PHISHING

1
PHISHING

• Kathleen Ting
• COEN 150 1 March 2005

2
(No Transcript)
3
We periodically review accounts - your account
will be put on restricted status. To lift this
restriction, you need to complete our credit card
verification process. Due to technical
security update you have to reactivate your
account. We are having problems with the
billing information in your account. We would
appreciate it if you would visit our website eBay
Billing Center and fill out the proper
information that we need to keep you as an eBay
member. Recently our customers have reported
receiving fraudulent e-mails that appear to be
from Bank One. Please login and learn more about
what's happening and how to protect yourself.  
4
Phishing is a term used to describe the action of
assuming the identity of a legitimate
organization, or web siteusing forged email
and/or web pageswith a view to convince
consumers to share their user names, passwords
and personal financial information for the
purpose of using it to commit fraud.
5
Phishing statisticsCourtesy of Gartner, Inc and
the Anti-Phishing Working Group

• 57 million Americans either are sure that they
  have received email attacks from phishers or
  believe they may have
• 11 million have clicked on the link in the email
• 1.78 millionabout three percent of those
  attacksrecall disclosing sensitive financial or
  personal information
• Of those, 980,000 were actually scammed
• Rate of attack has been growing exponentially
  since October 2003
• 282 phishing attacks launched last February
• 402 last March
• 1,974 attacks last July
• If these statistics dont seem all that
  impressive, keep in mind that each attack spawns
  tens of thousands of emails

6
Courtesy of the Anti-Phishing Working Group
7
Who phishes?

• Low-overhead crime
• Junior
• Grandma
• Organized crime
• Spammer
• Credit card number launderer
• Web graphics mastermind

8
Phishing methods

• SMTP
• Architectural flaw existence of sender of
  message not double-checked
• HTML-based email
• Lifted logos?trademark infringement
• HTML forms
• Bogus URL hidden in submit button

9
Phishing methods

• DNS
• Architectural flaw can hijack domain
• Lowercase letter L for number 1
• Trojan horses and spyware
• Keystroke logger
• Malicious Javascript
• Fake browser adress bar
• Social engineering
• Innate helpfulness of people

10
What companies can do to protect you

• Two-factor authentication
• Firewalls implementing heuristics
• Digital certificates
• SMTP server extension

11
What you can do to protect yourself

• STOP
• LOOK
• CALL

12
Future direction

• eBay
• Green light, red light
• Brightmail
• Anti-phishing software
• EarthLink
• ScamBlocker
• Phish Reporting Network
• Microsoft, eBay, PayPal, Visa

13
QUESTIONS?