Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Phishing Steals Spotlight at MIT Conference 74

Posted by Zonk from the beware-of-pork dept.
Bob Brown writes "Companies are coping with spam, but phishing is another matter altogether, according to researchers at the annual MIT Spam Conference this week. From the article: "The response rate for phishing e-mails is much higher than for spam, says Paul Judge, CTO of messaging security maker CipherTrust. So while spammers have to send more and more unsolicited e-mail these days, as anti-spam filters get better at identifying and blocking spam, phishing attacks are well enough disguised that a higher percentage get through such filters, and more recipients click on them, he says."
This discussion has been archived. No new comments can be posted.

Phishing Steals Spotlight at MIT Conference More

Phishing Steals Spotlight at MIT Conference

Comments Filter:

  • Uh, duh? (Score:4, Insightful)

    by Siberwulf ( 921893 ) on Friday March 31, 2006 @05:00PM (#15037577)
    The response rate for phishing e-mails is much higher than for spam, says Paul Judge, CTO of messaging security maker CipherTrust.

    Gee, I wonder why...

    Which would you click on? (Under the assumption you're a BoA customer)

    Cl1ck H33RE F0R S|0ft V1A_GR_A!!!!!

    or

    Click here to update your account information.

    Its a matter of logic. You can expect people to fall for things that look legitimate, not the things that just look utterly retarded, like most spam these days.

    • Re:Uh, duh? (Score:3, Interesting)

      by RajivSLK ( 398494 )
      The purpose of a well crafted spam email is to market something or convey a message. Our filters are getting pretty good at indentifying this kind of thing. But the whole point of a phising email is to look as much as possible like a legitimate peice of mail. That's the scam and it's fooling the filters too.

    • Re:Uh, duh? (Score:3, Insightful)

      by BACPro ( 206388 )
      Other than the obvious differences pointed out by the PP, I always click the phishing emails and seed them with false data.

      The value of the database must go down where there is invalid info in it...

      • If you want to play games with the phishers, you can as well seed their database with the real data and sue the suckers if they try to use it.
    • People must click on the "Cl1ck H33RE F0R S|0ft V1A_GR_A!!!!!" bullshit or the spamming fuckers would stop sending me this shit 10 times an hour. In general I think eugenics is a bad idea ... but really ... I think each and every person who orders from a spam like that should receive a bomb in the mail instead of penis pills. This solution would go a long way towards solving not only spam, but many of the other problems faced by our country today.
      • Agree with you, sadly.

        Forgot the comedian who said it, but let Darwin work. Take the caps off the bleach bottles.
      • People must click on the "Cl1ck H33RE F0R S|0ft V1A_GR_A!!!!!" bullshit or the spamming fuckers would stop sending me this shit 10 times an hour.
        Alternate theory: the spammers just think they're gonna make money ; the real money is made by the folks selling mass-mailers and address lists to to the spammers.

  • Geez. Will it never end? (Score:5, Funny)

    by BigZaphod ( 12942 ) on Friday March 31, 2006 @05:03PM (#15037593) Homepage
    First phishing steals identities and now its stealing spotlights, too? And not just any spotlights, either - but MIT spotlights! This has got to stop...
  • I rank 'em right up there with the spyware guys - send all the rats to this site [rat-hunter.com]
  • Username: [-----------]
    Password: [-----------]

    [Submit]

  • Help stop them, by reporting them (Score:5, Informative)

    by WyrdOne ( 96731 ) on Friday March 31, 2006 @05:10PM (#15037639)
    http://reportphish.org/ [reportphish.org]

    Also, those of you who use GMail, there is a "Report Phishing" option under "More Options"

  • Phishing emails look legit (Score:3, Interesting)

    by Nightspirit ( 846159 ) on Friday March 31, 2006 @05:21PM (#15037720)
    I keep getting chase banking emails, even though I don't have an account with chase.

    The emails say something to the effect of "bla bla, because of recent security issues, you have to reset your password or your account will be closed within 24 hours."

    The thing is, these emails I've been getting lately look professional and legit. If I was a grandma or ininformed parent I would have clicked on them and likely have my credit account wiped. The email address states "blabla@chase.com" and even the spoofing address looks legit.

    Don't know what we can do about it other than educate people to call their banks and confirm, log onto the banks real address, and not click on any address in an email.

    • Re:Phishing emails look legit (Score:1, Insightful)

      by Anonymous Coward
      If a real bank sent me an e-mail stating that my account would be closed in 24 hours I would have them on the phone in no time and closing all accounts and move to another bank.

      I know people do not think but does it really take that much?
    • I've been getting these Chase emails, too, and my Visa account recently was switched to Chase! I suspected a phisher, so I went to the site and entered some choice obscenities for the user name and password. The login page still sent me to the next page as if I had been logged in.

      So for a certain subset of phishing sites, one check might be to enter incorrect login info and see if it admits you. This should identify sites that are illegit. However, if the site doesn't log you in -- don't then assume tha
    • Actually, what could be done is to tell people to view the certificate for the site, and verify that the SHA1 fingerprint matches what's printed on the back of their card. Of course, there's no way to get Chase's certificate without using your password, so it's presently hopeless.

      With browser support, you would identify the certificate when you originally set up your account, and you'd mark the certificate in your browser as belonging to your bank, and no other site could make the greeting look like your ba
    • I always right-click and "View Source". Generally, the legitimate-looking email addresses and links turn out to actually be a URL with numbers, i.e., <a href="http://10.30.1.42/chase_login.html">.

  • Temporary e-mail (Score:5, Informative)

    by Dekortage ( 697532 ) on Friday March 31, 2006 @05:22PM (#15037724) Homepage

    From the article: Among these were a proposal to improve Bayesian filter accuracy, a system for generating temporary e-mail addresses so that a person's preferred address doesn't have to be given out, spam filters based on adaptive neural networks, a new message-verification platform. (emphasis added)

    This is called "keyed e-mail". I have used a keyed email system from Zoemail [zoemail.com] in the past and it works very, very well for this purpose. There is some extra time required for managing the keys, but the idea works great for me. (and no I do not work for them... I just think the technology works.)

    • Oh... if you want to test out how a spammer might e-mail me, go ahead and e-mail me [zoemail.net].
    • Now to DIY, this *is* Slashdot after all, get yourself a domain and some hosting (if you already have one, you're ahead of the curve). Then, create a catch-all that will forward anything@yourdomain.com to yourrealaddress@yourdomain.com . When you sign up for a new message board, mbname@yourdomain.com . For some mailing list, listname@yourdomain.com. Now, when you start getting spam to an email address, you'll see that it is to a certain address. If it's to listname, you know that mailing list has either so
  • I guess one thing phishing sites get is accurate information. After all, if you're computer-savvy you might not enter information into the site. But if you're not, you're likely to enter correct information.

    Perhaps someone can create a charity web site, where you submit the URL of a phishing site, and then it goes and submits millions of randomly generated username/password combinations to the phishing site?

    Would be relatively simple to create, just web-scrape for the words /user(name)?/ and /pass(word)?/ a

  • Best Cure for Phishing (Score:2, Insightful)

    by Anonymous Coward
    The cure for phishing is very simple - Don't use an email client that supports HTML in email. Read all emails as text only.

    This has the following advantages:

    1) There's no clicking on links - if you want to go to a referenced website, you have to think a little.
    2) Links to phishes are very obvious when you see the whole URL.
    3) Most Phishes sent as multipart alternative don't even have a
    phish attempt in the text-only part.

    In addition, because you're not loading any images referenced in HTML, the whole WebBug

  • Phishing is no joke... (Score:3, Insightful)

    by random_amber ( 957056 ) on Friday March 31, 2006 @05:30PM (#15037788)
    Especially if they catch you off guard. I consider myself as savvy as most on /. but even I've done double-takes on some of the better phishing schemes...esp when they catch me at a particularly hectic moment AND the email comes from some place I had been dealing with that very day.

    I've never fallen for one obviously, but just the fact I have to stop and check things out for Kosherability shows how insidious phishing has become. There is just no way someone like my wife who is just savvy enough to browse the web and read email could spot the difference (which is why i severely restrict her browsing/email habits, but not every newbie is so lucky to have the surf-nazi on their back!)

    There is a LOT of potential here for the unscrupulous. I don't even think phishing has even remotely reached its peak yet.

    Random_Amber
    • Actually, a simple addition to the Bayesian filtering should defeat many, many phishing attempts.

      As I said in another post to this story, I generally right-click and "View Source" when I'm unsure. The presence of the numbers in the URLs, like "http://10.30.1.42/chase_login.html", give it away to me.

      So, the easy answer is that any time an email arrives which is in HTML format and has at least one link whose URL is numeric, then it should be flagged with "[PHISH]" (or "[SPAM - phishing attempt]", or some

  • Why not cryptographically authenticate e-mail? (Score:5, Informative)

    by fortinbras47 ( 457756 ) on Friday March 31, 2006 @05:32PM (#15037807)
    The technology is there (PGP etc.. etc...) but as far as I can tell, hardly anyone besides comp security lists use it.

    If you visit a website and initiate an SSL session, the public-private key cryptography (along with the public root certificates imbedded in your browser) will verify that the website you're visiting is really who they say they are. (Or at least that Verisign thinks they are legit.)

    I don't see why companies don't make a similar effort to cryptographically authenticate their e-mail. People use PGP for security advisories etc......, but I don't understand why all e-mail coming from my bank, coming from Paypal etc... shouldn't be signed.

    If there was a portion of your e-mail window at the bottom right hand of your screen that said stuff like:
    "This is an authentic e-mail from BankOfBlanBlah signed on 3/31/06 at 3:52PM" or "This is an unsigned e-mail. It is possible that this e-mail is fraudulent." or "This e-mail has an incorrect signature. It is highly possible that its contents are fraudulent."

    My rough guess that e-mail authentication isn't done because (1) programmers are lazy and sending plain text is easier to program and (2) The way you do e-mail auth in e-mail clients is all different and a huge mess from a usability standpoint.

    It might put at least a dent in some of this phishing stuff if people expected all e-mail from e-bay, paypal, their bank, amazon etc... to be signed.

    • Obviously, this is where email as a whole is headed. In fact all IP services should eventually be encrypted. The government won't like it because it'll be harder to eavesdrop, but its the only solution to the problem.

      I'm surprised that Microsoft didn't lead the pack with a feature in MS Outlook, and work directly with all the certificate issuers or even directly with the financial companies. But maybe they were under pressure from Washington, DC not to implement encrypted email. If they had done it, it'

      • In order to avoid spoofed financial identities, the best would be for all clients of financial institutions to have a financial public key they only give out to banks and such. That way even if you get an email from Ch4s3 B4nK, with a valid looking certificate, you aren't fooled into thinking you have done business with them. Because only the real Chase Bank would have your financial public key.

        I think you're missing the point of having a public encryption key: it's supposed to be, you know, public. In

        • The hard part becomes the local database of keys/CERTS. You say you should trust some SSL website to add the key - something a spoofed email or malicious link might accomplish easily. I say, have a 'public' key thats meant for just the bank. In this case, your're right its not really all that public. However, its still serves a functional purpose of encrypting and validating the email. I'm dubious of systems that rely on CERT authorities or webs of trust (not that I don't think they're useful). I like
          • There's just as much trouble ensuring that you gave your "secure" public key to the right recipient at there is ensuring that you've just added the correct public key to the local database. With the public-key system you can at least check that the key they gave you matches the one in someone else's database; you can't do that with a random key you just generated. Furthermore, the truly paranoid can get the bank's public key from the bank in person; there's no need to rely on the security of their web site.
    • Most email clients support S/MIME, but there are several problems here. There are too many CAs, and it's too easy for bad guys to get a bogus (but mostly real-looking) cert. It's also somewhat difficult to make the signature chrome unspoofable.
    • You expect "normal" people to read a window at the bottom right hand of the screen?

      It would have to be 30 point font for most people. People don't even read pop-up messages, centered on the screen, that have to be closed by user action.

      Besides, the phishers would just add to their e-mail: ""This is not an unsigned e-mail. This e-mail is not fraudulent." "This e-mail has a correct signature. It is impossible that its contents are fraudulent."

      Which do you think users would read?
    • what a great idea! try http://www.dkim.org/ [dkim.org] for more information
      on the best bet for getting a deployable protocol out there for
      authenticating email. It's currently going through IETF standarization,
      but the -allman-01 draft is stable and has multiple interoperable implementations
      including a sourceforge sendmail milter.
    • When I ssh to an unknown host, I get a minor warning. (could be a typo) When I ssh to a supposedly known host and get a crypto response that doesn't match up with the past, I get a major warning. I don't have to screw around with keys. The server admin doesn't have to screw around with a certificate authority.

      Porting this to the email protocols...

      When somebody emails me, the headers should include both a signature and their public key. At first it means nothing. If they email me again with the same public k
    • The biggest problem with the classic signature systems (e.g., PGP, S/MIME) is that they don't have quite the right key management model. Anyone can create a PGP key with any mail address they want, and sign messages. Similarly, anyone can get a certificate for an email address they have (perhaps an employer), but when they leave the company, does the certificate get revoked? No; the employer may not even know of its existence.

      Signature schemes designed for this purpose, like DKIM, are actually a signatur
      • Yet the banks and other institutions could send their key signature/digest, by snail mail, as part of the account opening process. Or even have it either on display or available on CD from the branches. That way the user could be confident of the key used to sign the email.
    • And it does not help that many financial institutions use third parties for mailshots. Even having the institutions always send email from their own domains and using SPF and DKIM would help. I know that not many mail (receiver) programs check these but if the financial institutions started using them for outgoing mail then I am sure that this would accelerate the implementation in user mailers.

  • Fear is more effective the greed (Score:4, Interesting)

    by imkonen ( 580619 ) on Friday March 31, 2006 @05:36PM (#15037837)
    I've gotten a few phishing emails, and man...when they guess a bank/credit card I actually use, my heart just jumps. I mean...I'm aware of phishing, and I know how to safely confirm whether the email is legit or not if I can't tell by looking at it, but there's always that second or two of real panic when I read the part about "problem with my account" and worry that it could be real. Spam I can safely ignore: even if some spam offers are legitamately good deals, they're still mostly just trying to sell me things I don't need to buy. I can safely ignore a regular spam and not worry I'm going to regret it later. But I can't do that if the message says my bank account has a problem. I have to deal with it right then and there...even if dealing with it just means proving to myself the email is bogus. So putting myself in the shoes of a less internet savy type who may not have heard of "phishing", I'm not the least bit surprised phishing emails get more hits.
    • .......But I can't do that if the message says my bank account has a problem.......

      I'd lay the blame with the banks and other financial institutions for sending out e-mail with links embedded. My banks do not send out e-mails, but send a message when I log in to my accounts. An e-mail from a bank could also be a plain text message with NO links that instructs the customer to log in to their account if there REALLY is a problem. Asking a customer to type a link into the browser or using the bank's bookmark i
  • ...is my idiot coworkers who get a phishing email and are barely savvy enough to recognize it for what it is. These people seem to think 1) these emails make the rounds like viruses, and 2) no one else will figure it out. So when one of these idiots gets a phish, I get an email like

    DON'T CLICK ON BANK OF AMERICA EMAIL! ITS A SCAM!!!!

    because the moron sent their warning out to the entire company. It's like an idiot test.

    • I guess people like that are the reason why I will never be the CTO of a large corporation. Within 5 minutes of some asshat sending out a message like that, I would be at their desk, with security: "You have to leave the building now. You no longer work here. No, it would seem that it is impossible for me to explain it to you".

  • We simply aren't doing enough to stop phishing (Score:5, Insightful)

    by StevenMaurer ( 115071 ) on Friday March 31, 2006 @05:42PM (#15037876) Homepage
    Sure, phishers are more clever than spammers. There's more money involved, so it attracts organized crime. Still, there are some pretty basic things both Mozilla Thunderbird and MS could do to combat the problem:
    1. Bring up a warning dialog whenever you click on an email link whose body goes to a different domain than the text.
    2. Make that warning dialog in large RED LETTERS talking about the likelihood that it is a SCAM - if the referenced text is formatted like a hyperlink and points to a different address
    3. Hardcode in the top 100 sites subject to phishing, with a comparative of the hypertext links to known addresses. References to the site name in the text will cause the email client to check all embedded hyperlinks against their official published versions
    4. Set up a cooperative site for email clients that have direct internet access to automatically check against w/o hardcoding.

    Phishing is easier than spam to combat because it is constrained by the requirement to look authentic. And that can be used to virtually eliminate it.

  • Companies could do more to prevent phishing (Score:5, Insightful)

    by lorcha ( 464930 ) on Friday March 31, 2006 @06:02PM (#15037993)
    You have to admit that the companies themselves are making it as difficult as possible to spot phishing. For instance, look at the Citibank valid list of URLs [citi.com]:

    1. web.da-us.citibank.com
    2. www.citi.com
    3. www.citibank.com
    4. www.myciti.com
    5. www.citibankonline.com
    6. www.citibank.com/us/cards
    7. www.accountonline.com
    8. www.citicards.com
    9. www.thankyouredemptions.com
    10. www.studentloan.com
    11. studentloan.citibank.com
    12. citibusinessonline.di-us.citibank.com
    13. citibusinessonline.com
    14. citibusiness.com
    15. www.citimortgage.com
    16. www2.citimortgage.com
    17. www.smithbarney.com
    18. www.benefitaccess.com

    Well, excuse me if I can't keep all your fscking domains straight, Citibank! How am I supposed to spot a phishing attack when you have 18 URLs on your list of valid ones? I think you could do a lot to help folks spot phishing emails if you would restrict yourself to your citibank.com domain. Then folks could remember, "You want citibank? Go to citibank.com."

    • And not including citibank-visa.com, citibank-security.com, citisecurity.com, all of which a scammer could get an SSL certificate for.
    • To be fair, five of the eighteen domains that you listed are, in fact, citibank.com:

      1. web.da-us.citibank.com
      2. www.citibank.com
      3. www.citibank.com/us/cards
      4. studentloan.citibank.com
      5. citibusinessonline.di-us.citibank.com

      While it may be true that CitiBank has too many domains, you don't help your own argument much by exagerating your evidence.

    • Sure, phishers can try sending mail from mycitibank.com and c1t1bank.com, and occasional suckers will fall for it, and the general public doesn't understand digital signatures well enough for those to help. But most of the major phishing targets, such as banks, eBay, Paypal, eGold, etc. aren't even doing simple passive stuff like advertising SPF for their domains so your spam filter can at least discard the emails claiming to be from citibank.com at random zombie IP addresses.

      Aside from the email-protectio

  • Again, I shall plug my own anti-phishing Firefox extension: http://www.maryanovsky.com/sasha/smokedsalmon/ [maryanovsky.com].

    It currently does the following:

    • The host's originating country is displayed as a flag in the address bar.
    • The hostname is displayed clearly in a monospaced font.
    • On known phishing websites show, the hostname is blinking red.
    • On known good websites (paypal.com etc.), the hostname is green.
    • Users can report phishing.

    It's not particularly useful at the moment though, because the database is empty :

  • Newsflash: people are stupid (Score:3, Interesting)

    by mabu ( 178417 ) on Friday March 31, 2006 @06:37PM (#15038229)
    The phishing scam works because people are stupid. There is no amount of technology you can employ to save an idiot from himself. This is the sad reality.

    The best way to deal with this is to promote a healthy dose of cynacism amongst the populace.

    Well, another way is to force ISPs to filter port 25 traffic on broadband and eliminate the value of zombie PCs being part of the scam network.
  • I just got the third in a week. First two were from the same Phisherman posing as an eBay buyer (precisionlaptops4u).
    Got another yesterday posing as a paypal email.
    To try to expose these clowns, I do a reverse DNS lookup, a WHOIS lookup, and Google on key words, and publish the results on my Blog. http://mrlinuxhead.blogspot.com/ [blogspot.com]
    The IP address, port scans, who the domain owner is, the street address, email address and phone numbers, whatever I can find out about them I publish for the local authorities

  • My first phishing experience... (Score:3, Interesting)

    by antdude ( 79039 ) on Friday March 31, 2006 @07:36PM (#15038731) Homepage Journal
    It was related to my Yahoo! account. It was like 3:30 AM in the morning and I was half asleep. A friend of mine IM'ed me to check out his Web site. It took me to some Yahoo! looking site. Stupid me wasn't paying attention to the URL and stuff. It required me to log in like Yahoo! always does. So I did and it didn't work. I tried again. Then, I got disconnected from Yahoo! Messenger. I couldn't log back in. At first, I thought it was just a mainteance time.

    In the day time, I tried to connect, but failed. Then, it hit me. I got TRICKED! Damn social engineering. I also found out my other friends got the same IMs from my friend and me. Damn phishers.

    So pay attention even if you're super tired. They're getting you at your weakness! Good thing this account was only for IM and Launch.com.
  • The Army's civilian job site REQUIRES you provide your SSN and REQUIRES it as the login ID.

    https://cpolst.belvoir.army.mil/public/resumebuild er/builder/Logon [army.mil]

Slashdot Top Deals

To stay youthful, stay useful.

Close