As you’d expect, phishers target organizations that handle significant numbers of customer financial transactions online. And in the last 18 months, customers of Barclays, Citibank, Halifax, HSBC, Lloyds TSB and MBNA, NatWest have all been targeted by phishers. However, it’s not only banking customers: other organizations whose customers have been targeted include amazon.com, AOL, BestBuy, eBay, MSN, PayPal and Yahoo.
Of course, in any single phishing scam, it’s likely that only a small proportion of those who receive the fake e-mail will be customers of the spoofed bank or other organization; and only a small proportion of them may ‘take the bait’. However, as with spam e-mail, the perpetrators send out such large volumes of fake messages that even a low response is likely to harvest enough data to make scam worthwhile. In this sense, the term ‘trawling’ might be more appropriate than phishing.
There are high stakes involved. Estimates of the losses resulting from phishing scams vary [search online and you can find figures ranging from $400 million to $2.4 billion]. However, it seems clear that the number of phishing attacks, and the associated costs, are increasing. From July 2004 through to November 2004, there was a 34% month-on-month growth in the number of new, unique phishing e-mail messages; and a 28% month-on-month growth in the number of unique fraudulent web sites [figures taken from the Phishing Activity Trends Report – November 2004, Anti-Phishing Working Group].
As if this weren’t enough, the problem doesn’t necessarily end with direct costs. Some phishers also place exploits for Microsoft Internet Explorer [IE] vulnerabilities on their sites. When the victim follows the link to the fake web site, the exploit is used to upload a Trojan to their machine. As a result, not only is the user’s banking information harvested, but their machines become unwilling ‘soldiers’ in a ‘zombie’ army that can be used for further malicious activities: as part of a DDoS [Distributed Denial of Service] attack designed to extort money from a victim organization, for use as a platform for spam distribution or for use in the spread of a virus or worm.
It’s hardly surprising that phishing has attracted significant media attention during the last year or so. At the same time, financial institutions now provide advice to their customers about the potential dangers. The result is that users are becoming increasingly wary. So phishers are looking for more sophisticated ways of luring users into giving up their personal banking information.
Some phishers now make use of vulnerabilities [or unwanted features] to make their scams less obvious. An Internet Explorer [IE] vulnerability documented by Microsoft in late 2003 allowed a phisher to create a fake web site that not only has the right ‘look-and-feel’ of a legitimate financial institution, but displays the correct URL in the IE browser window. So when the user clicks on the link in the phisher’s e-mail, the web browser displays content from the fake web site, but the URL in the browser window is that of the legitimate bank. This vulnerability is explained on the Microsoft web site, together with tips on how to identify spoofed web sites.
Other pages: : <<Prev * 1 * 2 * 3 * Next>>
|
You are here: hacking technology
> hacker invade
> Content
Category: Home
> hacker invade