Forum for Science, Industry and Business

Sponsored by:     3M 
Search our Site:

 

Identity thieves’ "phishing" attacks could soon get a lot nastier

18.10.2004



"Phishing" e-mails appear to be sent by legitimate businesses, but are actually created and distributed by thieves who are trying to steal personal information. Photo by: David Bricker


The number of people who succumb to identity thieves’ "phishing" e-mails could go way up if immediate action isn’t taken to preempt the next generation of attacks, according to Markus Jakobsson, an Indiana University School of Informatics researcher.

A report by cybersecurity expert Jakobsson describing worst-case phishing scenarios was recently cited by Howard Schmidt, chief information security officer for eBay Inc., during his testimony before a U.S. Congressional subcommittee on government reform. The report has also been presented to members of the U.S. Government Accountability Office and the Cyber Security Industry Alliance, based in Washington, D.C.

"I came up with the worst kind of attacks I could think of and then worked on how to defend against them," said Jakobsson, who is associate director of IU’s Center for Applied Cybersecurity Research. "Phishers haven’t invented these attacks yet, but the phishing attacks that are happening now are getting more and more sophisticated."



Today’s phishing e-mails are already pretty tricky. Many spoof legitimate companies’ domain names by linking not to legitimate domain names, such as "ebay.com," but to misleading domain names, like "secure-ebay.com," which are owned by phishers. Some users, encountering fake Web sites that look real, unwittingly give away vital personal information such as social security numbers, bank account numbers, access codes, usernames and passwords. Another version of phishing takes advantage of the fact that many users configure their e-mail clients to display pictures and text formatting within the messages. This makes it possible for phishers to show users the name of a legitimate domain name within the body of their e-mails -- while linking to a differently named Web site.

Phishing messages that appear to be sent by such trusted companies as eBay, Citibank and others are currently duping 3 percent of the people who receive them, according to a recent survey by Gartner Inc. Aware of the threat, members of Congress are currently debating passage of the Internet Spyware Prevention Act, which would provide the Justice Department with $10 million to apprehend phishers and other online scam artists.

Jakobsson said preliminary data suggest that savvier, "context-aware" phishing attacks could have success rates as high as 50 percent. Context-aware attacks, as Jakobsson envisions them, would take advantage of users’ unique circumstances or personal relationships.

One kind of context-aware attack Jakobsson describes tricks eBay bidders into giving out identifying information by leading bidders to believe they’ve won an auction. He also explains how eBay sellers can be victimized by context-aware attacks in which false payments lure sellers to give out their passwords.

In another kind of context-aware attack, a potential victim might receive a message from a known person -- for example, a friend or loved one -- asking him or her to go to a Web site to update banking information. But how would a phisher know who was related to whom and how? "There are personal and business networking Web sites out there, such as orkut.com, where users’ relationships are easily seen," Jakobsson said. "A phisher can find out whether a person in your ’personal network’ list is a wife, a husband, a sister or a business associate, and take advantage of that."

In a third kind of context-aware attack, the phisher first creates a believable (but fictitious) problem with a user’s online account and then asks for a user’s personal information to fix it. By analogy, current e-mail attacks are like phone repair personnel showing up out of the blue, claiming a potential victim’s phone lines aren’t working, when the victim can easily tell they are. "But now imagine I, the attacker, actually cut your telephone lines," Jakobsson explained. "I wait for you to notice. Then I show up, claiming to be there to fix the problem. I appear legitimate and everything seems consistent, so you invite me onto your property. Whenever you get e-mails requesting personal information, no matter what the circumstances, be skeptical, even if what you’re seeing appears legitimate."

Jakobsson admitted the scenarios may instill some paranoia, but he is joined by eBay’s Schimidt and others in his assessment that such context-aware attacks are inevitable. To combat the problem, Jakobsson believes users, online businesses and government must get involved. "A number of us are recommending changes in the way eBay and others display online information," Jakobsson said. "Personal information should only be displayed publicly on Web sites if it is absolutely necessary, or if a user gives his or her specific assent, knowing the risks. Government can help by requesting or requiring these changes. And of course there must be a public awareness campaign."

The report, "Modeling and Preventing Phishing Attacks," is currently being considered for the International Financial Cryptography Association’s annual meeting in February 2005. Copies of the paper are available to journalists and scholars only upon request. The research was supported by RSA Laboratories in Bedford, Mass.

Jakobsson is part of a group at IU that develops technological counter-measures to phishing and other types of Internet fraud. Members of the group are currently working on authentication software that would protect users from unknowingly entering PINs, usernames and passwords at illegitimate Web sites.

David Bricker | EurekAlert!
Further information:
http://www.indiana.edu

More articles from Information Technology:

nachricht Quantum bugs, meet your new swatter
20.08.2018 | Rice University

nachricht Metamolds: Molding a mold
20.08.2018 | Institute of Science and Technology Austria

All articles from Information Technology >>>

The most recent press releases about innovation >>>

Die letzten 5 Focus-News des innovations-reports im Überblick:

Im Focus: It’s All in the Mix: Jülich Researchers are Developing Fast-Charging Solid-State Batteries

There are currently great hopes for solid-state batteries. They contain no liquid parts that could leak or catch fire. For this reason, they do not require cooling and are considered to be much safer, more reliable, and longer lasting than traditional lithium-ion batteries. Jülich scientists have now introduced a new concept that allows currents up to ten times greater during charging and discharging than previously described in the literature. The improvement was achieved by a “clever” choice of materials with a focus on consistently good compatibility. All components were made from phosphate compounds, which are well matched both chemically and mechanically.

The low current is considered one of the biggest hurdles in the development of solid-state batteries. It is the reason why the batteries take a relatively long...

Im Focus: Color effects from transparent 3D-printed nanostructures

New design tool automatically creates nanostructure 3D-print templates for user-given colors
Scientists present work at prestigious SIGGRAPH conference

Most of the objects we see are colored by pigments, but using pigments has disadvantages: such colors can fade, industrial pigments are often toxic, and...

Im Focus: Unraveling the nature of 'whistlers' from space in the lab

A new study sheds light on how ultralow frequency radio waves and plasmas interact

Scientists at the University of California, Los Angeles present new research on a curious cosmic phenomenon known as "whistlers" -- very low frequency packets...

Im Focus: New interactive machine learning tool makes car designs more aerodynamic

Scientists develop first tool to use machine learning methods to compute flow around interactively designable 3D objects. Tool will be presented at this year’s prestigious SIGGRAPH conference.

When engineers or designers want to test the aerodynamic properties of the newly designed shape of a car, airplane, or other object, they would normally model...

Im Focus: Robots as 'pump attendants': TU Graz develops robot-controlled rapid charging system for e-vehicles

Researchers from TU Graz and their industry partners have unveiled a world first: the prototype of a robot-controlled, high-speed combined charging system (CCS) for electric vehicles that enables series charging of cars in various parking positions.

Global demand for electric vehicles is forecast to rise sharply: by 2025, the number of new vehicle registrations is expected to reach 25 million per year....

All Focus news of the innovation-report >>>

Anzeige

Anzeige

VideoLinks
Industry & Economy
Event News

LaserForum 2018 deals with 3D production of components

17.08.2018 | Event News

Within reach of the Universe

08.08.2018 | Event News

A journey through the history of microscopy – new exhibition opens at the MDC

27.07.2018 | Event News

 
Latest News

Quantum bugs, meet your new swatter

20.08.2018 | Information Technology

A novel synthetic antibody enables conditional “protein knockdown” in vertebrates

20.08.2018 | Life Sciences

Metamolds: Molding a mold

20.08.2018 | Information Technology

VideoLinks
Science & Research
Overview of more VideoLinks >>>