Slashdot Log In
Next Gen Phishing Improves on Simple Spam
Posted by
Zonk
on Tue Sep 12, 2006 08:31 AM
from the we-can-improve-the-ham-we-have-the-technology dept.
from the we-can-improve-the-ham-we-have-the-technology dept.
An anonymous reader writes "ZDNet has a writeup about the next generation of phishing. According to the article, as anti-spam engines improve and user education levels increase, phishers will find it easier to hack into web servers and deliver password stealing trojans using browser vulnerabilities or Web 2.0 technologies than spam. Tom Chan from Messagelabs is quoted: 'They are trying to compromise poorly protected Web sites — they basically go in and enter their own code into that Web server,' said Chan, who explained that victims of this new phishing era would not have to do anything wrong in order to get hooked. 'You have gone to a legitimate Web site, you have not made a mistake and done everything right, but then your information gets compromised... because [the phishers] have taken over servers that belong to other people.'"
Related Stories
[+]
News: Phishers Defeat Citibank's 2-Factor Authentication 233 comments
An anonymous reader writes "Crypto experts and U.S. Government regulations (FFIEC) have been pushing the need for financial Web sites to move beyond mere passwords and implement so-called "two-factor authentication" — the second factor being something the user has in their physical possession like a token — as the answer to protecting customers from phishing attacks that use phony e-mails and bogus Web sites to trick users into forking over their personal and financial data. According to a Washington Post Blog, 'SecurityFix,' phishers have now started phishing for the two-factor token ID from the user as well. The most interesting part is that these tokens only give you one minute to log in to the bank until that key will expire. The phishers employ a man-in-the-middle attack against the victim and Citibank to log in via php and conduct money transfers immediately when logged in." (An update to the blog entry notes that the phishing site mentioned has since been shut down.)
[+]
AT&T Crack Part of a Phishing Operation 96 comments
JohnGrahamCumming writes "According to a story in the San Francisco Chronicle the AT&T store crack was the prelude to a very sophisticated phishing operation. The phishers were aiming to use the information from the store to fool existing customers into divulging SSNs and other personal information." From the article: "'The information that was provided by customers who ordered DSL-related equipment included name, address, e-mail address, phone number, credit card number and credit card expiration,' the memo says, adding that the hacked data didn't include Social Security numbers or birth dates. But the hackers had a scheme to get this extra info. After accessing the customer data, they incorporated it into phishing messages that were promptly sent to AT&T's DSL customers ... Each message included a legitimate order number culled from the AT&T vendor's database to create an illusion of authenticity. Messages also included the recipient's home address and the last four digits of his or her credit card number. "
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Inaccurate Term? (Score:4, Insightful)
Not to be pedantic here, but if a person gains access to users' passwords by hacking the actual site, rather than sending out bogus emails and/or setting up counterfeit web pages, can this activity really be called 'phishing'?
From TFA:
And from the 'phishing' entry in Wikipedia:
This attack does not consist of masquerading as a trusted party...it consists of compromising said trusted party. Thus, this activity cannot accurately be referred to as 'phishing'.
Re: (Score:3, Insightful)
In other news I have created a Next-Gen motorcycle that gets unlimited miles to the gallon, due to the addition of two levers that you operate with your feet that drive the rear wheel using a combination of chains and sprockets.
Re: (Score:3, Funny)
Re: (Score:2)
Perhaps he tried but O'Reilly's lawyers gave him the C&D smackdown
Re:Inaccurate Term? (Score:5, Funny)
Parent
Re: (Score:2)
It's even worse in TFA. (Score:3, Insightful)
So you could break into a bank and steal a backup tape with usernames/passwords and that would be "phishing".
Re: (Score:2)
Hmm... NexGen phising seems too... weak for that kind of thing...
Let's call it DyNaMiTe Phishing or something...
Re:Inaccurate Term? (Score:5, Funny)
Parent
Re: (Score:2)
Re: (Score:2)
This is not phishing. This is cracking, pure and simple.
Phishing implies that they have to set out "bait" to get what they want, but hacking into a site to capture passwords involves no bait.
Besides, Phishing exploits can be uncovered by normal users with a little education. Cracking attempts are far harder for the basic user, or even an experience user, to recognize client-side unless the cracker is stupid and changes the layout and functionality of the website.
Re: (Score:3, Informative)
Need a new metaphor (Score:5, Insightful)
Who hires these experts? (Score:4, Informative)
Even the well educated fall for it... (Score:3, Interesting)
Re: (Score:2)
Re: (Score:3, Funny)
My personal experience is that I'm either sometimes constantly amazed, or I'm always occasionally amazed.
Re:Even the well educated fall for it... (Score:5, Insightful)
I wonder if that has more to do with lack of education regarding bank/web security or have phishers just gotten that much better?
Phishers have gotten better, but the bottom line is: the average on-line banking customer is still pretty clueless. They subscribe to the theory, "if it walks like a duck and quacks like a duck and looks like a duck, it's a duck," which on the Internet is akin to measuring the speed of a bus by being hit by it and seeing how much it hurts.
My maxim has been: if it's actually from my bank, then I should be able to take a copy of the email to my local branch or call the bank and ask if the information in it is correct, i.e. have they lost all my data? The answer in 99.9% of cases will be no; of course there are increasingly less rare occasions where the bank has lost your data or let it get out into the wild. In those cases, the bank isn't generally going to admit it until some plucky person figures it out and makes them own up to it.
Parent
Re: (Score:2)
Generally I ignore any emails claiming to come from my bank. If the information is that important, I will recieve a paper letter or I can read about it on the website/online banking.
Re: (Score:3, Insightful)
Why should people on the internet be any smarter?
Re: (Score:3, Insightful)
How does this translate to the online world? Not so easily. It is easier to get tricked by things like mail headers and URLs.
Next Gen? (Score:2)
I'm still confused as to how this is Next Gen? This exists now.
Re: (Score:3, Insightful)
Happened to us (Score:4, Interesting)
Huh? (Score:4, Funny)
Never fear, OSS is here. (Score:2, Funny)
Fortunately as slashdot often reminds us. Apache is the number one server (over you know who), and the people who use Linux and Unix software are the most intelligent people on the planet (we're command line commandos).
Interesting theory but.... (Score:4, Informative)
The first is that no web site should ever be able to execute code on your PC without your express permission. If it can then the browser being used to access that site needs fixing.
Now there will still be cases where the user has to give permission to execute code locally in order for the site to work properly but these should be very very rare. Most code that is executed such as ActiveX or Javascript should be excuted in a sandbox environment where no access is given to local PC resources. If a local resource is needed it should be asked for specifically and the accepted or denied permission by the user.
What does need to happen is that users need to be educated into a state of mind where they deny everything and then only go back the accept permission to access a local resource if something doesnt work properly and it make sense for the web site to be accessing the resource in question. For instance, if a web site wants access to my
These problems all seem to stem from most PC users being lazy and not wanting to know these things. What they want is to have everything complicated hidden from them and everything to "just work". This might be possible with a pencil or other simple device but with things as complicated as PC's or Motor Vehicles it will not. Ever.
I really think that for people to expect to use a machine as complicated as a PC, they must understand the basics of how to operate it safely. This is no different to expecting drivers to undertake a test of competance. Without a driving licence I am not able to drive on the road although I can drive round my own back yard to my hearts content. Using a computer should ideally be the same where users are forced to undertake a basic competancy exam before they can allow their computer to interact with the web.
Until this happens you will always have users who allow their PC to be hijacked by malicious software and then carry on using it without calling for help. This is no different to forcing drivers not to drive with faulty breaks or severely worn tires.
Now how you would enforce this is a little complicated but it must still be possible with legislation. This is no different to a car salesman wanting to see a driving licence and proof of insurance before I buy a car. He wouldn't do that by choice (He would probably much rather make a sale regardless) but can be forced to by law.
Re: (Score:2)
Exactly. The problem here is one that pervades the world of computing today, and will have to be resolved one way or another. Computers are unbelievably (almost infinitely) flexible devices, yet we have established an IT industry that sells them as consumer appliances. 99.99 percent of the computers sold are neve
What the article lacked...an example (Score:5, Informative)
I've already seen this "next generation phishing" method used. I was on e-bay looking for a piece of autographed memorabilia. I noticed one auction and clicked on it. The E-Bay login screen popped up. I was about half-way through typing my password when it suddenly occured to me, "Wait a second, why do I have to enter my account to view an auction."
Careful review showed me that opening the auction had triggered some embedded javascript that opened a frame within the e-bay window that covered the whole base page, but presented a spoof of the e-bay login screen. The title bar still read as a legitimate e-bay address, the screen was a perfect dupe of the e-bay login screen. In short, it looked totally legitimate.
Now, they didn't have to hack e-bay's servers, nor did they have direct access to anything on e-bay's site. All they had to do was embed some javascript into an otherwise "secure" site.
I think that's what this article is talking about.
Oh, and I was running firefox with a javascript blocker, but since I've allowed scripts on e-bay (you can't even view most of the auctions without it) it happily ran the phishing script without even a warning.
Re:What the article lacked...an example (Score:4, Interesting)
Parent
Re: (Score:3, Interesting)
Isn't that XSS?? (Score:2)
Re: (Score:2)
Re: (Score:2)
I would say that this predisposes it very strongly towards the phishing crowd.
Out of interest, would you happen to know of any other types of attack that XSS might enable?
Re: (Score:2, Informative)
Howabout the myspace worm [namb.la]?
Cross site scripting is really great for simple session hijacking. Php stores a cookie called PHPSESSID by default with your unique session identifier. All of the important bits of your session (username, password, whatever else they're storing) are stored on the server. If someone can guess (very difficult) or steal (with xss very easy) that identifier, they can impersonate you and have access to whatev
Welcome to the wonderful world of AJAX (Score:3, Interesting)
Re: (Score:2)
the person who submitted the auction embedded a script into
his html auction page. (Ebay lets you upload your own html
pages to describe your auction). Seems they need to scan
all submitted auctions and bounce anything that has possible
trojan code in it. (and then CANCEL the submitters ebay
membership!).
Next Gen Phishing? (Score:4, Funny)
Vouchsafe (Score:4, Interesting)
The best solution to all this phishing, spam and other harvesting naive "normals" is the trust web. Everyone has a private key for signing assertions, and a contact list with trust levels. Every message is signed (or default untrusted) by the sender and vouchers. When enough vouchers sign a message, it is trustworthy. The Web contains vouching centers, including diverse security analysts signing messages (including each others' assertions). People subscribe to many vouch sources, as well as "vouchmasters" which publish formulas for securing transactions. This way, anyone who says a transaction is unsafe, and is vouched by someone else, makes that transaction at least subject to review, or blocked, depending on the person's policy. Which depends on whom they trust.
That is the kind of system I'd expect banks and governments to deploy for the public. They are the ones we are paying, and relying on, for security. There's so much efficiency to gain from security compared to the losses from insecurity that I expect a very diverse, competitive market of vouchers to thrive. The underlying tech, like PGP/GPG signing and other trustweb tools, already exists. There are already relatively informal vouchers, like CERT, DHS, and lots of independents.
What's needed are standards for trust degrees, and simple UIs for using the trust web without learning many new skills. UIs simpler than antiphishing techniques will win. UAs like Firefox and Outlook merely coloring buttons red to blue for degrees of trust, keeping personal info stored locally for standard submission to standard requests graded by risk and identified by trustworthyness would go very far. Onetime passwords for every transaction to prevent replay attacks would go even further. And local databases with audit trails of every transaction would make it even easier to use once a transaction is doubted.
All those features hook an automated trust web into many existing security practices already used by most people in person. A really secure regime would include privacy laws prohibiting transfer of personal info outside the transaction expressly required by the requester and expressly permitted by the sender. Putting personal info under copyright in detail, and a US Constitutional Amendment in general, would really lock our existing judicial/police/security system into a consistent defense of people as well as corporations.
The time is now. Why doesn't Novell's Evolution at least require PGP/GPG by default? Why doesn't Firefox keep personal info stored encrypted for form submissions with a separate log? Why don't banks issue onetime password credit "cards" for Web use? We've already gone far enough down the path that it's obvious Microsoft, the US government, Chase Bank aren't going to move first. Let's see some of the UIs start to make it easy, and force the backend of the trust web to catch up. I'm doing it in my own software. What are you doing?
Re: (Score:3, Interesting)
I think these things are not well- and widely-implemented for the same reasons that caused the dichotomy of MS releasing a DRM patch in 3 days but yet a security patch we must wait for while it goes through the "rigorous" testing process ends up corrupting my data.
Many humans do not seem to view security as an advantage; they view it as a (potentially unnecessary in their perspective) hindrance. In other words, there is no percieved profit i
Re: (Score:2)
Security is certainly an investment. And along the way there's not just the investment cost, but also decreased access (the essential tradeoff for security). Access is equated to simplicity, which is by far the main selling point of any technology (except for geeks
Re: (Score:2)
Those people would be wrong, because what you describe is exactly parallel to what humans do in the real world. Centers of trust are the equivalent of "community leaders".
Re: (Score:2)
I like the new features! (Score:4, Funny)
Don't waste your time (Score:3, Insightful)
Re: (Score:2, Interesting)
I used to be just like you. I could tell you the balance of my account to within 5 dollars just because I knew all the ins and outs.
Suddenly I'm married, and the word "Overdrawn" entered my vocabulary.
Imagine the dulcet tones of your wife saying, "How can we be overdrawn? I didn't spend that much when I was out shopping. Didn't I tell you I went shopping? What bills?"
All I know for certain is that since I got married, I've increased my earnings by a factor of 400%, and th
Re: (Score:2)
the checkbook!"
Re: (Score:2)
I have 3 accounts, all linked, so I can keep the bare minimum in the main account and all the rest in a savings account. If I want to buy something online, I just transfer the right amount over from the savings and then go buy the item.
Another useful aspect is when you're travelling. they don't have HiTW machines outside the UK that can deal with Link, so when I was in australia and new zealand and the us, it was trivial to keep a check on things and move money, p
This is ancient news (Score:4, Informative)
No cookies, no Javascript, no Java. (Score:2, Interesting)
Even less Flash or other even shadier active media.
Web designers with huge egos have no business running their often crappy programs on my box.
BTW, that is whi I'll always post here as Anonymous Coward:
No cookies, honey.