Forum for Science, Industry and Business

Sponsored by:     3M 
Search our Site:

 

Identity thieves’ "phishing" attacks could soon get a lot nastier

18.10.2004



"Phishing" e-mails appear to be sent by legitimate businesses, but are actually created and distributed by thieves who are trying to steal personal information. Photo by: David Bricker


The number of people who succumb to identity thieves’ "phishing" e-mails could go way up if immediate action isn’t taken to preempt the next generation of attacks, according to Markus Jakobsson, an Indiana University School of Informatics researcher.

A report by cybersecurity expert Jakobsson describing worst-case phishing scenarios was recently cited by Howard Schmidt, chief information security officer for eBay Inc., during his testimony before a U.S. Congressional subcommittee on government reform. The report has also been presented to members of the U.S. Government Accountability Office and the Cyber Security Industry Alliance, based in Washington, D.C.

"I came up with the worst kind of attacks I could think of and then worked on how to defend against them," said Jakobsson, who is associate director of IU’s Center for Applied Cybersecurity Research. "Phishers haven’t invented these attacks yet, but the phishing attacks that are happening now are getting more and more sophisticated."



Today’s phishing e-mails are already pretty tricky. Many spoof legitimate companies’ domain names by linking not to legitimate domain names, such as "ebay.com," but to misleading domain names, like "secure-ebay.com," which are owned by phishers. Some users, encountering fake Web sites that look real, unwittingly give away vital personal information such as social security numbers, bank account numbers, access codes, usernames and passwords. Another version of phishing takes advantage of the fact that many users configure their e-mail clients to display pictures and text formatting within the messages. This makes it possible for phishers to show users the name of a legitimate domain name within the body of their e-mails -- while linking to a differently named Web site.

Phishing messages that appear to be sent by such trusted companies as eBay, Citibank and others are currently duping 3 percent of the people who receive them, according to a recent survey by Gartner Inc. Aware of the threat, members of Congress are currently debating passage of the Internet Spyware Prevention Act, which would provide the Justice Department with $10 million to apprehend phishers and other online scam artists.

Jakobsson said preliminary data suggest that savvier, "context-aware" phishing attacks could have success rates as high as 50 percent. Context-aware attacks, as Jakobsson envisions them, would take advantage of users’ unique circumstances or personal relationships.

One kind of context-aware attack Jakobsson describes tricks eBay bidders into giving out identifying information by leading bidders to believe they’ve won an auction. He also explains how eBay sellers can be victimized by context-aware attacks in which false payments lure sellers to give out their passwords.

In another kind of context-aware attack, a potential victim might receive a message from a known person -- for example, a friend or loved one -- asking him or her to go to a Web site to update banking information. But how would a phisher know who was related to whom and how? "There are personal and business networking Web sites out there, such as orkut.com, where users’ relationships are easily seen," Jakobsson said. "A phisher can find out whether a person in your ’personal network’ list is a wife, a husband, a sister or a business associate, and take advantage of that."

In a third kind of context-aware attack, the phisher first creates a believable (but fictitious) problem with a user’s online account and then asks for a user’s personal information to fix it. By analogy, current e-mail attacks are like phone repair personnel showing up out of the blue, claiming a potential victim’s phone lines aren’t working, when the victim can easily tell they are. "But now imagine I, the attacker, actually cut your telephone lines," Jakobsson explained. "I wait for you to notice. Then I show up, claiming to be there to fix the problem. I appear legitimate and everything seems consistent, so you invite me onto your property. Whenever you get e-mails requesting personal information, no matter what the circumstances, be skeptical, even if what you’re seeing appears legitimate."

Jakobsson admitted the scenarios may instill some paranoia, but he is joined by eBay’s Schimidt and others in his assessment that such context-aware attacks are inevitable. To combat the problem, Jakobsson believes users, online businesses and government must get involved. "A number of us are recommending changes in the way eBay and others display online information," Jakobsson said. "Personal information should only be displayed publicly on Web sites if it is absolutely necessary, or if a user gives his or her specific assent, knowing the risks. Government can help by requesting or requiring these changes. And of course there must be a public awareness campaign."

The report, "Modeling and Preventing Phishing Attacks," is currently being considered for the International Financial Cryptography Association’s annual meeting in February 2005. Copies of the paper are available to journalists and scholars only upon request. The research was supported by RSA Laboratories in Bedford, Mass.

Jakobsson is part of a group at IU that develops technological counter-measures to phishing and other types of Internet fraud. Members of the group are currently working on authentication software that would protect users from unknowingly entering PINs, usernames and passwords at illegitimate Web sites.

David Bricker | EurekAlert!
Further information:
http://www.indiana.edu

More articles from Information Technology:

nachricht Quantum Technology for Advanced Imaging – QUILT
24.04.2018 | Fraunhofer-Institut für Lasertechnik ILT

nachricht Paint job transforms walls into sensors, interactive surfaces
24.04.2018 | Carnegie Mellon University

All articles from Information Technology >>>

The most recent press releases about innovation >>>

Die letzten 5 Focus-News des innovations-reports im Überblick:

Im Focus: BAM@Hannover Messe: innovative 3D printing method for space flight

At the Hannover Messe 2018, the Bundesanstalt für Materialforschung und-prüfung (BAM) will show how, in the future, astronauts could produce their own tools or spare parts in zero gravity using 3D printing. This will reduce, weight and transport costs for space missions. Visitors can experience the innovative additive manufacturing process live at the fair.

Powder-based additive manufacturing in zero gravity is the name of the project in which a component is produced by applying metallic powder layers and then...

Im Focus: Molecules Brilliantly Illuminated

Physicists at the Laboratory for Attosecond Physics, which is jointly run by Ludwig-Maximilians-Universität and the Max Planck Institute of Quantum Optics, have developed a high-power laser system that generates ultrashort pulses of light covering a large share of the mid-infrared spectrum. The researchers envisage a wide range of applications for the technology – in the early diagnosis of cancer, for instance.

Molecules are the building blocks of life. Like all other organisms, we are made of them. They control our biorhythm, and they can also reflect our state of...

Im Focus: Spider silk key to new bone-fixing composite

University of Connecticut researchers have created a biodegradable composite made of silk fibers that can be used to repair broken load-bearing bones without the complications sometimes presented by other materials.

Repairing major load-bearing bones such as those in the leg can be a long and uncomfortable process.

Im Focus: Writing and deleting magnets with lasers

Study published in the journal ACS Applied Materials & Interfaces is the outcome of an international effort that included teams from Dresden and Berlin in Germany, and the US.

Scientists at the Helmholtz-Zentrum Dresden-Rossendorf (HZDR) together with colleagues from the Helmholtz-Zentrum Berlin (HZB) and the University of Virginia...

Im Focus: Gamma-ray flashes from plasma filaments

Novel highly efficient and brilliant gamma-ray source: Based on model calculations, physicists of the Max PIanck Institute for Nuclear Physics in Heidelberg propose a novel method for an efficient high-brilliance gamma-ray source. A giant collimated gamma-ray pulse is generated from the interaction of a dense ultra-relativistic electron beam with a thin solid conductor. Energetic gamma-rays are copiously produced as the electron beam splits into filaments while propagating across the conductor. The resulting gamma-ray energy and flux enable novel experiments in nuclear and fundamental physics.

The typical wavelength of light interacting with an object of the microcosm scales with the size of this object. For atoms, this ranges from visible light to...

All Focus news of the innovation-report >>>

Anzeige

Anzeige

VideoLinks
Industry & Economy
Event News

Invitation to the upcoming "Current Topics in Bioinformatics: Big Data in Genomics and Medicine"

13.04.2018 | Event News

Unique scope of UV LED technologies and applications presented in Berlin: ICULTA-2018

12.04.2018 | Event News

IWOLIA: A conference bringing together German Industrie 4.0 and French Industrie du Futur

09.04.2018 | Event News

 
Latest News

Quantum Technology for Advanced Imaging – QUILT

24.04.2018 | Information Technology

AWI researchers measure a record concentration of microplastic in arctic sea ice

24.04.2018 | Earth Sciences

Complete skin regeneration system of fish unraveled

24.04.2018 | Life Sciences

VideoLinks
Science & Research
Overview of more VideoLinks >>>