Phisher's Dictionary

[admin]

Who are Phishers and what do they do?

Phisher (pronounced as “fisher”) is a term used for a person who does the act of Phishing.

PHISHERS are like parasites in this Web World, who take the advantage of the vulnerabilities in the system and pose a big threat to the very existence of Online Transactions.

Phishers are basically fraudsters who use social engineering tricks on the Internet and some harmful software to pry on your important personal and financial information. They gather important information like your bank logins or credit card information and then use it like their own.


Phishers Psychology

An insight into the Phishers mind will reveal that not all of the Phishers do it for money. There are some who do it because they think it is fun. Some others do it because they get a kick out of it. Find below the common characteristic traits of these fraudsters
They mostly fall under the age group of 15 to 30.
They are easily susceptible to online crime because of easy access to internet and also because of the negative environment they grow up in.
They don’t fear being caught or their identity being revealed because it’s on the internet and there’s no physical appearance at any point of time.
Most of them wish to make big money in short time. On a good day, they even make $20,000 to $50,000 in 24 hours.
They think it is fun. Some start with having fun then get into serious crime.
Mostly the fraudsters are from poor nations or developing countries.
They hardly bother about victim’s emotions and feelings.
For most of them, it’s their job to make a living.
They have unlimited access to technology and have extremely good technical expertise.
They are smart and often think of innovative ways to cheat people.
Target

The most favorite target for the fraudsters are innocent people who are not aware of the various kinds of technology frauds that are prevalent. Also among the target are people who are not so savvy with the computer and who are usually lured with the prospect of making easy money or dating.

When it comes to targeting large organizations, the Phishers usually target the financial organizations because these organizations do a lot of financial transactions everyday and all of their work and information is dependant on technology.


Tricks and Techniques

The Phishers or fraudsters use all the tricks and techniques of social engineering to trap innocent victims. The victims usually fall prey to what seems like a genuine request for personal and financial information.

Phishing
One of the common ways of phishing is to use a Web design and URL which closely resembles that of your bank. The fraudster then sends emails at random, asking you to verify or update your account details along with a link embedded in the email. This is a URL to the fraudulent Web site made to look real with information and other details closely resembling the original. You then enter your account details and password (sadly, it’s for the fraudster and not for your bank.). The fraudster would then see your account details and password in clear characters. This is when your account becomes susceptible to use by the fraudster in any way as he pleases

Dating Scams
Fraudsters pose as beautiful girls and enroll themselves in various dating and social networking sites. Novice users not aware of this ploy get attracted to them by seeing some fake pictures/videos and contact them. Fraudsters then exploit them to the maximum extent like:
Claiming that they are in deep financial trouble and would like you to support them with some money.
Claiming that they need money as he/she wants to come to US and marry her/him.
Get bank accounts from them for transferring stolen money making them money mules
Use their address to send bill pay check (sent from compromised accounts) and asking them to cash the check at their bank account and forward the cash to them.
Using their address to send purchased goods bought by stolen cards and then asks them to forward to their country as most of the online shops do not send goods overseas.
Users need to be careful when comes to dating scams because it is an emotional loss apart from a monetary loss. They might lose trust on the Internet and people altogether.

If you are interested in dating an online partner you need to verify the partner carefully before you begin the relationship. If the partner is based overseas, then make sure to call them and verify the phone number and address of the place given by the partner. Because most of the fraudsters even though use a US or UK phone number, they use the forwarding feature of these numbers and stay overseas.


Vishing
Here fraudsters setup a fake call center using Voice over IP (VOIP). They usually send emails asking you to confirm your banking details as a security check at the phone number provided in the email. As you are not aware about this, you call the number believing it to be a bank phone number and end up giving your banking details and other personal information at the Interactive Voice Response (IVR) phone number. They record your calls and use it for fraudulent purpose.

Fraudsters often think of innovative ways to scam innocent people. Most prevalent are phishing, pharming, URL spoofing, dating or romance scams, job scams, money mules scams, over payment fraud, foreign lottery scams, pharmacy scams, auction scams, Escrow service scams, advanced fee scams, cross border scams, investment scams, charities fraud, Debt elimination scams, Nigerian letter scams or Nigerian 4-1-9 scams, Foreign lottery scams, Sweepstakes or prize scams, Work from home scams, Counterfeit cashiers checks fraud, Counterfeit money order scams, Telemarketing fraud, spam emails, spy ware, hacking and much more.


Cashing your information

Have you ever wondered how others would use your personal and financial information after they’ve stolen it from you? Below are some of the common ways how they’re used:
Identity theft – Your identity can be used to impersonate you and commit hideous crimes.
Credit card information – can be used to shop online or create a counterfeit card to shop in stores.
Bank Logins – can be used to transfer funds, pay bills or obtain loans and cards.
Debit card information - to create duplicate debit cards and withdraw amounts at ATM and Point of Sale transactions
ebay logins - to bid auctions
PayPal logins – transfer your money to other PayPal accounts
Trading accounts - to trade stocks
SSN and DL information - to create duplicate cards and get social benefits in your name or commit other crimes.

What’s worse is that you could lose all this without you even knowing that you lost it and by the time you realize, it is too late to make amends and you’re probably bankrupt. This is exactly what happens when you disclose your personal details at unknown sources on the Internet.


Communication

Even in the world of cyber crime there are specialists who are experts in a particular area of crime. Some are experts in hacking, some in setting up fake websites, some in stealing credit card information etc. Though these guys are located at different parts of the world they usually meet at a common place to communicate with each other and sell each other’s expertise.

There are various means by which these guys communicate. The most common are underground forums which are not accessible to law enforcement agencies or common public. They also meet in private IRC chat rooms, messenger chat sessions or email conversations to share their services for a price and few of them go to an extent of hosting websites to sell stolen cards.

Who’s who?

Most of us are familiar with terms Phishing and Phishers, but there are many others who support them. Here are few names

Impersonators:
These guys take all the stolen data of a cardholder and contact the banks posing as the cardholder. With that information they might change the billing address to receive goods, order for a credit card, obtain a bank loan, or use the cardholder’s identity to commit crime.

Pin Cashiers:
The PIN cashiers are a group of fraudsters who specialize in making a replica of the ATM cards and then cash them at ATM's using the theft data got by ATM skimming , Point of sale skimming or phishing.
Dump Vendors:
A dump is the information of your card’s magnetic strip which includes track1 and track2. These guys sell magnetic strip data of credit cards which is either stolen at ATM's using ATM skimmers, POS scams, hacked from merchant Websites and phishing scams. They usually sell each card ranging from 10 USD to 150 USD depending on the card’s credit limit.

Bank Drops:
The role of these guys is to provide bank accounts by making common people victims of dating scams or money transferring agents so that Phishers can make bank transfers or bill pays using the stolen data.

Drops:
These guys provide legitimate address to ship goods which are bought using the theft credit cards or collect money made from auctions fraud or other frauds.

Hackers:
Hackers are those tech savvy individuals who hack into websites for credit cards or to host phishing scams. They hack into novice user computers and can use the victim’s personal or financial information for their own purpose. They might use the victim’s computers as bots (a chain of computers which can be controlled simultaneously) to send millions of spam emails or use them as proxies to cover the tracks of the original IP address.

Connectivity:
All these guys who are experts in different kinds of fraud meet at a common place like an underground forum which is not accessible to law enforcement agencies or common public. They also meet in private IRC chat rooms and messenger chat sessions to share their services, for a price of course.

Money Transactions:
These guys are located around the globe and they usually use e-currencies to transact.

Covering the tracks

One of the reasons why phishing and other cyber crimes are difficult to fight is because of the anonymity and fraudsters location around the globe. Since everything happens on cyber space there is no physical existence or evidence of the fraud. This makes them difficult to track.

Thanks to technology, fraudsters find ways to cover the IP address from which they are operating. They use proxy servers, socks chains, Virtual Private Network’s and dedicated servers to cover their IP addresses.

Infact things are so worse that the fraudster doesn’t have to be tech savvy to do all this. There are many websites that provide this kind of service. For those fraudsters who want to play it really safe they turn to underground sources where other fraudsters provide the service – “how to cover your IP address”.

Threat to e-commerce Industry

Life is not the same since the inception of internet and e-commerce. With a single click of your mouse you could be traveling thousands of cyber miles within fraction of a second. Transactions worth billions happen at a click of Mouse. People see their banks in their computers and have started doing their banking and credit card transactions via Web. People started to shop in the virtual world. Many super virtual stores carved their niche in this world.

Phishers have taken this as their sole point of existence - started infecting online users with scam emails, with key loggers and started monitoring their online information. This is nothing but Identity Theft. They also started creating scam pages that would look like a copybook of the authentic websites. Innocent and unsuspecting users visit these pages and provide sensitive/personal information like credit card information (CVV code/billing details), debit card information including PIN (Personal Identification Number), Banking Details like Logins, Account/Routing number, SSN (Social Security Number) and other sensitive information including passwords.

Amount worth billions of dollars is lost and no one is able trace them. In 2006 the amount of money lost in identity fraud is estimated to be $55.7 billion. Apart from the money that is lost in these transactions, the very reputation of the genuine organizations is at stake. It becomes so bad that unless you are cautious you never know who's watching your computer and where you're landing when you open up a web page.

Apart from innocent people, all credit card companies, banks and e-commerce companies are the victims of Phishers activities. All these frauds are a major threat to the e-commerce industry on the whole and unless this is stemmed from the root, the trust of users on making transaction over the internet will be lost.

---------- Post added at 11:44 ---------- Previous post was at 11:43 ----------

Fraudsters on the Internet don’t stop at installing key loggers and spy ware on your computer to ruin your day. They go a step further—they pry on your bank accounts, gather account information, and then use it like it’s their own. And how do they do it?

By Phishing (pronounced as “fishing”)
So what is phishing? You always admired how convenient it is for you to access your bank account online and transact. What if someone “else” could transact using that little piece of information in your head—your account password? Worse, what if you were to give it to a fraudster yourself without you knowing it? Before you dismiss that thought, let us tell you that they know of a way to make you do that.

How is it done?

Your bank’s website is where you’ll most always use your account details and password without worrying about it much. That’s secure alright, but if you were displayed a Web interface which so closely resembles that of your bank, you are subconsciously programmed to assume it to be your bank and provide your login details, which may include your account number, your credit card number, and a password. This is what the fraudster wants.

The fraudster uses a Web design and a URL which closely resembles that of your bank. The fraudster then sends emails at random, asking you to verify or update your account details along with a link embedded in the email. This is a URL to the fraudulent Web site made to look real with information and other details closely resembling the original. In the world of Internet fraud, this trick of sending emails to gather personal and banking information leading to identity theft is called phishing.

For example, a fraudster designs a website that very closely resembles that of your bank and hosts it at a URL, which is also similar to that of the bank (for example, www.your-ownbank.com instead of the original www.your-bank.com). The fraudster then sends emails (seem to be coming from legitimate sources) at random, asking you to verify or update your account details.

Here’s what the fraudster wishes will occur: you believe the “urgent” need to update your information and as mentioned in the email, you click on the link. The link takes you to the website the fraudster created (www.your-ownbank.com or www.fraudster-website.com/your-bank/login). You then enter your account details and password (sadly, it’s for the fraudster and not for your bank.). The fraudster would then see your account details and password in clear characters (encryption is his enemy, remember!). This is when your account becomes susceptible to use by the fraudster in any way as he pleases.

What is the impact?

Phishing has been around for a few years now and growing in strength. Once your account details are gathered, you are at the mercy of the fraudster as to how they would be used—withdrawals, transfers, checks, to name a few common usages.

What can you do to avoid it?

Here are some ways of Identity theft prevention and protection from internet fraud:
When you receive emails claiming to be sent by financial institution asking you to enter your account details, DO NOT do so! Your institution already has your details and clearly would not want them again.
Check if the email that you receive has your name spelt correctly. Fraudsters simply try to guess your name by your email address. DO NOT open emails that have your name spelt incorrectly.
Check the email to see if it is addressed to your name. Fraudsters never personalize emails, they will refer you as “Dear Customer” or “Dear Valued Customer” because they send emails randomly to a million email addresses and they even don’t know that you have an account with the bank. Your bank or e-commerce company on the other hand will refer you with your name.
DO NOT respond to emails that seem like they are sent from your bank. Some of the claims made in these emails may be the following:
The bank is trying to protect you from a fraud.
The bank needs some security and maintenance update on your account as asks for your account details.
You are to receive a refund.
You are to receive a prize
If you receive such email always check back with your back directly or speak to the customer service representative of the bank.
NEVER enter your credit card details and password in a website which you suspect is not genuine.
DO NOT share your account details, password, or credit card details with anyone who you do not know or trust.
DO NOT open unsolicited emails.
It is a good practice to type in the URL of your bank yourself, or bookmark it if the URL is difficult to remember. DO NOT follow links to a banking website from another website or email.
Verify a website’s URL carefully before you provide your login details on any web page. Fraudsters create fake websites that have URLs closely resembling the original.
Log in to your accounts regularly and look for account transactions that you do not recognize.
DO NOT send your account details and/or password over an email to anyone.
Check that the Internet connection you are using is secure. Look for the lock at the bottom or https (an‘s’ appended to ‘http’) in the address field of your browser. These indicate that the connection is a secure one.
Make sure that you have automatic updates / firewall turned on and regularly download the security patches if you are a windows user.

Sharing and Caring

The fight against phishing requires one crucial resource that is at your disposal—knowledge. You know what phishing is and what havoc it could cause to a novice Internet user. Therefore, please share information on this form of Internet fraud with your family and friends.

---------- Сообщение добавлено в 11:49 AM ---------- Предыдущее сообщение размещено в 11:48 AM ----------

Fraudsters on the Internet don’t stop at installing key loggers and spy ware on your computer to ruin your day. They go a step further—they pry on your bank accounts, gather account information, and then use it like it’s their own. And how do they do it?

By Phishing (pronounced as “fishing”)
So what is phishing? You always admired how convenient it is for you to access your bank account online and transact. What if someone “else” could transact using that little piece of information in your head—your account password? Worse, what if you were to give it to a fraudster yourself without you knowing it? Before you dismiss that thought, let us tell you that they know of a way to make you do that.

How is it done?

Your bank’s website is where you’ll most always use your account details and password without worrying about it much. That’s secure alright, but if you were displayed a Web interface which so closely resembles that of your bank, you are subconsciously programmed to assume it to be your bank and provide your login details, which may include your account number, your credit card number, and a password. This is what the fraudster wants.

The fraudster uses a Web design and a URL which closely resembles that of your bank. The fraudster then sends emails at random, asking you to verify or update your account details along with a link embedded in the email. This is a URL to the fraudulent Web site made to look real with information and other details closely resembling the original. In the world of Internet fraud, this trick of sending emails to gather personal and banking information leading to identity theft is called phishing.

For example, a fraudster designs a website that very closely resembles that of your bank and hosts it at a URL, which is also similar to that of the bank (for example, www.your-ownbank.com instead of the original www.your-bank.com). The fraudster then sends emails (seem to be coming from legitimate sources) at random, asking you to verify or update your account details.

Here’s what the fraudster wishes will occur: you believe the “urgent” need to update your information and as mentioned in the email, you click on the link. The link takes you to the website the fraudster created (www.your-ownbank.com or www.fraudster-website.com/your-bank/login). You then enter your account details and password (sadly, it’s for the fraudster and not for your bank.). The fraudster would then see your account details and password in clear characters (encryption is his enemy, remember!). This is when your account becomes susceptible to use by the fraudster in any way as he pleases.

What is the impact?

Phishing has been around for a few years now and growing in strength. Once your account details are gathered, you are at the mercy of the fraudster as to how they would be used—withdrawals, transfers, checks, to name a few common usages.

What can you do to avoid it?

Here are some ways of Identity theft prevention and protection from internet fraud:
When you receive emails claiming to be sent by financial institution asking you to enter your account details, DO NOT do so! Your institution already has your details and clearly would not want them again.
Check if the email that you receive has your name spelt correctly. Fraudsters simply try to guess your name by your email address. DO NOT open emails that have your name spelt incorrectly.
Check the email to see if it is addressed to your name. Fraudsters never personalize emails, they will refer you as “Dear Customer” or “Dear Valued Customer” because they send emails randomly to a million email addresses and they even don’t know that you have an account with the bank. Your bank or e-commerce company on the other hand will refer you with your name.
DO NOT respond to emails that seem like they are sent from your bank. Some of the claims made in these emails may be the following:
The bank is trying to protect you from a fraud.
The bank needs some security and maintenance update on your account as asks for your account details.
You are to receive a refund.
You are to receive a prize
If you receive such email always check back with your back directly or speak to the customer service representative of the bank.
NEVER enter your credit card details and password in a website which you suspect is not genuine.
DO NOT share your account details, password, or credit card details with anyone who you do not know or trust.
DO NOT open unsolicited emails.
It is a good practice to type in the URL of your bank yourself, or bookmark it if the URL is difficult to remember. DO NOT follow links to a banking website from another website or email.
Verify a website’s URL carefully before you provide your login details on any web page. Fraudsters create fake websites that have URLs closely resembling the original.
Log in to your accounts regularly and look for account transactions that you do not recognize.
DO NOT send your account details and/or password over an email to anyone.
Check that the Internet connection you are using is secure. Look for the lock at the bottom or https (an‘s’ appended to ‘http’) in the address field of your browser. These indicate that the connection is a secure one.
Make sure that you have automatic updates / firewall turned on and regularly download the security patches if you are a windows user.

Sharing and Caring

The fight against phishing requires one crucial resource that is at your disposal—knowledge. You know what phishing is and what havoc it could cause to a novice Internet user. Therefore, please share information on this form of Internet fraud with your family and friends.

 

[admin]

All about Phishing

Amongst all fraud related to the online banking identity theft remains, probably, the biggest headache of respective authorities and users themselves causing Americans $45.3 billion in losses within 2007, however as it was recently announced there's a slight but noticeable tendency shown in decreasing number of cases related to ID theft. Losses in online banking segment have dropped 11% in comparison to $51 billion reached in 2006. The average loss fell 6 percent from $5,920 to $5,574. Last year we have witnessed, probably, one of the largest thefts of data, estimated loss of 45.7 million credit and debit cards reported by discount retailer TJX Cos, famous owner of T.J. Maxx and Marshalls.

Meanwhile, with the strength of the online banking security the hackers are more and more focusing on the mobile banking as the most unsecured channel of banking. In accordance to Juvenil research about 48% of 25 top listed US financial institutions don't have any reliable multi-level authentication system. The new phone-based fraud methods are developing: let's say people are calling from "non-profit organizations" or naming themselves the representative of any presidential candidate asking to donate and in between divulge the financial sensitive information. The "vishing" schemes become extremely popular: in difference to phishing that redirects user to the fake bank web site, vishing directs callers to rogue interactive voice response systems that fakes the real bank mobile system and allows to catch the account information. Together with mail-fraud, the mobile fraud shows tremendous increase from 3% in 2006 to 40% in 2007. wireless accounts have reached 32% of fraudulent new account openings in 2007 in difference from 19% in 2006.

Let us remind you that year of 2008 was announced by anti-fraud experts the year of the iPhone fraud that would flood merging markets with a tremendous wave of losses an number of cases related to the ID theft resulted by mobile banking.

Phishing: development progress or scourge of virtual economy?

In all times there were people greedy for easy money. And neither political situation nor prosperity of the country influenced on this fact. Thieves always existed and will exist - such is a nature of human being. But the form will change it is for sure. For example, 50 years not a single man knew about phishing ago as it is a new term. But today thousands of people suffer from the art of these swindlers living in endless space of Internet.

Let's read together an article found on http://www.csoonline.com.au/ about this scourge of virtual economy.

The Great Train Robbery of 1963 netted $69 million in today's dollars. The largest bank heists have scored more than $80 million. But "PayPal-'em-up" bank robberies offer high risks and low rewards: according to the FBI, the average US bank heist yields just $4200 -- and between 50 and 75 percent of perpetrators get caught

Robbing a brick-and-mortar bank seems like petty theft compared with a new breed of cybercrime that, according to a growing number of security experts, is siphoning untold millions of dollars from banks and their customers using SSL-evading Trojans and ever more refined phishing techniques. Every antivirus and antimalware vendor can report thousands of bank and e-commerce-specific Trojans designed to steal money and identities, often collectively referred to as Bancos/Banker variants. Yet given the vast investment in quelling consumers' fears about conducting business online, it's no surprise that few sources are anxious to provide information that highlights the severity of the problem.

Although the banking officials and security officers contacted for this article refused to be quoted on the record, all of them agreed that online bank fraud is an increasing problem. One banking regulatory security auditor said that in some instances, online bank fraud drains as much as 2 to 5 percent from a bank's overall revenue.

Mark Sunner, CTO of e-mail security provider MessageLabs, thinks it will take "a single, high-value tipping-point event" to wake up the general public, which would then pressure public officials. "I think the world's largest bank heist will soon be committed using malware," he says.

Phishing with a hook

Phishing remains the weapon of choice for online bank theft -- and the sleight of hand that tricks users into visiting a phishing Web site continues to get more sophisticated. Phishing e-mails now show up with the user's address, postcode, or account information already filled in, indicating that professional criminals are using other, previously compromised resources to gain the trust of consumers.

Yet as phishing gets slicker, users are getting smarter. As the average Joe becomes less likely to type in authentication information in response to an e-mail, more and more cybercriminals are turning to SSL-evading Trojans.

These Trojans install themselves on unsuspecting users' PCs and either capture user log-on credentials or manipulate transactions after a successful log-on. In both cases, the SSL connection between PC and bank remains intact. The user may think the confidential online transaction is protected against mischief -- but it is not.

That shift has enormous implications. Ever since Netscape released SSL in 1996, consumers have been told that a confirmed SSL-connection icon indicates that it's safe to conduct online business.

"The problem is," according to one bank regulatory security auditor, "SSL isn't broken. SSL states that the connection between your PC's network card and the bank's network card isn't compromised. This is still true. Nobody is sniffing the transaction off the wire. Instead, this is a 'man-in-the-end-point' attack". In other words, the Trojan is sniffing or manipulating the transaction before it is ever sent across the Internet to the bank.

According to Mitchell Ashley, CTO of network security provider StillSecure, "Traditional phishing attacks have duped end users into clicking on a link, but in the newest evolution, even the most security-savvy can fall victim to attack. Once you're infected, the game is up."

Although the theft of credentials remains the biggest threat to online e-commerce, SSL-evading Trojans are quickly becoming the criminal hacker's favourite tool, mainly because SSL-evading Trojans can bypass any authentication scheme.

Fighting the last war

Most banks and e-commerce sites fall one step behind, responding to Trojans that steal log-on credentials by creating more complex authentication schemes and implementing two-factor authentication solutions. Today, banks frequently require that users click on-screen, randomized keyboards; type in the random letters of a "magic word"; or enter information from a hardware-based cryptographic key fob. None of these solutions works against the new breed of SSL-evading Trojans.

"It's not a problem of authentication but one of transactional authorization," says Bruce Schneier, leading security expert and CTO of Counterpane Internet Security. "No matter how hard you make the initial authentication for the end user or hacker, the malware can just wait until the authentication is done and then manipulate the transaction."

For example, you think you're checking your bank balance or writing an online cheque to pay a bill, but the Trojan is transferring your bank balance to a bank account in the Cayman Islands.

"The real problem is that we are allowing computers to make transactional decisions for us on our behalf, and the computer really doesn't know what is right or wrong," Schneier explains. "The consumer may not be able to see the real transaction to put a stop to the automated authorization approval, and the bank really has no way of knowing that a Trojan is making the decision, and not the customer."

Even more disturbing is that most banks and regulatory officials don't understand the new threat, and when presented with it, hesitate to offer anything but the same old advice.

Every bank and regulatory official contacted for this article said they have already recommended banks implement a two-factor or multifactor log-on authentication screen. In general, they expressed frustration at the amount of effort it has taken to get banks to follow that advice. And all complained about the trouble these schemes are causing legitimate customers.

When told how SSL-evading Trojans can bypass any authentication mechanism, most offered up additional ineffective authentication as a solution. When convinced by additional discussion that the problem could be solved only by fixing transactional authorization, most shrugged their shoulders and said they would remain under pressure to continue implementing authentication-only solutions.

They were also hesitant to broach the subject with senior management. It had taken so long to get banks to agree to two-factor authentication, they said, it would be almost impossible to change recommendations midstream. That puts the banking industry on a collision course with escalating attacks.

Verifying real transactions

Workable answers to the SSL-evading Trojan problem aren't necessarily more inconvenient than two-factor authentication solutions. They just have a different focus: transactional authorization. Solution providers need to realize that any authentication mechanism can be bypassed, and instead focus more on the right long-term answer.

Some banks now send consumers an "out-of-band" authorization code -- that is, not through the PC, but via voice message or text message through another device -- to type in and confirm a particular transaction. Unfortunately, the bank is confirming the transaction as the bank sees it, whereas an SSL-evading Trojan could be manipulating what the customer thinks the bank is getting ready to do. The customer may think he or she is making a small transaction, whereas the bank, because of the Trojan, is closing an account and making a transfer of funds to another bank.

In this case, sending an authorization code to the customer by itself doesn't work because the consumer is confirming a transaction he or she can't really see.

A better solution would be to send the consumer the relevant details -- such as the date, from, to, amount, and so on -- along with the authorization code, thus allowing the consumer to confirm the transaction. Some banks and e-commerce sites do this already using in-band e-mail confirmations. Schneier has his doubts about the out-of-band approach. "These types of authorization schemes would work, but it sounds a little extreme as a solution. Unfortunately, we live in an economic reality where users will not accept extremes. They want convenience."

Bank officials concur. One regulator said, "Most banks, because of their customers, would probably not accept such an extreme form of authentication. How often would the out-of-band device fail or not be available? Requiring users to confirm every banking transaction out-of-band would not be accepted by today's consumers."

The regulator speculated that a better solution might be for the bank to offer out-of-band confirmations as an option and allow the consumer to pick the dollar amount at which the transaction would require additional confirmation measures.

Other bank security officers thought implementing added intelligence on the back end would provide more value. "How about not allowing online transfers to banks and countries with strong ties to crime?" offered one officer. "We could deny any transaction that the bank deemed highly suspicious, like your credit card company does now, and require a second confirmation."

Close observation of consumer behaviour can also help. In one case, nearly 100 customers of one large bank were infected with an SSL-evading Trojan. As usual, the phishing e-mail used mostly legitimate links to the real bank's Web site. After noticing outside requests to links, most of which were normally referenced from other internal links, the bank's IT staff realized a Trojan was to blame.

The solution was to rename one of the requested links. If any user went to the real bank's Web site, the renamed link was now referenced by the legitimate Web site. Only the phishing customers would request the link's old name, enabling the bank to tell how many of its customers were compromised.

Yunus Emre Alpozen, a consultant for one of the world's largest banks, says, "Every customer requesting the old Web page link was redirected to a new page that notified them that they were the victims of a phish attack, and how to proceed. We used the phisher's e-mail against them."

Self-defence for consumers

Sadly, infection can't be stopped merely by convincing users not to execute untrusted software. No consumer knowingly installs malicious software, and SSL-evading Trojans can easily go unnoticed by the most careful user.

One of the best defences is simply to convince consumers to check their online balances frequently. Beyond this, consumers need to lobby financial institutions and move their accounts from institutions that keep their head in the sand.

Banks that require stronger authentication and transactional authorization should be rewarded. Those institutions should also encourage customers to report phishing attacks to the site's security reporting e-mail address so they can take down fake Web sites or otherwise minimize risk.

Currently, log-on-stealing Trojans are still the No. 1 threat to the banking industry, but SSL-evading Trojans that can bypass any authentication scheme are emerging as a particularly frightening challenge. They need to be dealt with now before consumer confidence in e-commerce goes into serious decline.

The one who knows much sleeps badly. Exactly such words we can hear when we want to know about something. And may be it is true in some extend. But this article proves that the more we learn about modern technologies and use them the less we take chances to be robbed.

Spammers at the service of phishers

According to the reports of British security systems they have discovered a new group of hackers who do their business by the hands of a new category of victims - by would-be spammers. Recently, on one of the sites hosted in France a Moroccan group called "Mr-Brain" offered a free phishing kit to attack the innocent civilians. "Benefactor" offers software packages to setup a fraudulent website mimicking of such known brands as Bank of America, eBay, PayPal, HSBC and others to mislead people and to get their credit card details or bank account numbers. In addition, this site provides not only with the information on what kind of data can be collected from each entity, such as usernames, passwords or Social Security numbers, but also includes the templates for spam email.

As it's clear the said group is not a charitable organization that aims to make some people richer. These phishing kits are designed to return any collected sensitive information back to the email accounts controlled by Mr-Brain. So it is an easy way to do all the hard work by the hands of novice phishers who, unfortunately, can hardly boast with successful end of their attack.

And that is just one phishing kit placed in Internet and nobody knows their exact number. And it's mean that we should be careful and think hard before sending any information to anybody.

Phishing in severe figures

The specialists of online brand monitoring NetNames was published its Quarterly Fraud Report and data are not encouraging. So, according to this report the number of phishing attacks has greatly increased this year. This can be judged by the sole fact that only in February 2008 customers of financial services customers were exposed to 60,000 phishing e-mails.

The statistics show that in the period between December 2007 and February 2008 the number of phishing attacks has risen for 70%. The report says that fraudsters focused on three banks whose customers are much more vulnerable than the other ones. However, not a single name was mentioned.

Returning to phishing e-mails mentioned above it should be said that exactly the customers of those three banks were targeted. The total number of e-mails in December was 77%, in January 79% and in February has already been 88%. There is direct evidence of phishing progress.

"Just as phishing seemed to have slipped off the consumer radar, online fraudsters have leapt on the chance to capitalise on this false sense of security and have increased their phishing activity drastically in the past few months. Consumers must be aware of this renewed and increasing threat and make sure they never give out personal details over e-mail," said Jonathan Robinson, chief operating officer of NetNames.

He also added that it was also crucial for the reputation of financial services organisations that they made their customers aware of these threats and helped protect them.

PayPal is on the war-path… against phishing

PayPal, famous for its security is going to solve phishing problem last and all the time. About this has declared company's chief information security officer Michael Barrett at the RSA security conference held last week in San Francisco.

PayPal is going to solve this problem by complex and three-way approach: education-technology-partnerships. Exactly this method is the most effective thinks Michael Barrett and PayPal as whole.

Speaking about education Barrett compared the Internet with early years of the car industry when people also didn't pay enough attention to rules of road and safety.

As for technology, PayPal has implemented a number of up-to-date technical solutions, such as digital email signatures. The next step, according to Michael Barrett is email certification. Barrett also added that some browsers have warning systems such as Microsoft's Internet Explorer 7 that help people to avoid phishing.

The third direction-partnership is not less important than the previous two ones. At the moment company works with AOL, Google, Verisign, Yahoo! and various government agencies.

Phishers set to Visa

Following last week phishing attacks on Mastercard owners the world faced a new wave of scams targeted Visa credit card owners. The aim of phishers is to get as much information on credit card details as it possible. They send messages offering imitated 'Verified by Visa' service that in reality is aimed to make online transactions safe and secure.

This attack wasn't a surprise as for the company as they were expecting it. "We expected to see similar attempts targeting Visa's counterpart service, Verified by Visa. Today, we received one of the first samples," Savio Lau said.

But unlike Mastercard attacks phishing attacks on Visa are not very good. It is plain and simple. The pattern is as follows: potential victim receives an e-mail with suggestion to join Verified by Visa service. Message also contains a link to some rogue website on which the victim is asked to provide some personal and card details.

Having entered the site user can see a field requiring entering security key. In case if the user is not sure in his security key he may click on a link provided there. The link will take one to Yahoo security key web page that reads: "Your security key... must not match your Yahoo ID".

Even if the user is not suspicious he may ask about the relation of yahoo IDs and Verified by Visa service.

How to avoid e-commerce scams - Phishing emails

Recently there has been a lot of news regarding the phenomena known as "phishing emails."

Anyone who does business on the Internet today has undoubtedly, at one time or another, received an official looking email, which appears to come from a legitimate online community asking the reader to supply sensitive information. The source of such emails are usually scammers, who are attempting to lure an unsuspecting reader into providing some type of sensitive information, so that the scammer can then use this information for criminal activity.


Below are a few useful guidelines to help tell the difference between a phishing email, and a legitimate email from an online community.
Phishing emails almost always contain a generic greeting, and are not addressed directly to the receiver of the email. Most phishing emails begin with a greeting such as, "Dear Alibaba User," and do not contain unique greetings such as, "Dear Mr. Watkinson." In most cases, the scammer does not know who the phishing email is being sent to, so a generic greeting is used in the hopes that he reader will not notice the message is not addressed to them personally.


Most phishing emails contain horrendous grammar and punctuation errors. Even a very casual reader should be able to identify the numerous typos found with a typical phishing email. On occasion, phishing emails are often written in all capital letters, with only periods used as punctuation.


The general tone of most phishing emails is usually very demanding, and very harsh. Phishing emails usually threaten all sorts of dire consequences, which will happen immediately, if the reader does comply and submit the requested information instantly.


Phishing emails often demand that the reader supply sensitive information such as login information, personal identification information, and or bank card information. This is exactly the type of information that most online communities will never ask you to verify via email, if at all.


If you suspect that you have received a phishing email, the best thing to do is avoid clicking any links found within the email, and most certainly do not reply to the email, even with fake information. It may be tempting to give the scammers a dose of their own medicine, by replying to their phishing email with useless junk information. However, replying to the phishing email will let the scammers know that your email address is valid, and that email is being opened at your inbox, and thus trigger other problems down the road.

User of Google AdWords? Beware of phishing!

Bigmouthmedia, the digital marketing agency, has revealed that the users of Google AdWords are the potent ional victims of online fraudsters whose aim is to steal internet traffic and get access to the banking details of businesses and individuals.

During the last 6 months the number of "phishing" e-mails targeted to attract the customers and to make them reveal their AdWords account login details has increased greatly. Statistics has described tht unpleasant situation in figures and has revealed a shocking picture of the present. So, according to the revealed data the traffic has increased by 240 percent on the monthly average for 2007.

Most of people know about phishers and their activity, and know the ways to avoid their malicious action. However, they still fall for the bait of the fraudsters. Today a new direction of phishing, known as Google Phishing, grows greatly. Being targeted at personal and financial details of the victims to redirect their AdWords traffic to the site of perpetrators, Google Phishing uses search engines to drive traffic to illegitimate sites.

Giants alliance against phishing

The worldwide internet auction giant eBay and the biggest online payment processor PayPal are starting "a collaborative effort with Google’s webmail service Gmail to better protect consumers against fraudulent e-mails and phishing attacks. Starting today, eBay and PayPal customers with Gmail accounts will have a safer e-mail experience because they will receive fewer fake e-mails claiming to be sent by eBay and PayPal."

Google is stated to be able to prevent the delivery of fraudulent eBay and PayPal messages into Gmail users’ inboxes by means of DomainKeys and DomainKeys Identified Mail (DKIM) e-mail authentication technology. Thus users of Gmail, eBay and PayPal across the globe will be secured.

With DomainKeys technology spam and phishing protections are supplemented with an additional security layer as it enables Internet service providers to ascertain if messages are true and decide if they should be delivered to a customer’s inbox. Hence this cooperation is directed to decrease consumers’ risk of being victimized by phishing attacks through the reduction of fraudulent e-mail consumers receive.

“Industry cooperation represents a pivotal part of stamping out phishing and other e-mail scams,” said Dave Cullinane, chief information security officer at eBay. “Google’s commitment to this battle will undoubtedly encourage others to join in the fight to keep consumers safe online.”

Amalgamated forces to struggle against phishing in China

In Beijing a number of Chinese banks and securities organizations, e-commerce sites, domain name registrars and service providers made a decision to consolidate their forces in an effort to fight against phishing websites and protect Internet users from phishing. This consolidation will be represented by the newly formed "China Anti-Phishing Alliance".

The alliance is to include the Industrial and Commercial Bank of China, Agricultural Bank of China, Bank of China, Construction Bank of China, Huaxia Bank, China Everbright Bank, Minsheng Banking Corporation, Galaxy Securities, Tencent, Taobao, Alipay, Alibaba, HiChina, eName and others.

The main task of the alliance is stop DNS service of phishing websites in time to put an end to their operation. The China Internet Network Information Center (CNNIC) is to play a role of the secretariat of the alliance and to seek confirmation of fraudulent activity from third-party technology providers such as the National Computer Virus Emergency Response Center and the National Computer Network Emergency Response Technical Team and Coordination Center of China.

The primary targets to be checked and secured by the alliance are IT system of securities, financial institutions, e-commerce companies, and online payment companies, which have been much more vulnerable to phishing.

APACS warns against phishing mail

The figures reported by the UK payments association APACS show that online banking popularity underwent a significant growth among adult customers in the country increasing 505% from less than 3.5 million in 2000 to just over 21 million last year; while frauds related to online banking transactions decreased 33% in 2007 on a year-over-year basis. Yet in the association’s opinion there is still a substantial danger of various kinds of phishing and spyware scams aimed at customers’ computers as the banks’ system proved more resistant to fraud attacks.

In light of these considerations APACS released a Banking Safely Online advice guide intended to help customers stay on the alert against online fraud when banking in the Internet.

The guide published by the association contains the general information about most frequently met online scam and the ways to avoid it.

Most common feature of all scam messages is that the scammers address to a customer in a general way instead of doing it personally which reveals that the person behind the letter does not know the customer’s real name and personal information. Such messages are usually addressed to ‘Dear valued customer’.

The association warns against replying to the messages as this may lead to putting a PC at risk of attack from malicious computer viruses.

Besides, banks never sent letters to their customers enquiring about PINs, login details or complete passwords – this personal data request in most cases is a crafty trickery.

And one more kind of online fraud is targeted to human cupidity when e-mail messages contain seductive offerings to make easy money simply by transferring funds in and out of customers’ online account. This may be related to money laundering which is illegal.

 

[admin]

Stealing from phishers

I was amazed, it is so easy.

Here is how you do it:

Contents:

Step 1 (Finding hosts)
Step 2 (Getting logs)
Step 3 (Other way to get logs)
Step 4 Check the quality
Step 5 Enjoy

Step 1

You need a list of hosters phishers use. Search for free hosts which allow php. In this tutorial I will be using ripway.com( site down) , which is used a lot by phishers.

Step 2

Getting logs.

Choose a site from the list made in step one. Go to google and search for:
Code:
site:ripway.com filetype:txt

Now the results will show .txt files on that hoster. Go through the results and you will find phishers soon. Open them and save them. Congratulations, you stole from a phisher!

Step 3

However most of the time the hoster will have shut down the phisher. There is a nice trick for this. Just use googles cache. I love the cache <3! Then save, and you stole from the phisher!

Step 4

You need to check the quality. For this you can randomly choose accounts and try them. But a better method are account checkers. You insert your list there and that program checks all of them for you. They are great. Just search for them, Let them check, and save the accounts that work.

Step 5

Now have fun.



Also if you find a phisher you should try:

www.site.com/log.txt
www.site.com/log_.txt
www.site.com/_log.txt
www.site.com/defaultlog.txt
www.site.com/lol.txt
www.site.com/lolz.txt

etc You might get lucky!