Phishers change bait as IM use grows
Update: Phishers are ramping up their use of instant-messaging services instead of e-mail to trick people into revealing personal information, according to a new report.
Thursday, March 31, 2005 by SSOne | Discussion: WinCustomize Talk
Some Instant Messanger ppl might want to read this:
The Anti-Phishing Working Group found that, for the third month in a row, the number of attacks that do not use e-mail has steadily grown. The nonprofit organization, which monitors phishing trends, published the findings for February in its report last week.
"Phishers are using alternative methods to 'phish' for end-user information," the authors wrote. "Previous phishing attacks were based around luring a user to perform an action through social engineering, primarily through spoofed e-mail and Web sites. The use of IM to spoof companies and phish for information is becoming more frequent."
Phishers change bait as IM use grows
Last modified: March 30, 2005, 3:40 PM PST
By Munir Kotadia and Dan Ilett
Special to CNET News.com
update Phishers are ramping up their use of instant-messaging services instead of e-mail to trick people into revealing personal information, according to a new report.
The Anti-Phishing Working Group found that, for the third month in a row, the number of attacks that do not use e-mail has steadily grown. The nonprofit organization, which monitors phishing trends, published the findings for February in its report last week.
"Phishers are using alternative methods to 'phish' for end-user information," the authors wrote. "Previous phishing attacks were based around luring a user to perform an action through social engineering, primarily through spoofed e-mail and Web sites. The use of IM to spoof companies and phish for information is becoming more frequent."
Phishing scams attempt to lure victims into parting with confidential information. Scammers typically send an e-mail, purporting to be from a bank or e-commerce vendor, that links to Web sites that mimic those companies' sites, but are actually hosted by scammers.
Yahoo last week confirmed that users of its Messenger software were being targeted by this type of attack. According to the search giant, attackers are sending members a message containing a link to a fake Web site. The fake site, which looks like an official Yahoo site, asks the user to log in by entering their Yahoo ID and password. The scam was more realistic because the incoming message appeared to originate from someone on the victim's contact list.
In its report, the APWG also highlighted two other techniques that could allow an attacker to steal personal information without requiring the potential victim to respond to a phishing e-mail.
"Phishing without a lure is now becoming more prevalent among attack styles. The most common is malicious code which either modifies your host's file to point commonly accessed sites to the fraudulent site," the report said. "DNS cache poisoning is also an alternative means that can be used to resolve information to non-legitimate Web sites."
Some security companies have dubbed DNS cache poisoning "pharming" and have been warning customers against it.
The rate at which identity theft e-mails hit consumers is beginning to slow, the study also suggests. People reported 13,141 new phishing e-mails to the organization in February, an increase of just 2 percent, compared with January results. The number of phishing Web sites supporting these attacks only rose by 1.8 percent--from 2,578 to 2,625--over the same period, the APWG said.
The report found that the monthly growth rate of phishing attacks since July 2004 is 26 percent. However, since the group's results depend on the number of people that report phishing scams to its Web site, the increase in reported scams could simply be a result of growing awareness of the APWG and its actions. It's not clear why there was such a small rise in reported phishing scams between January and February 2005.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Thursday, March 31, 2005 7:07 PM