Phishing

Study Guide

Why is phishing unethical?

Phishing in computing is the process of acquiring private and sensitive information by pretending to be a trustworthy or a legitimate website through the online communications. Phishing is an example of fraudulent use of social engineering techniques to deceive an online service user. In this article some of the known attacks will be discussed following with some solutions to guard against these attacks.

Phishing attacks

As the technology advances and anti malware applications become more efficient, phishing attacks adopt new forms to stay away from detection. First different forms of attack will be discussed and then some of the solutions that one may prevent these attacks with will be presented.

Keyloggers

These are spywares that can get installed either into a web browser or as a device driver. They record the user’s input to the computer by recording the keyboard keystrokes or mouse click. This information will be then sent to the spyware owner. These spywares can cause severe data leak.

Torpig-family Trojan

These Trojans are using advanced technologies that help them to spread very fast and hide very well. They are designed to hijack sessions. These Trojans are constantly monitoring major banks’ websites throughout the world. They display a fake page when a user tries to log in to these websites, and in this way continue to steal the private information of their victims.

Session hijackers

These attacks can take place either from the malware that is installed on the victim’s computer or remotely. The attacks are triggered when users is trying to log into they account (usually bank accounts) or when they initiate a transaction. The malware then hijack the session for malicious purposes.

Content-injection phishing

This phishing refers to the situations when malicious or fake content gets injected into some legitimate Web sites. This content then can deceive the users of the Web site by redirecting them to other Web sites, install malware on their computers, or redirect the input that users is inputting to that Web site to the phishing server.

“Universal” man-in-the-middle phishing kit

There is only little effort required for the attackers to use this method to attack their victims. The attackers use a kit which is called MITM that includes several PHP files that get installed on the phishing server. This server then acts as a medium between the user and the legitimate website that he/she wants to access. These victims receive emails that include a purported link to their known website. Once they click on the link, they’ll be redirected to the phishing server which then will communicate with the original Web site on behalf of the user.

Search engine phishing

In this type pf phishing, phishers establish a webpage, and then get it indexed by the search engines to make it searchable. These pages are usually designed to include items and services at very low price to attract visitors to sign up or to enter their confidential information. The phisher then get the hold of the private information of the visitors.

Spear phishing

In this approach the phisher targets a particular person or a specific department in a company. The phisher then contacts the person by email and pretends to be from a legitimate department and is a trustworthy staff. The attacker then asks for the username and password with some fake reasons. Once the attacker get those information the can by pass the firewalls and break into the secured network.

Phishing solutions

To fight against the phishers, in the first place, the online service users should be educated. Once users know what phishing is and what methods phishers use, less people will fall for their tricks and many of their method then become useless. However some countermeasures have been developed and some of them are explained below.

Phishing blacklist

A server that is containing a list of all of the malicious websites and phishing servers should be established and be accessible by the internet browsers. The list should be updated on daily basis due to the lifetime of the phishing servers. The malicious URLs should be reported immediately.

Bookmarks or history

Using bookmarks and history to detect the list of the websites that the user uses. Then if a new website is visited randomly by the user that he/she did not visit before, chances are that this website is has malicious purposes. The down side of this method is that the history feature holds a history of the limited and short time.

Two-way authentication

In this method once a user signs up for an online service they receive and image in a secure way. Thereafter whenever the user visits the website and enters his/her username the website displays the image to prove its legitimacy. The user then can continue to enter his/her password.

VeriSign identity protection (VIP)

VIP has been design to protect the digital identities of the people who use online services. VIP provides number of rules that organizations should comply with if they want use VIP services. The VIP suite then provides a secure way for users to log into their account and transactions to take place.

Early alarm

This solution requires sort of add-on tool to be installed on Web browsers. This tool contains several rules and ways to check the authentication of the Web sites. The tool will notify the user if the Web site is legitimate and trusted.

Bibliography

What is phishing?

Phishing Wikipedia

Phishing Scams identityprotection101.com

Phishing mongers and posers Hal Berghel, Digital Village

Privacy and ethical Issues

Privacy and e-commerce: a consumer-centric perspective Rhys Smith and Jianhua Shao, Electronic Commerce Research, Volume 7, Number 2 / June, 2007

Phishers “net” unsuspecting consumers fraud alert october/november 2004

Why phishing works Rachna Dhamija, J. D. Tygar, Marti Hearst

The battle against phishing: Dynamic security skins Rachna Dhamija, J. D. Tygar

A Revocation scheme preserving privacy Łukasz Krzywiecki, Przemysław Kubiak and Mirosław Kutyłowski

Security and privacy as market failuresL. Jean Camp,Economics of Identity Theft: Avoidance, Causes and Possible Cures

Protection or privacy? Data mining and personal data David J. Hand

Protection against phishing attacks

Method for evaluating the security risk of a website against phishing attacks Young-Gab Kim, Sanghyun Cho, Jun-Sub Lee, Min-Soo Lee, In Ho Kim and Sung Hoon Kim

An Intrusion detection system for detecting phishing attacks Hasika Pamunuwa, Duminda Wijesekera and Csilla Farkas

Protection mechanisms against phishing attacks Klaus Plössl, Hannes Federrath and Thomas Nowey

On the effectiveness of techniques to detect phishing sites Christian Ludl, Sean McAllister, Engin Kirda and Christopher Kruegel

Effective protection against phishing and web spoofing Rolf Oppliger and Sebastian Gajek

Usability evaluation of anti-phishing toolbars Linfeng Li and Marko Helenius

Others

Topic page

Old phishing page