Beware: Spear Phishing Beware: Spear Phishing
Links to recommended reading about Safety, Monitoring and Filtering
May be the next worst thing
It's been about two years now since I first began talking about the online crime known as Phishing. Now, the criminals have honed their phishing tools into spears and are targeting unwary computer users with a very pointed weapon.
Phishing was bad enough. Online criminals committing multiple crimes by spamming millions of users then posing as favorite ecommerce institutions to steal their customers' identities. Known as the "spoof" most phishers set up fake web sites that look exactly like the users trusted web site -- eBay, PayPal, SouthTrust, and others -- and then harvest IDs and passwords for breaching private accounts. The email is fake, the links fake, the web site fake, all intended to lure in unsuspecting users.
All along, the phishing has continued to develop better ways of prying sensitive info from users. Huge networks of compromised systems (botnets) now use increasingly sophisticated techniques to probe deeper and deeper. (Study: Phishers Get More Sophisticated) But evidently the spam shotgun blasts weren't taking in enough suckers.
Now the phishers are sharpening their spears, using fake e-mails, posing as powerful executives of the targeted organizations, demanding the employee render their IDs and passwords as well as other sensitive details that can be used in identity theft. It's referred to as Spear Phishing.
Employees, fearing losing their jobs, see the (forged) sender address and (forged) reply-to address and think it must be real -- handing over their identity on a silver email. According to one article (among dozens) from eWeek last week, MessageLabs reports that they now typically see two attacks a week. The criminals do their homework, learn the company executives names and addresses and fire off an attack to that specific company or government agency. Upon gaining the password, the criminal is free to gather sensitive data from the users' computer, steal email address lists for spamming, and even plant spyware, zombies or Trojans on the user's machine. UK's NHTCU, (National Hi-Tech Crime Unit) has observed compromised machines are reporting back to Internet addresses in the Far East -- another development of grave concern for national security.
The good news is, at least the NHTCU is on the case. They snagged two virulent phishers last June who now have been sentenced to a combined 10 years in prison. Douglas Havard (U.S. citizen) and Lee Elwood (United Kingdom) were both found guilty of conspiracy to defraud and conspiracy to launder money.
According to this Paul F. Roberts article, the criminals' UK-based syndicate had links to Eastern European identity-theft rackets that is believed to have raked in over 6.5 million pounds over two years. According to NHTCU these thugs were frequenters of online communities that traded stolen credit card data -- uncovered by U.S. Secret Service (Operation Firewall) which targeted sites like Shadowcrew.com, Carderplanet.com and key members of the online carding community.
Best advice? If you get a demanding email from the boss, don't open it -- call upstairs to the head-honcho's office and ask what's up. If they don't know, be sure to tell them.
Forward ALL email Phishing attempts to:
* spam@uce.gov
* reportphishing@antiphishing.org
* eBay Phishing: spoof@ebay.com
* PayPal Phishing: spoof@paypal.com
* Wachovia: (888) 647-3648
Protect Yourself at all times just don't open it!
* Take Charge: Fighting Back Against Identity Theft [FTC PDF]
* What To Do If Your Personal Information Has Been Compromised
References:
* The Internet Spyware (I-SPY) Prevention Act [PDF]
* H.R. 744 provides funding for anti-spam law enforcement
* Is Someone "Phishing" for Your Information?, or [PDF]
* How Not to Get Hooked by a 'Phishing' Scam, or [PDF]
* Spyware, or [PDF]
* See: FTC Internet Crime Alerts
Please add your comments or recommend good links.
Return to: the top of this page, or the INDEX for this department
Exit to: The User Group Network front page
Contact: The Editor, Webmaster or Membership Director