Experts: 'Phishing' more sophisticated

Me thinks that CNN needs better "experts". I've bolded two areas. One because of the terminology ("... little known directory called a host file"?!!?) and one because it misses the most important fact: educating users. Giving users a physical token and relying on technology as the only solution isn't the solution to phishing. Phishing is, simply, an elaborate form of social engineering. Educate the user on this and that's half the battle there.

Heck, the ads that Visa did for their "Verified by Visa" were a great educational tool, along with the ones that Mastercard, IIRC, did (male actor with female voice, spending all sorts of money somewhere -- the idea that no one knows who you are). So rather than depend on having it on the website, why not do some quick spots? Educating the users means less money spent on tracking this crap down. And that can often mean more profit (what a concept).

Quote:

---

Source: CNN

WASHINGTON (Reuters) -- Internet "phishing" scams are becoming more difficult to detect as criminals develop new ways to trick consumers into revealing passwords, bank account numbers and other sensitive information, security experts say.

Scam artists posed as banks and other legitimate businesses in thousands of phishing attacks last year, sending out millions of "spam" e-mails with subject lines like "account update needed" that pointed to fraudulent Web sites.

These attacks now increasingly use worms and spyware to divert consumers to fraudulent sites without their knowledge, experts say.

"If you think of phishers initially as petty thieves, now they're more like an organized crime unit," said Paris Trudeau, senior product manager for Internet-security firm SurfControl.

Phishing attacks have reached 57 million U.S. adults and compromised at least 122 well-known brands so far, according to several estimates.

At the end of 2004 almost half of these attacks contained some sort of spyware or other malicious code, Trudeau said.

One attack, first documented last month by the Danish security firm Secunia, misdirects Web surfers by modifying a little-known directory in Microsoft Windows machines called a host file. When an Internet user types a Web address into a browser, he is directed instead to a fraudulent site.

This technique has shown up in attacks spoofing several South American banks, said Scott Chasin, chief technical officer of the security firm MX Logic.

The convergence of all of these threats means "we can expect to see some large attacks in the near term," he said.

Another more ambitious attack targets the domain-name servers that serve as virtual telephone books, matching domain names with numerical addresses given to each computer on the Internet.

If one of those computers is compromised, Internet users who type in "www.bankofamerica.com" could be directed to a look-alike site run by identity thieves.

Domain-name servers are tougher to crack, as they are typically run by businesses rather than home users, but hackers can find a way in by posing as a company's tech-support department and asking new employees for their passwords, Trudeau said.

Domain-name hijacking is suspected in incidents involving Google.com, Amazon.com, eBay Germany and HSBC Bank of Brazil, Chasin said.

Even straightforward phishing attacks are getting more sophisticated. Spelling errors and mangled Web addresses made early scams easy to spot, but scam artists now commonly include legitimate-looking links within their Web addresses, said Kate Trower, associate product manager of protection software for EarthLink Inc.

Consumers who click on links like www.citibank.com in these messages are directed to a fraudulent Web address buried in the message's technical code, she said.

MasterCard International has caught at least 10 phishing scams involving www.mastercard.com over the past two months, said Sergio Pinon, senior vice president of security and risk services.

Consumers can protect themselves with software that screens out viruses, spyware and spam. But online businesses will have to take steps as well, perhaps by issuing customers a physical token containing a changing password, Chasin said.

Internet engineers should also figure out a way to authenticate Web addresses, much as they are currently figuring out how to make sure e-mail addresses are legitimate, he said.

---

I think they're being forced into the assumption that your average user is too dumb to learn how to dodge phishing attacks.

I think the solution is to make people pass a test to be able to use a computer, like a driving test.

That way, we can have a 'computer training school' that teaches people that making viruses and defacing websites are eventually self-destructive, and so on...

Quote:

---

I think they're being forced into the assumption that your average user is too dumb to learn how to dodge phishing attacks.

---

Forced? How are they being forced into this belief?

Quote:

---

I think the solution is to make people pass a test to be able to use a computer, like a driving test.

That way, we can have a 'computer training school' that teaches people that making viruses and defacing websites are eventually self-destructive, and so on...

---

And who would administer this? Who would pay the cost for this? How would you prove whether someone has taken the training or not? How are you going to enforce that people take this training.

There are tonnes of schools that already teach this kind of ethics as well as trains people on how to prevent this. However, most of the people attending are ones that want to be in a computer-related job (e.g., technical support, administrator, etc.). It's everyone else that we need to be concerned about.

We have to be somewhat realistic about whatever training that users are given. And, based on my own experiences, I find that users take the path of least resistence. This includes training. So rather than force them to do something they aren't interested in doing, why not show them something in an environment they already want to use? (e.g., run TV ads during primetime shows that appeals to the user).

Quote:

---

Originally posted here by Spiritus
I think they're being forced into the assumption that your average user is too dumb to learn how to dodge phishing attacks.

I think the solution is to make people pass a test to be able to use a computer, like a driving test.

That way, we can have a 'computer training school' that teaches people that making viruses and defacing websites are eventually self-destructive, and so on...

---

That is highly impractical i would say.
Computer has reached third world countries and also rural parts in some of developing and least developing countries.
We shouldn't deprive them of such a wonderful resource in the name of security.
Should we?

Now to the origional problem MsMitten is right this educating the end user is probably the most effective(or the only possible solution).
It is just anather form of social engineering.
I guess the key to this type of security threat is keeping things simple.
When humans become excessively dependent on technology problems arise and solution to those problems is educating the end users. :P

Well, my response was intended to be tongue-ni-cheek, but since we're considering this...

Quote:

---

Originally posted here by MsMittens
Forced? How are they being forced into this belief?

---

Well, by the fact that your average user tends to be too dumb to learn to watch for phishing.

Ok, well, support-desk-born bitterness aside, perhaps it would be more objective to say that your average user doesn't have the technical grounding to understand what to watch out for in phishing attacks, and doesn't have the motivation to learn. Lectures simply lead to glazed looks and nodding and smiling in the hope that you'll go away. There are otherwise intelligent people out there who have been using computers for years, who are still uncomfortable with install programs.

As specialists in the 'IT' field, we forget how big and scary and confusing it is to the uninitiated.

Quote:

---

Originally posted here by MsMittens
And who would administer this? Who would pay the cost for this? How would you prove whether someone has taken the training or not? How are you going to enforce that people take this training.
[/B]

---

The same as driving licences, TV licences and all of the other governmental ripoffs that plague our existence. The user pays a yearly sum for the licencing costs (plus skimming, payoffs and monopoly abuse as per standard practice) and receives an official card or certificate.
For enforcement, perhaps ISPs could be required to ask for certification before supplying a connection to a household (If there is a certificate holder in the house, he/she would be responsible for the behaviour of those in the house). I suppose it would have the enforcibility level of a driving license. Spot checks, maybe?

Quote:

---

Originally posted here by MsMittens

There are tonnes of schools that already teach this kind of ethics as well as trains people on how to prevent this. However, most of the people attending are ones that want to be in a computer-related job (e.g., technical support, administrator, etc.). It's everyone else that we need to be concerned about.

We have to be somewhat realistic about whatever training that users are given. And, based on my own experiences, I find that users take the path of least resistence. This includes training. So rather than force them to do something they aren't interested in doing, why not show them something in an environment they already want to use? (e.g., run TV ads during primetime shows that appeals to the user). [/B]

---

As much as I like this idea, I have to say that TV ads are horrendously expensive in their own... and they are a dead cost, with no potential ROI (at least, not directly). A certification system would have potential income for the authority, with admin charges and fines... assuming the authorities would front the initial setup charges.

Anyway, a silly ideal that sounds nice. I still think it'd work, though...

Quote:

---

The same as driving licences, TV licences and all of the other governmental ripoffs that plague our existence. The user pays a yearly sum for the licencing costs (plus skimming, payoffs and monopoly abuse as per standard practice) and receives an official card or certificate.
For enforcement, perhaps ISPs could be required to ask for certification before supplying a connection to a household (If there is a certificate holder in the house, he/she would be responsible for the behaviour of those in the house). I suppose it would have the enforcibility level of a driving license. Spot checks, maybe?

---

Right. Governments are already spending too much in too many areas. Having them, and we know how technically advanced the government is, license this is hugely impractical. And ISPs are in the business to make money. Who's going to pay them to do the "enforcement"? This would be challenged heavily in courts since ISPs are not trained for enforcement (it'll raise ISP costs if they have to be trained under guidelines similar to police officers and other law officials).

And then the possibility of forged certificates?? What about people pretending to offer courses so you can get your "license"? Or pretending to act on behalf of the gov't to issue the license? Would it be specific for Microsoft only? So if people used Linux/MacOS, they wouldn't need a license (don't get spyware and/or worms to the extend that MS products do)? What about foreign countries? Are we going to force them to follow suit? How do you convince them to be part of this when their budgets in many cases just can't handle "one more thing"? There are quite a few people online from the UK, Europe, Australia, China, India.

You pan ads because of a lack of ROI. And you think this is going to create an ROI!?

Quote:

---

A certification system would have potential income for the authority, with admin charges and fines... assuming the authorities would front the initial setup charges.

---

You've never seen a gov't implement a simplistic certification program have you? They tried to implement a gun registry here in Canada (it's running). It was supposed to cost something in the $2 million (IIRC) and eventually pay for itself. At present, it's well over $2 BILLION. I have little to no faith in having the gov't run this. In addition, particularly for those in the US, what additionally layer of Big Brother would this add?

Interesting but I don't think it's a pratical idea.

Educating the end user, to me, is the only viable solution.

If all new computers would come with a booklet, or even an interactive CD, that would contain the basic security needed by the user.......it would be more effective than any other form. Also, if they were to produce this booklet in a cartoon style, almost everyone would at least glance through it and perhaps learn something.

Perhaps combining the booklet/interactive CD with TV comercials would be even more effective.

I really don't think that there is a 'one size fits all' approach to educating the public. I believe it would have to be approached as any good security system has to be........in a layered format.

Well that's the thing... most of the infrastructure is already in place in any government that has a motor vehicle licensing system, and most governments could do with another source of income.

I wasn't suggesting that ISP's directly enforce complience, just indirectly via not providing services to account holders that cannot produce such a license.

Forged certificates are a problem, of course, but then so are forged driving licences/gun licences/etc. The same logic applies.

I'm sure the computer licence could be made generic to every operating system... the theory is still applicable.

Getting buy-in from foreign countries is of course the sticking point. No country wishes to admit that their population contains idiots. Perhaps heavy emphasis on the yearly losses due to computer-related crimes/screwups/etc...

As for the ROI, I think this has a much higher ROI potential than prime-time ads with no associated product. A local ten second radio ad here costs roughly the equivalent of about US$500... that's a potential customer base of 50000, at a guess. Now extend that to prime time television airtime on a large American television network... you're looking at tends of thousands of dollars per second, (possibly even more, this is just semi-educated guesswork) and you havn't even factored in the cost of making the adverts. And you've maybe reached some of the people in part of America.

I have to say, you do have a valid point in terms of governmental competency. A noticalble chink of the users you are trying to reach would probably be involved in running the system ;)
I wouldn't use Big Brother as a valid worry, though, specially in the states... with the acts that have been slipped through after the twin towers tradegy, I think that this would barely be noticed...

But yeah, I don't think this is practical, any more than the TV ads. My only serious suggestion is limit who produces offspring, try and stop humanity as a whole apparently breeding for lack of intellect.

:P

Knowledge is Half the Battle! CBS...NBC? ABC? has it right! (If that's the phrase...I forget.) User awareness can not be supplanted by certification, tokens, digital signature verification authorities, or any other contraption spewed from the mind of us 'experts'. The human is always the vulnerable link in security.

Oh, technology can help, but I have a stack of RSA SecurID pin-pad token cards to demonstrate otherwise (the client insisted that these were the only acceptable form...the Fob tokens meant the PIN was sent as part of the passcode, so anyone who could view/sniff/decrypt the traffic could learn the PIN) I kept this stack specifically becuase each one shows how a user wrote the PIN on the token with permanent marker, or tape it on, or anything else. The client had gone to the considerable expense of purchasing these things for a community of 15,000+ users, and prepared an informative user awareness packet, and these folks STILL did this, because they simply didn't get it. It's human nature.

And that point is a significant one. If you want to pursue I.S. as a career, and you want to do more than run ping sweeps, vulnerability assesments, and log reviews, you probably are gonna need some people-skills to work with the 'uninformed'. If you want to be successful and go far, you'll need to deal with these folks graciously. Fortune 500 companies do not pay for Security Analysts, Engineers, or Managers that display an attitude of contempt for users and their practices.

But, of course, educating users is hard work and the profits for the A/V and anti-spyware firms may go down a little if we do that.

Now we wouldn't want to be reponsible for that, would we?

You have a valid point, zencoder. I think you'll still agree that there is a serious problem here, though... what would your proposed solution be? Humanity has always been the weak link in the chain, wether through valid error, ignorance or maliciousness... there has to be some kind of mitigating system we can apply.

Actually there are much better commercial systems that can aid in authenticating the email for the user automatically (or just using digital signatures but there is an education issue here that the businesses cannot solve). I'll look em up later and post on them.

Quote:

---

what would your proposed solution be?

---

There is no and never will be a 100% solution. That's something I think we'll have to accept. As time passes, technology becomes more complex and the attacks become more complex. People are licensed and trained every day to drive cars safely and yet, on a daily basis, people get killed due to DUI, speeding, poor driving habits, etc.

Does that mean we shouldn't try? No. We should keep trying. They key here is that we mitigate our risks as much as we can by educating our users (a video that runs when the user first starts the machine and can't be turned off might be one way of "encouraging" users to pay attention). Additionally, getting the media to publish stories that have proper facts and hints would also be good. Moxnix is right in that it needs to be a layered approach.

I don't know if society is ready for a physical device option yet and don't know if it's practical. Neither is a wide-spread biometric option (fingerprints are too easily circumvented and abused; iris scanning is too costly for personal usage as are RSA token generators).

Whatever is used to mitigate these problems has to be flexible enough to adapt to new technologies which is why, IMO, a certain level of constant education (through a variety of media) would be a good place to start.

This is a wild run, the original post said "it was to tweak your interest" and it sure did. Read Antionline, thats what it is all about folks....

ok, your all missing one fundamental thing:

Humans are stupid.

Ok, your avarage person does not THINK it will happen to them, therefore they zone out and do not pay attention. There is a really simple fix: let them experiance it.

Say you are a company and educating your employees about SEing. A lecture only goes so far, after that, you gotta show the employee that it CAN happen to them. have a tech call up each employees one after another and attempt to get some sensitive info out of them using social engineering techniques. If they succeed, them talk to them about it and warn them not to fall pray in the future. Furthermore, if you're really woried about it, you could take it even further, and play a "prank" on your employees, keep going through with it, call these people in and inform them that they have caused so and so SE to gain sensitive info and the company has lost so and so ammount, really play it up and get the gravity of it hammered into their head. At the point they look like they are ready to faint from distress, let them in on it and say to remember that this could happen for real.

As far as home users, theres not much you can do. Companies (eg: bank or whatever), simply need to say that if the attack could have been easily prevented by following the guidelines they set out (they will need to set some out) they will not get any compensation back, even if the phishers are caught. This will firstly get the users attention, as they do not want to loose money, secondly, and secondly no need for expensive and futile advertising campaigns against phishing (keep it at a acceptable low to get the message accross to those who will listen, but not waste time on those who wont). Once a user is scammed, they will have learned their lesson, if a user hears a first hand account from one of his/her freinds, hes also more likely to listen. Humans learn from their own mistakes, the more distant the warning is, the less impact it will have. In order to truely get through, the user victim needs to experiance it for them selves.

Blunt as he is, I think VorTexx has the right idea. I don't mean we should abandon all hope and give up *trying* to educate, but let them experience the frustration of dealing with this. It *is* nice to be able to say "I told you so" every now and then.

As I've said, is it really a bad thing if some people are dissuaded from using the Internet, if they can't be bothered to learn a few pratical tips about security and netiquette? I swear to GOD I'm tired of getting the (L)user mail about "this cookie recipe from Neman Marcus" or "Bill Gates will send you money" or...well you all know. I'm sure you've seen them once or twice.