techniques. Those who fail (or originally admit to being clueless) get:
I have had the Indian MS helpdesk ring a few times about the viruses of my Windows PC, surely there has to be a way of "honey potting" them to shut them down?
If I have time, I like to play with them. i use to put the phone down while they were talking and walk away but I worry they'll take silence as consent to switch my phone or do something else. So you egg them on. Keep saying "Sorry I don't understand" and "Could you explain a bit more?". Then agree to nothing. If you don't have time you just hang up.
These posts express my own personal views, not those of my employer
Phishing means tricking users into divulging sensitive data, usually a password. It is just one type of social engineering. What is being described here is another form of social engineering, where users are told instead to install malware or something like that. It is not phishing, or even spear phishing. When you get a lot of information together to plan out an effective attack on human psyche, it's called pretexting.
Fact of the matter is, the less companies, governments, organizations, etc trust their employees the less control they will give them. Every time a phisher is successful more control over the PC is taken away by security (in general).
I've seen this happen in my organization. The flexibility of having a computer you can install software that helps you do your job without permission is vanishing very quickly. Before long I expect that you will not be able to download any executable (even archived in zip) or run them. Of course this not saying they will not
Basically people's desktops at work are going to become less "personal computer" and more "web/document processing workstation".