Phishing Makes a Comeback
Not that it ever really went away, but Brian Krebs Security Fix Blog at The Washington Post has read the latest report from The Anti-Phishing Working Group (APWG). It confirms what my junk mailbox, and occasionally my real inbox, have been telling me — attacks are on the increase:
The number of unique phishing sites jumped from 4,630 in November to 7,197 in December, a 55 percent increase. Online scam artists also targeted a wider range of companies in their phishing sites. One scam found at the end of 2005 targeted customers who shop at Wal-Mart’s Web site, telling their their accounts had been compromised.
….. That growth was spurred in large part by the discovery of two critical security flaws in Microsoft’s Internet Explorer browser — MS05-054 and MS06-001 — that allowed malicious Web sites to install software on the visitor’s computer. The APWG report said its members spotted hundreds of sites using exploits for those vulnerabilities to install keystroke-logging software.
In case you have no idea what phishing is, here’s the APWG’s definition on its home page:
Phishing attacks use both social engineering and technical subterfuge to steal consumers’ personal identity data and financial account credentials. Social-engineering schemes use ’spoofed’ e-mails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as credit card numbers, account usernames, passwords and social security numbers. Hijacking brand names of banks, e-retailers and credit card companies, phishers often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using Trojan keylogger spyware. Pharming crimeware misdirects users to fraudulent sites or proxy servers, typically through DNS hijacking or poisoning.
Note the two different types.
The response to the first (social-engineering) is easy: Don’t respond to the e-mails supposedly originating from your financial institution, Ebay, PayPal, or whomever.
The second (technical subterfuge) is more difficult to defend against, and requires (just for starters) a good firewall to prevent intrusions; never opening unknown attachments to e-mails; keeping operating system and browser software up-to-date; and, if you are a Windows user, using two different brands of good spyware-removal software (two because the best brands are currently only elminating about 80% of spyware found, so two different brands “should” achieve about 95% effectiveness in eliminating spyware); and keeping your computer disconnected from the Internet when you are not using it.
