Phish as a Fraudulent site
This type of phish attack are mostly hosted on a compromised server and the rest are hosted on free web hosting services. The phish data collected is on the same server or send to another hacked/compromised server.
Phish as an embedded email form
This type of phish attack is distributed as mass mailing and is called as a "spear phish" attack. This attack uses a network of "Botnets". Data is collected through Free form data collectors.
Phish by Redirecting Traffic
This type of attack is targeted at banks which are using 2 factor authentication process. This attack is also called as a Man in the middle attack. Its a highly sophisticated attack and sessions are hijacked in this attack.
Phish by Key Logger Trojan
This type of attacks are distributed through spam emails carrying Trojans, compromised sites and through botnets.
Sunday, December 13, 2009
Thursday, December 10, 2009
Credit Union Customers Fooled by Bogus Text Messages
Title:
Phishing Scam Expands to Three More States
Reference:
http://www.bankinfosecurity.com/articles.php?art_id=1986&rf=120709eb
Dated:
December 7, 2009
Details:
Banking customers in three additional states have received bogus text messages purporting to be from their institutions.
As part a growing wave of similar phishing attempts throughout the nation, customers in Cincinnati, Ohio, St. Louis, Missouri and Lewiston, Idaho last week reported receiving text messages stating their bank accounts had been frozen.
These attacks mirror those against bank customers in October in Pennsylvania, Nebraska and New York, and are part of a continuing wave of phishing attacks that have shot up 600 percent over last year, according to the Anti-Phishing Working Group.
In Ohio, one Cincinnati US Bank customer told law enforcement about receiving the text message, calling the phone number listed and then giving out an account number, expiration date and PIN. The next day, the customer became suspicious and called the number again and heard the following message: "This is a message from the Federal Trade Commission. The telephone number you've just called has been disconnected because it may be involved in a scam."
The customer called US Bank, had the card replaced and didn't lose any money. Law enforcement reported a number of banks had been targeted in the scam.
Similar reports come in from Bridgeton, MO-based Vantage Credit Union customers who reported to the credit union they received the text message phishing scam.
According to Eric Acree, executive vice president at Vantage, the phishers began sending fake text messages over the weekend. Phishing scammers have posed as the credit union before, and Vantage is trying to educate customers about its security procedures, Acree says. When the number in the text message was checked early last week, the recording states it also has been disconnected by the FTC. XUMG7M7BK3A9
Phishing Scam Expands to Three More States
Reference:
http://www.bankinfosecurity.com/articles.php?art_id=1986&rf=120709eb
Dated:
December 7, 2009
Details:
Banking customers in three additional states have received bogus text messages purporting to be from their institutions.
As part a growing wave of similar phishing attempts throughout the nation, customers in Cincinnati, Ohio, St. Louis, Missouri and Lewiston, Idaho last week reported receiving text messages stating their bank accounts had been frozen.
These attacks mirror those against bank customers in October in Pennsylvania, Nebraska and New York, and are part of a continuing wave of phishing attacks that have shot up 600 percent over last year, according to the Anti-Phishing Working Group.
In Ohio, one Cincinnati US Bank customer told law enforcement about receiving the text message, calling the phone number listed and then giving out an account number, expiration date and PIN. The next day, the customer became suspicious and called the number again and heard the following message: "This is a message from the Federal Trade Commission. The telephone number you've just called has been disconnected because it may be involved in a scam."
The customer called US Bank, had the card replaced and didn't lose any money. Law enforcement reported a number of banks had been targeted in the scam.
Similar reports come in from Bridgeton, MO-based Vantage Credit Union customers who reported to the credit union they received the text message phishing scam.
According to Eric Acree, executive vice president at Vantage, the phishers began sending fake text messages over the weekend. Phishing scammers have posed as the credit union before, and Vantage is trying to educate customers about its security procedures, Acree says. When the number in the text message was checked early last week, the recording states it also has been disconnected by the FTC. XUMG7M7BK3A9
Monday, December 7, 2009
Top five phishing tips every citizen should know
- Always verify you're at the right website before entering information
- Visit websites by typing the URL directly into the address bar
- Regularly visit different anti-phishing websites for news and updates on phishing scams and new techniques
- If you feel you've been a victim of a phishing scam, you should immediately report the scam to the company that's being spoofed. If you're unsure how to contact the company, visit its website to get the correct contact info
- Regularly check your bank and credit card statements to check that all transactions are legitimate. If you notice anything suspicious, contact your bank immediately
Taking the test
Now that you know what to look for in a potential phishing e-mail or website, the next step is to test your skills.
Point your browser to the below websites to take the Phishing IQ test.
Once you've completed the test, the site will provide a post-mortem of each e-mail and explains why that particular message was legitimate or not.
Try it out.
Point your browser to the below websites to take the Phishing IQ test.
- http://www.sonicwall.com/phishing
- http://onguardonline.gov/quiz/phishing_quiz.html
- http://www.onguardonline.gov/games/phishing-scams.aspx
- http://survey.mailfrontier.com/survey/quiztest.cgi?themailfrontierphishingiqtest
Once you've completed the test, the site will provide a post-mortem of each e-mail and explains why that particular message was legitimate or not.
Try it out.
Saturday, December 5, 2009
3 ways to recognize a spoof website
1. The URL
If you visit a login page, online shopping site, banking or credit card website, make sure the URL in the address bar includes "https". Https doesn't mean that the site is secure. It only shows that site has an SSL Certificate and that the encryption between Client and Site is encrypted. A Phisher can go and buy an SSL Certificate for less than 50 dollars and put it on his phish site.
Client should verify by clicking on the Certificate to make sure that the Certificate belongs to the company who owns the site.
For instance, http://login.abcbank.com/config/login_verify. As you can see from this example, the website does not include the "s" and is therefore unsecured and therefore is a phishing website.
Moreover, if the web link you're visiting contains an IP address (e.g. http://192.135.5.6.anybank.payment12.com), and then it's without a doubt fake website, as no legitimate company would ever direct you to an IP-named webpage.
2. Domain Names
Whilst some phishers use different domain names altogether, others use misspelled domains to trick you into thinking they are legitimate. They either buy a domain name that resembles the actual domain or they will swap letters very cleverly, so that it isn't obvious.
Therefore, it's key that you keep a close eye on the spelling of domain names and not be tricked into clicking on www.mircosoft.com or www.bankofvvalescom
Also look out for variations in domain names. For instance, sites such as http://support.microsoft-security.net are not legitimate. If it actually belongs to Microsoft it will read http://support.microsoft.com
3. The lock icon
If you're at a secure website, you should see a closed padlock icon on the lower right corner of the browser window. The closed lock signifies that the website applies encryption to its personal and financial data.
If you click on it, it will open a window that gives you more details regarding the security certificate. Every company that asks you for sensitive information must have a digital certificate, preferably one from an established certificate authority such as Thawte, Digicert or VeriSign.
Note that many phishers place a fake closed padlock icon on the webpage itself to trick you into thinking the page has a valid certificate.
If you visit a login page, online shopping site, banking or credit card website, make sure the URL in the address bar includes "https". Https doesn't mean that the site is secure. It only shows that site has an SSL Certificate and that the encryption between Client and Site is encrypted. A Phisher can go and buy an SSL Certificate for less than 50 dollars and put it on his phish site.
Client should verify by clicking on the Certificate to make sure that the Certificate belongs to the company who owns the site.
For instance, http://login.abcbank.com/config/login_verify. As you can see from this example, the website does not include the "s" and is therefore unsecured and therefore is a phishing website.
Moreover, if the web link you're visiting contains an IP address (e.g. http://192.135.5.6.anybank.payment12.com), and then it's without a doubt fake website, as no legitimate company would ever direct you to an IP-named webpage.
2. Domain Names
Whilst some phishers use different domain names altogether, others use misspelled domains to trick you into thinking they are legitimate. They either buy a domain name that resembles the actual domain or they will swap letters very cleverly, so that it isn't obvious.
Therefore, it's key that you keep a close eye on the spelling of domain names and not be tricked into clicking on www.mircosoft.com or www.bankofvvalescom
Also look out for variations in domain names. For instance, sites such as http://support.microsoft-security.net are not legitimate. If it actually belongs to Microsoft it will read http://support.microsoft.com
3. The lock icon
If you're at a secure website, you should see a closed padlock icon on the lower right corner of the browser window. The closed lock signifies that the website applies encryption to its personal and financial data.
If you click on it, it will open a window that gives you more details regarding the security certificate. Every company that asks you for sensitive information must have a digital certificate, preferably one from an established certificate authority such as Thawte, Digicert or VeriSign.
Note that many phishers place a fake closed padlock icon on the webpage itself to trick you into thinking the page has a valid certificate.
5 Ways to Recognize a Phishing e-mail
1. The "From:" Address
Most phishing e-mails include a legitimate looking e-mail address to make it appear that the message is coming from your bank or an online service. However, these can very easily be forged. So, if you spot one or more of the remaining clues here then it's likely the "From:" e-mail address is a spoof.
2. Subject Title
The subject headline of a phishing e-mail almost always has a sense of urgency. The "Restore your Account Access" subject headline in the example above is a case in point. Common phishing headlines include "Very important announcement", "Account suspended", "Money received" and "Verify your account." In addition to the urgency factor, be sure to look out for typos or spelling mistakes in the e-mail.
3. Who it is Addressed To
Scam e-mails are usually sent out in bulk and don't include your first or last name. If you receive an e-mail that states "Dear Paypal customer" or "Greetings BankName customer", then the e-mail is a spoof.
4. The Included Web Link
This is the most crucial clue to look out for. In our example above, the "Click here to restore your account access" leads you to believe you will be directed to www.paypal.com, however in reality you'll be redirected to http://www.Free_Web_Hosting_Site/www.paypal.com/cgi-bin-us/login/, which is a spoof website.
Now while some phishers use the text link tactic, others prefer to use "masked" web links. This means the link you see in the e-mail won't send you to that link but a phishing site instead. So clicking on say https://www.XYZbank.com would actually take to you http://192.165.1.8/XYZbank.html.
5. Urgency of Message
Most phishing e-mails try to deceive you by warning you that your account will be in jeopardy if it's not updated immediately. An e-mail that urgently requests you to offer sensitive info is typically fraudulent.
In the above example, the phishers are trying to reel you in by claiming that your account has been compromised. Other spoof e-mails include statements such as, "If you don't respond within 24 hours, your account will be shutdown". Don't fall for it.
Most phishing e-mails include a legitimate looking e-mail address to make it appear that the message is coming from your bank or an online service. However, these can very easily be forged. So, if you spot one or more of the remaining clues here then it's likely the "From:" e-mail address is a spoof.
2. Subject Title
The subject headline of a phishing e-mail almost always has a sense of urgency. The "Restore your Account Access" subject headline in the example above is a case in point. Common phishing headlines include "Very important announcement", "Account suspended", "Money received" and "Verify your account." In addition to the urgency factor, be sure to look out for typos or spelling mistakes in the e-mail.
3. Who it is Addressed To
Scam e-mails are usually sent out in bulk and don't include your first or last name. If you receive an e-mail that states "Dear Paypal customer" or "Greetings BankName customer", then the e-mail is a spoof.
4. The Included Web Link
This is the most crucial clue to look out for. In our example above, the "Click here to restore your account access" leads you to believe you will be directed to www.paypal.com, however in reality you'll be redirected to http://www.Free_Web_Hosting_Site/www.paypal.com/cgi-bin-us/login/, which is a spoof website.
Now while some phishers use the text link tactic, others prefer to use "masked" web links. This means the link you see in the e-mail won't send you to that link but a phishing site instead. So clicking on say https://www.XYZbank.com would actually take to you http://192.165.1.8/XYZbank.html.
5. Urgency of Message
Most phishing e-mails try to deceive you by warning you that your account will be in jeopardy if it's not updated immediately. An e-mail that urgently requests you to offer sensitive info is typically fraudulent.
In the above example, the phishers are trying to reel you in by claiming that your account has been compromised. Other spoof e-mails include statements such as, "If you don't respond within 24 hours, your account will be shutdown". Don't fall for it.
Awareness on Protecting yourself from Phishing
Description
Introduction
According to Gartner, approximately 3.6 million people lost money to phishing e-mails and spoof sites in 2007, in contrast to 2.3 million in 2006.
In the USA, it's estimated that 3.2 billion dollars was stolen in phishing scams in 2007. Now that's a lot of money.
Don't get hooked
Considering the huge number of websites you visit everyday, both regional and international, it's crucial that you recognize a phishing scam when you see one.
To help you hook those cunning phishers before they hook you, read on and take notes. What you learn here could save you a fortune!
Back to basics
For who are new to the world of phishing, Phishing is a method of data theft, involving spoof email messages and fake websites, the aim is to make innocent customers believe giving personal or financial information to a trusted source but in reality that information is given to a Phisher who planted the phish site on a hacked server or free web hosting site.
Once the Phisher receives your personal or financial information, they can potentially use it to commit identity theft, charge your credit cards, empty your bank accounts, even read your emails and much more.
Subscribe to:
Posts (Atom)
