Forum for Science, Industry and Business

Sponsored by:     3M 
Search our Site:


Identity thieves’ "phishing" attacks could soon get a lot nastier


"Phishing" e-mails appear to be sent by legitimate businesses, but are actually created and distributed by thieves who are trying to steal personal information. Photo by: David Bricker

The number of people who succumb to identity thieves’ "phishing" e-mails could go way up if immediate action isn’t taken to preempt the next generation of attacks, according to Markus Jakobsson, an Indiana University School of Informatics researcher.

A report by cybersecurity expert Jakobsson describing worst-case phishing scenarios was recently cited by Howard Schmidt, chief information security officer for eBay Inc., during his testimony before a U.S. Congressional subcommittee on government reform. The report has also been presented to members of the U.S. Government Accountability Office and the Cyber Security Industry Alliance, based in Washington, D.C.

"I came up with the worst kind of attacks I could think of and then worked on how to defend against them," said Jakobsson, who is associate director of IU’s Center for Applied Cybersecurity Research. "Phishers haven’t invented these attacks yet, but the phishing attacks that are happening now are getting more and more sophisticated."

Today’s phishing e-mails are already pretty tricky. Many spoof legitimate companies’ domain names by linking not to legitimate domain names, such as "," but to misleading domain names, like "," which are owned by phishers. Some users, encountering fake Web sites that look real, unwittingly give away vital personal information such as social security numbers, bank account numbers, access codes, usernames and passwords. Another version of phishing takes advantage of the fact that many users configure their e-mail clients to display pictures and text formatting within the messages. This makes it possible for phishers to show users the name of a legitimate domain name within the body of their e-mails -- while linking to a differently named Web site.

Phishing messages that appear to be sent by such trusted companies as eBay, Citibank and others are currently duping 3 percent of the people who receive them, according to a recent survey by Gartner Inc. Aware of the threat, members of Congress are currently debating passage of the Internet Spyware Prevention Act, which would provide the Justice Department with $10 million to apprehend phishers and other online scam artists.

Jakobsson said preliminary data suggest that savvier, "context-aware" phishing attacks could have success rates as high as 50 percent. Context-aware attacks, as Jakobsson envisions them, would take advantage of users’ unique circumstances or personal relationships.

One kind of context-aware attack Jakobsson describes tricks eBay bidders into giving out identifying information by leading bidders to believe they’ve won an auction. He also explains how eBay sellers can be victimized by context-aware attacks in which false payments lure sellers to give out their passwords.

In another kind of context-aware attack, a potential victim might receive a message from a known person -- for example, a friend or loved one -- asking him or her to go to a Web site to update banking information. But how would a phisher know who was related to whom and how? "There are personal and business networking Web sites out there, such as, where users’ relationships are easily seen," Jakobsson said. "A phisher can find out whether a person in your ’personal network’ list is a wife, a husband, a sister or a business associate, and take advantage of that."

In a third kind of context-aware attack, the phisher first creates a believable (but fictitious) problem with a user’s online account and then asks for a user’s personal information to fix it. By analogy, current e-mail attacks are like phone repair personnel showing up out of the blue, claiming a potential victim’s phone lines aren’t working, when the victim can easily tell they are. "But now imagine I, the attacker, actually cut your telephone lines," Jakobsson explained. "I wait for you to notice. Then I show up, claiming to be there to fix the problem. I appear legitimate and everything seems consistent, so you invite me onto your property. Whenever you get e-mails requesting personal information, no matter what the circumstances, be skeptical, even if what you’re seeing appears legitimate."

Jakobsson admitted the scenarios may instill some paranoia, but he is joined by eBay’s Schimidt and others in his assessment that such context-aware attacks are inevitable. To combat the problem, Jakobsson believes users, online businesses and government must get involved. "A number of us are recommending changes in the way eBay and others display online information," Jakobsson said. "Personal information should only be displayed publicly on Web sites if it is absolutely necessary, or if a user gives his or her specific assent, knowing the risks. Government can help by requesting or requiring these changes. And of course there must be a public awareness campaign."

The report, "Modeling and Preventing Phishing Attacks," is currently being considered for the International Financial Cryptography Association’s annual meeting in February 2005. Copies of the paper are available to journalists and scholars only upon request. The research was supported by RSA Laboratories in Bedford, Mass.

Jakobsson is part of a group at IU that develops technological counter-measures to phishing and other types of Internet fraud. Members of the group are currently working on authentication software that would protect users from unknowingly entering PINs, usernames and passwords at illegitimate Web sites.

David Bricker | EurekAlert!
Further information:

All articles from Information Technology >>>

The most recent press releases about innovation >>>

Die letzten 5 Focus-News des innovations-reports im Überblick:

Im Focus: New 3-D wiring technique brings scalable quantum computers closer to reality

Researchers from the Institute for Quantum Computing (IQC) at the University of Waterloo led the development of a new extensible wiring technique capable of controlling superconducting quantum bits, representing a significant step towards to the realization of a scalable quantum computer.

"The quantum socket is a wiring method that uses three-dimensional wires based on spring-loaded pins to address individual qubits," said Jeremy Béjanin, a PhD...

Im Focus: Scientists develop a semiconductor nanocomposite material that moves in response to light

In a paper in Scientific Reports, a research team at Worcester Polytechnic Institute describes a novel light-activated phenomenon that could become the basis for applications as diverse as microscopic robotic grippers and more efficient solar cells.

A research team at Worcester Polytechnic Institute (WPI) has developed a revolutionary, light-activated semiconductor nanocomposite material that can be used...

Im Focus: Diamonds aren't forever: Sandia, Harvard team create first quantum computer bridge

By forcefully embedding two silicon atoms in a diamond matrix, Sandia researchers have demonstrated for the first time on a single chip all the components needed to create a quantum bridge to link quantum computers together.

"People have already built small quantum computers," says Sandia researcher Ryan Camacho. "Maybe the first useful one won't be a single giant quantum computer...

Im Focus: New Products - Highlights of COMPAMED 2016

COMPAMED has become the leading international marketplace for suppliers of medical manufacturing. The trade fair, which takes place every November and is co-located to MEDICA in Dusseldorf, has been steadily growing over the past years and shows that medical technology remains a rapidly growing market.

In 2016, the joint pavilion by the IVAM Microtechnology Network, the Product Market “High-tech for Medical Devices”, will be located in Hall 8a again and will...

Im Focus: Ultra-thin ferroelectric material for next-generation electronics

'Ferroelectric' materials can switch between different states of electrical polarization in response to an external electric field. This flexibility means they show promise for many applications, for example in electronic devices and computer memory. Current ferroelectric materials are highly valued for their thermal and chemical stability and rapid electro-mechanical responses, but creating a material that is scalable down to the tiny sizes needed for technologies like silicon-based semiconductors (Si-based CMOS) has proven challenging.

Now, Hiroshi Funakubo and co-workers at the Tokyo Institute of Technology, in collaboration with researchers across Japan, have conducted experiments to...

All Focus news of the innovation-report >>>



Event News

#IC2S2: When Social Science meets Computer Science - GESIS will host the IC2S2 conference 2017

14.10.2016 | Event News

Agricultural Trade Developments and Potentials in Central Asia and the South Caucasus

14.10.2016 | Event News

World Health Summit – Day Three: A Call to Action

12.10.2016 | Event News

Latest News

Resolving the mystery of preeclampsia

21.10.2016 | Health and Medicine

Stanford researchers create new special-purpose computer that may someday save us billions

21.10.2016 | Information Technology

From ancient fossils to future cars

21.10.2016 | Materials Sciences

More VideoLinks >>>