 |
Dangerous new trends emerge in phishing
25 November, 2004
by Mark Cox
Analysts with the Anti-Phishing Working Group have uncovered
what they consider to be disturbing shifts in phishing attacks,
which indicate that hackers are achieving new levels of automation,
possibly commanding software tools and BOT nets to vastly
increase the potency of their phishing campaigns. Phishing,
of course, is a form of online identity theft that uses spoofed
emails designed to lure recipients to fraudulent websites
which attempt to trick them into divulging personal financial
data such as credit card numbers and account usernames and
passwords.
Starting in early October, APWG analysts witnessed massive
increases in the amount of phishing sites, most all outside
the US, indicating that a new and powerful set of tools might
have been deployed recently.
The report notes that starting on the afternoon of October
5, 2004, they started seeing a massive increase in the amount
of phishing sites. Evidence indicated that the phishing exploits
were not targeting one particular brand, but several targeted
simultaneously.
The one common theme of these phishing sites is that nearly
all are being hosted on IP addresses and mostly outside of
the US. The number of these sites that are being hosted on
what appear to be compromised broadband PC's has risen to
more than 50 percent. The APWG concludes that "it appears
as though some sort of toolkit is available and/or a set of
tools that are being used to produce similar exploits. The
sudden large spike may, however, indicate that some automation
may be involved." They also received some feedback from
a post on the incidents mailing list from individuals who
have witnessed large volumes of spam increases since October
5th.
The APWG is also seeing multiple brands being spoofed from
the same machine over a few days. For example a site will
be an Ebay spoof one day, and then Paypal, then Citbank, etc.
The content of the attacks is quite varied. There are several
versions of content that move from site to site.
The actual number of phishing attacks has also risen considerably.
In October, there were 6,597 new, unique phishing email messages
reported to the APWG. This was over three times the number
of unique reports received in August (2,158) and represents
an average monthly growth rate of 36 per cent since July (2,625).
In terms of where the phishing is being conducted, the United
States is once again the 'leader' in the number of hosted
phishing sites. But it appears to be on the decline with 29%
of the total the number of sites hosted in the US during October.
China, Korea, and Russia are next on the list with 16%, 9%,
and 8% respectively of the total sites hosted.
Meanwhile, the number of brands subjected to the largest
numbers of phishing attacks rose from four in July to six
in October, indicating a broadening of attack subjects. The
most targeted industry sector for phishing attacks continues
to be Financial Services, from the perspective of total number
of unique baiting sites as well as number of companies targeted.
This sector averaged 73 per cent of all hijacked brands in
October. The ISP sector now has a solid hold on second place
with 14 per cent in October. A total of 44 brands were hijacked
by phishing campaigns.
The APWG report was authored jointly by Websense Security
Labs and Tumbleweed Communications. The APWG is the global
counter-phishing flag ship organizing the community of stakeholders
confronting the phishing threat, including national law enforcement
agencies, financial institutions, national ISPs, ISVs and
hardware vendors and e-commerce companies. The group has more
than 930 members worldwide from some 590 companies, government
regulatory agencies and law enforcement bureaus, as well as
some 60 sponsors including: ActivCard, Affinity, Anakam, Cloudmark,
Cyota, Cyveillance, Datanautics, Entrust, Experian, GeoTrust,
GoDaddy, MarkMonitor, McAfee, MessageLevel, Microsoft, NameProtect,
NetIQ, PassMark, SAIC, RSA Security, Symantec, Trend Micro,
Tumbleweed Communications, Vasco, VeriSign, Visa, Visa Canada,
Websense and WholeSecurity.
|
|
