Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Privacy Communications Security

Online Scammers Go Spear-Phishing 144

Posted by Zonk from the fishing-with-a-'ph' dept.
Ant wrote to mention an examination at C|NET looking into the increasingly more effective techniques employed by phishers. From the article: "More recently, however, a hybrid form of phishing, dubbed "spear-phishing," has emerged and raised alarms among the digital world's watchdogs. Spear-phishing is a distilled and potentially more potent version of phishing. That's because those behind the schemes bait their hooks for specific victims instead of casting a broad, ill-defined net across cyberspace hoping to catch throngs of unknown victims."
This discussion has been archived. No new comments can be posted.

Online Scammers Go Spear-Phishing More

Online Scammers Go Spear-Phishing

Comments Filter:

  • This is weird. (Score:5, Insightful)

    by meringuoid ( 568297 ) on Monday December 05, 2005 @07:38AM (#14183793)
    According to records of the Israeli investigation, Wieseltier told authorities that she received a Trojan-infested e-mail message bearing the address of gur_r@zahav.net.il, which she believed came from a friend.

    But her friend's e-mail was actually gur-r@zahav.net.il. As Israeli investigators traced the origin of the bogus account they discovered that the person who had opened it lived in London and had charged the cost of the account to his American Express card.

    Are we to believe that these super-phishers don't know how to spoof a From: header?

    • the path! Re:This is weird. (Score:5, Interesting)

      by leuk_he ( 194174 ) on Monday December 05, 2005 @07:53AM (#14183832) Homepage Journal
      als form the article:

      Some computer security specialists suggest at least one basic approach that might allow e-mail recipients to learn right away that a communique appearing to come from a company like Amazon.com actually originated somewhere in the Ukraine, Romania, Bulgaria, Poland, Russia or any of the other places that law enforcement officials say are hot spots for phishing scams. "It strikes me that this is just a failure of most e-mail systems to reveal the history of an e-mail," said Whitfield Diffie, a pioneer in computer cryptography who is the chief security officer of Sun Microsystems. "You could post a warning flag indicating that the 'from' address doesn't seem consistent with the path history."

      I have yet too see an applcation that does (only) this. And "8 out of 10 collegues here (in the IT) don't have a clue what a "path" in a e-mail is.

      Anyway the gist of the article was in the start that some phisher used a fake-emial address where the from was NOT faked, but contained a small alteration that does not show at first. Since no anti-spam/anti-phissher can protect against that ou leave the people who run the most up to date anti-spam will beleive the mail is trusted. Even the journalist has problems to explain that a technical solution is not the final solution.

      by the way: you americans do not have to worry so much since you seem to care so much for privacy.

      • I am not sure what GMail is doing exactly, but it does give a warning at times that a particular e-mail may not be from the claimed sender. Is this a path check or merely spam-filtering based on content?

      • Re:the path! Re:This is weird. (Score:5, Insightful)

        by Technician ( 215283 ) on Monday December 05, 2005 @10:02AM (#14184370)
        I have yet too see an applcation that does (only) this. And "8 out of 10 collegues here (in the IT) don't have a clue what a "path" in a e-mail is.

        And if I was phishing, there are ways to get completely valid headers. For example, I live in the US. From here it is a simple task to send you a valid e-mail from the Cayman Islands. I have an account in the Cayman Islands. Using the Webmail interface, I can send an e-mail from there. If I scam someone in England for example and got the password for one of their e-mail accounts, I could scam someone in England by using the ISP Webmail interface and send a perfectly valid e-mail from the US that originated in England. By signing up for an account in England, using a bogus credit card, I could use VOIP and dial into the ISP in England from England (local number) and send a scam that way. Think outside the box. A local call doesn't have to be local anymore.

        Some Nigerian scammers are using Canadian, Australian, and UK VOIP phones so they don't look like Nigerian scammers until you are hooked and find out where to send the Western Union money. I'm in England and not a Nigerian scammer.
        • I just checked my e-mail and this is just in...

          Information Regarding Your account:

          Dear PayPal Member!

          Attention! Your PayPal account has been violated!

          Someone
        • Most webmail will give the actual originating IP, not just the server IP, so it can be localized. So your e-mail, although sent from a server in the Cayman Islands, should still show an originator in the US. Even taking into account that you may have used a proxy in the Cayman Islands, it's less likely that it would be for the same company that provides the webmail. This is the path of the e-mail that we're talking about, it can still be deemed suspicious by software, especially if there's some sort of hist
        • Some Nigerian scammers are using Canadian, Australian, and UK VOIP phones so they don't look like Nigerian scammers
          Hang on, isn't the entire point of the Nigerian scam that the various people using it are not in or from Nigeria?

  • ...which you should worry about. Viruses which create havoc and draw attention to themselves should be less of a concern.

    If software has been created for a specific attack, then standard virus scanners will never pick up its signature.

  • bullshit article (Score:5, Insightful)

    by eobanb ( 823187 ) on Monday December 05, 2005 @07:47AM (#14183811) Homepage
    I particularly love this part:

    Jackont took his computer to the Israeli police last fall and was told to reformat it. But his problems persisted. So the police examined his computer more closely and discovered that a malicious program known as a Trojan horse lay hidden deep inside and had hijacked the machine from a remote location.

    So he reformatted his drive but the virus was still there? What?

    I'm sorry, but does it really take much effort to get the facts right? EVERYONE seems to get it wrong: CNN, MSNBC, the NY Times, CNET. Somehow, the writers chosen to pump out articles like this either don't really understand technology or just pick subjects of which they don't really know anything.

    • Re:bullshit article (Score:3, Insightful)

      by Renraku ( 518261 )
      Its entirely possible to reformat and still have a virus. What about MBR viruses and memory-resident ones?

      • WTF? (Score:1, Informative)

        by Anonymous Coward
        When you install the OS, the MBR is overwritten.
        Memory resident ones? If he reformatted then he reinstalled the OS and if he reinstalled he rebooted and if he rebooted.... you figure it out.

        GP is correct, the story makes no sense.
      • True enough, though I suspect it is just as likely that the person did format it, then reloaded the OS from the original media and either did not patch or got infected whilst online and trying to patch...

        • Re:bullshit article (Score:3, Insightful)

          by KiloByte ( 825081 )
          Or, more likely, the person who did "reformat" it just reinstalled the OS without actually formatting anything. Most of people who work in tech support don't know the difference.

    • Re:bullshit article (Score:5, Informative)

      by Sir Runcible Spoon ( 143210 ) on Monday December 05, 2005 @08:05AM (#14183860)
      There is more than one way to format a disk. If you do it with FDISK and don't provide the /MBR option it does not recreate the master boot record. If your virus is hiding there it will survive.
      • Running lilo, as you do from within the installation chroot just before you boot into your new kernel, does overwrite the master boot record.

        GUI installers still do all this behind the scenes, they just hide it from you. I am guessing Windows must do something similar with its own bootstrap loader.

        • Re:bullshit article (Score:3, Insightful)

          by oolon ( 43347 )
          No i does NOT! It infact installs it where the "boot" line in your lilo.conf tells it too. Yes alot of distro default to this behavior but they don't HAVE to. For example from my lilo.conf

          boot=/dev/ide/host0/bus0/target0/lun0/part2

          Why don't I install it on my MBR? because when you install windows it wipes the MBR, creates a boot block on its partition and changes the active partion. So if I don't use the MBR all I have to do to get lilo back is to change my active partition back to partition 2, which is muc
      • As anyone dual booting Windows and Linux knows, everytime you reinstall windows of the non-ancient type, it rewrites the MBR (blowing away your bootloader that lets you dual boot.) Yeah, I guess you could call that a "anti-virus" feature and not a "anti-competitor" one.

    • Re:bullshit article (Score:5, Interesting)

      by Motherfucking Shit ( 636021 ) on Monday December 05, 2005 @08:16AM (#14183900) Journal
      EVERYONE seems to get it wrong: CNN, MSNBC, the NY Times, CNET. Somehow, the writers chosen to pump out articles like this either don't really understand technology or just pick subjects of which they don't really know anything.
      And unfortunately, it's not all that unusual. After reading the article, I'm not so sure that "phishing" played a part at all, and I'm disappointed that C|Net is playing the media-hype-buzzword game beyond what could reasonably be expected. I figure that [MS]NBC, CNN, and the other networks will get this sort of thing wrong, but C|Net is fairly reputable when it comes to tech reporting.

      FTA,
      Last spring, staff, faculty and students at the University of Kentucky opened e-mail messages purporting to be from the university's credit union and requesting confidential information to access their accounts (something no financial institution in the country ever seeks via e-mail).
      That isn't "spear phishing," and sure as hell doesn't warrant the coining of a new term. It might be considered normal "phishing," if only the author had a clue. Just because a "phish" is targeted at a particular group doesn't make it any more special than the everyday eBay "phish" spammed at random to ten million email addresses. This whole "spear phishing" thing is a contrived buzzword like "spim" (or "Cyber Monday [slashdot.org]"). Spam over IM is still spam, it doesn't need a new term. Phishing for particular targets is still phishing - I even hate that term, really - and doesn't need a new cyberbuzzword.

      Free clue-by-four: the term "phishing" gained popularity on AOL some 6 or 8 years ago, and described the practice of attempting to solicit passwords from unsuspecting users. No matter how simplistic or elaborate the scheme, and regardless of whether normal users or employees were targeted in a blanket or with a direct ploy, it was always "phishing" (or ><> 'ing). Back then, the media hadn't yet caught on to the idea. Now that they've caught up, they want to call anything and everything "phishing."

      From TFA,
      About two weeks ago, a more traditional phishing scam infected about 30,000 individual computers worldwide, according to CipherTrust, a computer security firm.
      Are you kidding me? How does a "phishing scam" "infect" computers? "Phishing" is asking for information; it's impossible for a "phish" to infect anything.

      I've really lost some respect for C|Net on this one.

      • Re:bullshit article (Score:5, Insightful)

        by Stiletto ( 12066 ) on Monday December 05, 2005 @09:23AM (#14184168)

        How about we just drop all the silly cyber-words and start calling it what it is: Fraud.
        • Ah, but what kind of fraud is it? Phishing describes a very specific type, even if the media outlets are starting to make the two equivalent.

        • Re:bullshit article (Score:5, Insightful)

          by Woldry ( 928749 ) on Monday December 05, 2005 @10:04AM (#14184386) Journal
          Nah, let's get even less specific and just call it "crime." Or wait! How about maybe just "bad"? While we're at it, let's stop all this silly talk of Fords and Saturns and SUVs and just call 'em all "cars". And we can definitely do without all of the ridiculous kitchen words like "fry" and "roast" and "microwave" and "steam" and "simmer" and just call it what it is: Cooking.

          "All the silly cyber-words" are useful means of distinguishing nuances of meaning -- identifying specific methods of fraud, for instance. "Phishing" refers to a specific method of fraud, and as such adds precision and power to the language. The coining of the new term -- "spear phishing" -- makes it clear that this is a special type of the more general method of phishing, and even provides a pretty clear image to identify the particular type. Identifying this particular subtype also is the first step toward arming people against it -- which may require slightly different methods of self-defense than arming people against more general phishing, or mail fraud, or flimflam scams at the bank, or car-in-distress fraud, or white collar crime, or "blind" panhandlers who can see perfectly well, or any of the other myriad varieties of fraud that exist out there. Lumping them all together with a single word is sometimes useful, but "just dropping" all the language that draws useful distinctions between them is what is "silly".
          • Nah, let's get even less specific and just call it "crime." Or wait! How about maybe just "bad"? While we're at it, let's stop all this silly talk of Fords and Saturns and SUVs and just call 'em all "cars". And we can definitely do without all of the ridiculous kitchen words like "fry" and "roast" and "microwave" and "steam" and "simmer" and just call it what it is: Cooking.
            I just call everything "Marklar," to avoid confusion.
        • How about we just drop all the silly cyber-words and start calling it what it is: Fraud.
          i prefer the term "Unsmurfy"
        • No ... phraud!
      • I realized a while back that every writer's wet dream is to coin a new term that becomes common use. Not merely to report a word in use by others, but the make a new one up and refer to it in the article in some offhand manner, as if it already exists and is common, but you ain't hep 'nuff to know that, and so we're gonna let you in on what the cool kids are saying now.

        Riiiight.

        Now when I read articles with new fake words I just laugh and make sure not to use it.

      • It's New York Times. CNET posted NYT's story on their Web site.
    • lso if his email was on a server so stored externally to his computer he might have redownloaded the virus. However (from reading the article) the X was envolved so could have just got access to the machine and put it back on again or even just posted another infected email to the victim.

      Personally i thought it was rather sophisicated and could see how many people could fall for it. Particularly the reposting with payload, people who only check there email one a day or less could very easily fall victim to
    • It's possible that the user had an infected secondary hard drive.
    • In the writer's defense, it only states that the Israeli police told him to reformat his drive and then problems persisted. It never explicitly stated that he actually did format his hard drive. As a tech support monkey, I've had many users simply listen to my advice/instructions and then ignore it.

      Of course, the writer was probably not technically knowledgable to pick up on this little omission or its significance.
    • So he reformatted his drive but the virus was still there? What?
      He was told to reformat it. That doesn't mean that he did it. In my experience most users won't format and reinstall their systems (or have it done) because of the inconvenience.
    • So he reformatted his drive but the virus was still there? What?

      1) He was told to; this does not mean he did it.
      2) He may not have done a proper full (MBR) reformat
      3) He may have backed up the infection vector with his "important" files, on other infected media.
      4) If the infection vector was via email, he might have redownloaded and reopened the message from a POP/IMAP server that retained a copy.

      It is also theoretically possible to make something that will survive anything short of degaussing or

  • Format the disk (Score:4, Insightful)

    by jurt1235 ( 834677 ) on Monday December 05, 2005 @07:48AM (#14183816) Homepage
    Jackont took his computer to the Israeli police last fall and was told to reformat it. But his problems persisted.

    So either he did not format it, or after formatting it, he did not properly protect it and got infected again.

    Poor (usually Microsoft Windows) users who also have to be administrators. The key problem is just that current OSes are not for people without CS knowledge to use. They need appliances which are protected, on which they can not install more software and which are protected by a mixed contract of anti-virus anti-spyware and system update vendors.
    As long as users have to administrate their system, whatever system, these kind of problems will continu to exist.
    • So either he did not format it, or after formatting it, he did not properly protect it and got infected again.

      Another possible scenario: After he had formatted the disk, he restored a backup which already contained the infection.
    • This applies to just more than simple users. If it was tricky enough, it could catch quite a few admins too.

      FTA: the Trojan horses that penetrated their computers came packaged inside a compact disc or an e-mail message that appeared to be from an institution or a person that the victims thought they knew very well.

      Let's say that you have a computer at your company that has a certain program on it, and a scammer knows that. With some research, and some effort, they could send you an "update" CD in the mai

  • Not news (Score:2, Interesting)

    by ajs318 ( 655362 )
    People run an operating system known to be vulnerable to Trojan Horse infections. They haven't had the source code independently audited and verified. They believe the headers in e-mail messages. And then they get infected by a Trojan horse.

    The only surprise is it's taken this long for it to get noticed.

    As long as people have had weaknesses, there have been other people out there seeking to exploit those weaknesses. That's just human nature; and if you fail to account for it, you might just as well
    • > Anyone who uses ^ when they mean ** is obviously a BASIC programmer.

      Or a TeX user.
      • In TeX, the up-arrow indicates a superscript {as in ax^2+bx+c}; I'll give you half a point on that one. However, in languages which support bitwise operations {some people do still use them}, 7 ^ 2 means 5 and not 49.

    • Re:Not news (Score:4, Insightful)

      by antifoidulus ( 807088 ) on Monday December 05, 2005 @08:34AM (#14183963) Homepage Journal
      Hate to burst your bubble here, but it's incredibly EASY to create a trojan horse in Linux. All you have to do is convince the user to run the program, and if they do that, no matter what the OS, the program the user runs has all the same privlidges as the user. Meaning if I want to covertly send all the user's files to an offsite location, I can because the user has read access to all those files. Sure I can't delete the whole hard drive, but seriously, what is the point in doing that? Even if you do delete the whole drive, outside of the home directories, who cares? Seriously, the kernel files are easily replaceable, the home directory files much less so....In conclusion, that was a pointless, completely wrong post by an open source fanboy, ie something that is incredibly common here...

      *Note:I did not say that open source OSs do not have any security advantages, they usually do. However, the parent decided to mention trojan horses which are the easiest of all malware to write and probably the hardest to protect against.

      • Re:Not news (Score:2, Insightful)

        by ajs318 ( 655362 )
        You're forgetting the rather obvious.

        If somebody is bothered enough to be running GNU/Linux or a BSD variant, they probably are already smarter than to go running unknown programs without at least checking what they do. Of course, there are plenty of Windows users who know that already. But they aren't the ones you hear about.

        Windows has made it possible for computer users to be ignorant and proud of it, and ignorant people have created all manner of problems for them and the rest of us. A computer i
        • that very generality of purpose is a double-edged sword which cuts both ways.

          As opposed to a double-edged sword that cuts only one way?

          :-)

      • Re:Not news (Score:5, Insightful)

        by Technician ( 215283 ) on Monday December 05, 2005 @10:12AM (#14184427)
        All you have to do is convince the user to run the program, and if they do that, no matter what the OS, the program the user runs has all the same privlidges as the user.

        This is a little harder to do. In windows all you have to do is convince the user to look at these pictures of my naked wife wife.gif.pif (the .pif does not show)

        In linux you have to convince the user to save the attachment, change it's attributes to include execute and explain why the file must be executed instead of viewed.

        Convincing the user is much harder in Linux. Microsoft has blurred the line between executing a program and viewing a file. Linux still makes it harder to trick a user into running a program.
      • Yeah, back in the late 80's, my university's mainframe would always go down around Christmas because none of the freshmen knew not to run that christmas card program that showed up in their email inboxes. The program would then merrily redistribute itself to everyone in their mailboxes, and most of those people would run it too. Fun stuff!

        You could probably mitigate the danger by running your browser and mail client chrooted or as another user. Or both. And possibly have them drop any unecessary regular-u

      • Re:Not news (Score:4, Insightful)

        by forkazoo ( 138186 ) <<wrosecrans> <at> <gmail.com>> on Monday December 05, 2005 @04:40PM (#14187848) Homepage
        Certainly, it is quite easy to nuke a home directory, but that doesn't mean there aren't any benefits. The first that occurs to me is that a normal user can't install a service that runs at boot automatically. They also don't have permission to do things like open certain ports.

        So, on Windows, as long as the average user is running your code, you can very easily have an FTP server running at boot which the user can't kill. It can run silently for a very long time, making available keylogs or whatever else.

        On Linux/BSD/OS-X, the danger is slightly reduced. Sure, you can monitor a single user's access, and you can open up a port > 1024. You can certainly nuke the home directory, which would be horribly bad news for a lot of users. But, it is always possible to log in as another user and kill whatever it is. When you are running as another user, you will be fairly confident that you can at least see any problems that might present themselves. With windows, any app can make itself invisible to normal means of inspection (See Sony rootkit!).

        There are some *nix fanboys who overstate the protections, certainly. But, "not much real extra security" is a hell of a lot better than "what in god's name were those chimp brained fucktards thinking?"

  • Is this really phishing? (Score:3, Insightful)

    by Zog The Undeniable ( 632031 ) on Monday December 05, 2005 @07:49AM (#14183820)
    Looks like good old-fashioned social engineering to me, probably kicking off with some even more old-fashioned dumpster-diving to get the names and addresses of the target's friends and acquaintances.
  • Spear-phishing, say security specialists, is much harder to detect than phishing. Bogus e-mail messages and Web sites not only look like near perfect replicas of communiqués from e-commerce companies like eBay or its PayPal service, banks or even a victim's employer, but are also targeted at people known to have an established relationship with the sender being mimicked.
    Its just phishing.Yea ,it carries names of people whom you know.but they have always been around!What is so new here?
    • What is new about it is that the security companies have a new product to hawk. Windows already requires firewall, anti-virus and anti-spam software to be usable; anti-phishing software is a new market. There are other operating systems, with privilege separation designed in from the ground up, which only run necessary services; won't execute arbitrary code without a user's say-so and definitely not in privileged mode; and allow for mail filtering at several levels, privileged and non-privileged. With so
    • I find it incredible that people fall for these things. I've heard otherwise perfectly sensible people saying "the online scammers are so clever, the email looked exactly like the real thing". Of course it does, it's called copy-and-paste, something a ten-year old could do.

  • C Food (Score:5, Funny)

    by mysticwhiskey ( 569750 ) <mystic_whiskey@hotm a i l . c om> on Monday December 05, 2005 @08:03AM (#14183852)
    From the beginning, life in the C was perilous. Once in the 'net, our shells were vulnerable. They tried to bait us with spam & worms, and while most found those tasteless, some were hooked.

    Explicitly casting further with new lures, the phishers trolled, hoping for more bytes on the (on)line. The emails of the species were particularly at risk, as their outlook was not so good to begin with.

    Some sought harbour in the eBay, hoping their bet paid off. Last I heard, the feedback was good.

    Maybe our only hope is growing legs and migrating to the LAN.

  • The problem isn't Windows (Score:5, Insightful)

    by wk633 ( 442820 ) on Monday December 05, 2005 @08:03AM (#14183853)
    Phishing isn't a technology problem. If your computer has a virus, the bad guys can get your critical data without tricking it out of you. Phishing will always exist due to human nature.

    Case in point: http://www.schneier.com/cgi-bin/mt/mt-tb.cgi/474/ [schneier.com]

    in which a bank manager was convinced to leave 5 million under the door to a bathroom stall in a bar in Paris.

  • FROM GOVERNMENT SOFTWARE FOUNDATION OF NIGERIA (Score:4, Funny)

    by n0dalus ( 807994 ) on Monday December 05, 2005 @08:03AM (#14183855) Journal
    DO NOT WORRY, my GOOD FRIEND.

    PHISHING claims many LIVES, but YOU TOO can be SAFE when you use our SECURE SOFTWARE to protect your family from PHISHING. BUT alas, my COMPANY lacks FUNDS to share this SECURE SOFTWARE with GOOD PEOPLE like you. THIS TRAGIC moment for our company can only be FIXED by your kind SERVICES. PLEASE transfer ONE THOUSAND DOLLARS to me at the GOVERNMENT SOFTWARE FOUNDATION OF NIGERIA so we can all SHARE this SECURE SOFTWARE.

    ATTACHED is a special TRIAL of this very SECURE SOFTWARE, just for YOU. DO NOT HESITATE to protect yourself from the deadly THREAT of PHISHING.

  • That does it. (Score:5, Funny)

    by sticks_us ( 150624 ) on Monday December 05, 2005 @08:06AM (#14183861) Homepage
    I'm calling the "Metaphor and Analogy" police, if there is such a thing.

    Why is it that EVERYTHING involving computers and the internets ends up becoming some cutesy-cutesy thing?

    What's next?

    Employee 1: "You hear about Bob?"

    Employee 2: "Yeah, I hear he got spear-phished this weekend. I guess they gutted and scaled him, and supposedly they're going to pan-phry him."

    Employee 1: "Well, it beats being served in a tuna salad!"

    Employee 2: "What the hell, exactly, are we talking about?"
    • I'm calling the "Metaphor and Analogy" police, if there is such a thing.

      Why is it that EVERYTHING involving computers and the internets ends up becoming some cutesy-cutesy thing?

      What's next?

      Spear-spamming?
  • Technology is advancing on all sectors.

    Or does it? Jackont took his computer to the Israeli police last fall and was told to reformat it. But his problems persisted. So the police examined his computer more closely and discovered that a malicious program known as a Trojan horse lay hidden deep inside and had hijacked the machine from a remote location. Trojan horse? That's sooo 1000 BC. Was this trojan hiding in his BIOS or is this guy incompetent?

    The only new thing is this "spear-phishing" is a speciali

  • Drama queen (Score:5, Funny)

    by bumptehjambox ( 886036 ) on Monday December 05, 2005 @08:13AM (#14183888)
    Sorry for the 'spoiler,' but what a grand finale at the end of the article.

    People don't like it when I say this, but it's like being raped. It's like my underwear was spread all over the streets. It was a severe breach of privacy.

    I'd like to be the cop that treats this like they do when they try to tell young girl rape victims its their fault...
    Well, look at ya! is that all you put on as a browser?!
    Yea, this is just what I usually put on, Internet Explorer.
    Well there ya go... You're going out on the internet putting on nothing but a skimpy browser, making all sorts of purchases, without any sort of protection? No wonder you're gettin yourself raped!

  • Better habits.... (Score:4, Insightful)

    by Chaffar ( 670874 ) on Monday December 05, 2005 @08:14AM (#14183891)
    Wieseltier told authorities that she received a Trojan-infested e-mail message bearing the address of gur_r@zahav.net.il, which she believed came from a friend.[...]But her friend's e-mail was actually gur-r@zahav.net

    See why whitelisting your contacts is important ? The problem is that people want to use they computer the way they use their washing machine. They think that just because they have "auto-update on" for Windows and Norton, then they're safe. Unfortunately, they're not. If they use emails irresponsibly, they will get spammed/phished/worse. There is no miracle cure, but good internet "security" habits can help a lot. No amount of software can replace good habits and experience.

    However, I feel that this is a battle that is already lost. How can I convince strangers to pick up good habits if I can't even convince my sister and father? All they care about is having a functional computer to send their emails and type their .docs whenever they need to do so. Any downtime is unacceptable, yet they refuse to acknowledge the fact that any downtime is usually their fault. PCs have become the 'automobiles' of the 21st century:" I don't care how it works, as long as it gets me to where I want to be."

    Bah, maybe I'm wrong. Maybe I have too much free time, others don't have the luxury to care about these things. Still I'm the one who ends up fixing the PC/ taking the car to the mechanic....

    • The 'automobiles' and PC's analogy just doesnt stand up. To use a car I have to demonstrate I can handle it and most things that im likley to come accross when using it. In the UK at least drivers have to be proficient in the theory and practise of driving, but any idiot can own a PC. I like to think of PC infection etc like getting pregnant. Yes accidents might happen but most people are bright enough to stop it. If someone does get knocked up (phished or virus infected) then the only deserve help an
    • This might sound rather sad, but this is what I do. Considering how I've been slowly moving family away from Microsoft products and operating systems and to Apple systems, my solution was to set-up their system once they purchased it BEFORE they even touched it.

      I made myself the administrator of the system, gave one of them a "managed" account with a simple finder. All the applications could be used but the restrictions were little enough so they could do everything they needed without access to Terminal, o

  • Spear-phishing (Score:3, Insightful)

    by Aceticon ( 140883 ) on Monday December 05, 2005 @08:17AM (#14183906)
    Spear-phishing = social engineering via e-mail

    Instead of telephoning some company and making believe ur their service provider to try and get the root password for some machine, one sends an email disguised as a legit email from a company with which a target company's employee has a commercial relation. Said email contains as payload an agent program which can be used to gather information/control the machine.

    This is more powerfull than old style social engineering, both because you directly get an agent running on a machine inside the target company's network and because the list of potential targets is bigger than just "the person's that have passwords to the company's servers"

    • Re:Spear-phishing (Score:1, Funny)

      by Anonymous Coward
      This is an e-mail I got today:

      Notice the misspellings.

      Dear Amazon member,

      Due to concerns we have for the safety and integrity of the Amazon community we have issued this warning.

      Per the User Agreement, Section 9, we may immediately issue a warning, temporarily suspend, indefinitely suspend or terminate your membership and refuse to provide our services to you if we believe that your actions may cause financial loss or legal liability for you, our users or us. We may also take these actions if we are unable

  • What utter crap (Score:3, Insightful)

    by MikeyToo ( 527303 ) on Monday December 05, 2005 @08:35AM (#14183966)
    CNET takes a year-old story about a bitter divorce and revenge, adds some buzzwords, information about very common, almost "old school", spamming and phishing techniques and we're all supposed to run around yelling "The sky is falling!!". Someone must be way behind on their copy output and have the FUD generators turned up to 11.

    I'm sorry for those of you IT types who have managers or "super users" who learned everything they know about computers from reading PC Ragazine or CNET. I'm sure you'll be getting worried calls and emails today. Just what you need on a Monday.
  • "It's like the Yom Kippur War or Pearl Harbor in the Israeli business market because of the great surprise the victims had when the problem was exposed,"

    Hard to believe anything is a surprise in that area of the world anymore.
  • The latest tricks seem to be offering some special deal and all you have to do is login. Soon I expect most of them will be like "Dear Big Bank customer, you've been picked for 200,000 frequent miles" and the a log in screen with spots for bank and airline details and people may just give away all that info.

    I've seen two messages that are heading in this direction and the banks better step up their education because more people will fall for these than the older scams.

    And this isn't new.... This type of so
    • Similarily, I got an email yesterday from someone posing to be eBay, except that they pretended to provide a way to login into eBay after your account has been suspended to get your account reinstated. This is a sore spot with many people, see this [paypalsucks.com]. So I think your right -- some phishing setup's are perhaps just starting to lose the look and feel of obviousness, and this is not good thing.
    • "Dear Big Bank customer, you've been picked for 200,000 frequent miles" and the a log in screen with spots for bank and airline details and people may just give away all that info.

      The media is going to call that "phly phishing".

  • More marketing words (Score:3, Funny)

    by OO7david ( 159677 ) on Monday December 05, 2005 @09:06AM (#14184066) Homepage Journal
    I have half a mind to start a company that targets people whose computer freezes from all of the spy/ad/malware by claiming to offer something that will remove it. They, being tired of frozen screens, will give me the info I need.

    I'll call it ice phishing.

  • Spam Fritter (Score:3, Funny)

    by BarryNorton ( 778694 ) on Monday December 05, 2005 @09:07AM (#14184071)
    I got spam-frittered the other day - they used the old 'spam, spam, spam, egg, chips and spam' attack, luckily I was phishing on the back of a trojan horse on my pharm - still, I was pretty phreaked. You know what I mean?

  • Phishing or not? (Score:5, Interesting)

    by swm ( 171547 ) <swmcd@world.std.com> on Monday December 05, 2005 @09:09AM (#14184083) Homepage
    My health insureance company called.
    First thing they want is my birthday.
    I hesitate, and they say they have to confirm who I am before they can talk to me.
    (Federal privacy regs, HIPAA, and all that).

    I refuse, because I don't know if they are who they say they are.
    They immediately understand, and give me a tool-free number that I can call into.
    After I hang up, I realize that their number doesn't help me, becuase *they* gave it to me.

    It isn't the number on my health insurance card.
    I can't find it on their web page.
    I google for it and get no hits.
    So I still don't know who they are.
    So I don't call the number.

    Phishing? Probably not.
    It probably was my health insurance company.
    But it's been a couple of weeks now, and they haven't called back.
    In the past, when they've wanted to talk to me,
    they've called every few days until they got hold of me.

    So I don't really know...
    • They immediately understand, and give me a tool-free number that I can call into.
      I wish the call centres I have to deal with weren't manned by such tools...

    • Re:Phishing or not? (Score:5, Interesting)

      by Lord Grey ( 463613 ) on Monday December 05, 2005 @09:54AM (#14184330)
      I'm glad to see that I'm not the only one.

      A couple of months ago I received a message on my home phone from American Express concerning "suspicious activity on my card." The message said really only that, and that I should call some toll-free number that wasn't printed on my card. There was no identifying information at all in the message, and to make matters stranger they were calling about a business card (they called me at home, not at work).

      So I called the number. I get a person almost immediately and there is quite a bit of background noise on the line. They ask for my card number. When I didn't tell them and started asking questions (trying to determine if the person really did work for AmEx), the guy got insistent and asked for my social security number. I refused to answer and asked more questions, but never got a good answer.

      I eventually hung up on the guy and then looked up AmEx's fraud prevention number in Google and called THAT. It turned out that someone really did hijack the card number from some vendor's database and there were 4-5 bogus purchases. We got the problem cleared up relatively quickly.

      The problem, however, is that the AmEx representative did not come across in a professional manner and his conversation with me served only to make me more suspicious. With all the phishing going on, I'm extremely leery of simply providing personal information upon request.

      • Re:Phishing or not? (Score:5, Insightful)

        by Technician ( 215283 ) on Monday December 05, 2005 @10:31AM (#14184556)
        A couple of months ago I received a message on my home phone from American Express concerning "suspicious activity on my card."

        So did I. I knew it was a phishing call. I was polite and refused to give my paticulars and asked about the activity. I asked if I gave the last 4 digits if they could verify the address. They said no they needed the full number, exp date, name as it is on the card and the verification number. I then told them I do not have an American Express card. I then called American Express and gave them the phishing information.

        If a bank is having their customer base phished, and you don't have an account, let the bank know anyway instead of ignoring it. You may protect your neighbors.
    • This is the same problem I have with email notifications or marketing from credit card companies. I assume they are all scams. Only the paranoid are safe against these scams.

      What is worse is that the companies use the same kinds of approaches, so it's even more difficult to figure out if any of it is legit. The companies are also victims in these cases, but due to the disconnects between the fraud stats and their customer service, they don't see the big picture. Large companies use "email marketing" as
    • Just call the number on your insurance card. They should be able to verify that it was them trying to contact you, and accomplish whatever the heck it was they were calling about.
    • I had an issue where I forgot to pay my Sprint bill, and so they called my cell phone. Except that nothing on the display indicated that it was Sprint (I would think that *they* of all people could change what's displayed on my phone if they wanted). The person wanted my credit card or checking account information to pay the bill. I told them I would pay it online by the end of the day. She informed me that if I did not pay immediately, my account would be suspended. I told her that since I did not cal
    • *Stupid me. Forgot to "preview" before I submitted.*

      I had an issue where I forgot to pay my Sprint bill, and so they called my cell phone. Except that nothing on the display indicated that it was Sprint (I would think that *they* of all people could change what's displayed on my phone if they wanted). The person wanted my credit card or checking account information to pay the bill. I told them I would pay it online by the end of the day. She informed me that if I did not pay immediately, my account woul
  • I will never open my email or install anything on a PC again, I will become a self-contained unit.
    I am a rock I am an island. And a rock feels no pain, and and island never gets phished.

  • Dupe? (Score:2, Informative)

    by MirrororriM ( 801308 )
    Hate to beat a dead horse, but here is an older Slashdot story about "spear phishing" here ... [slashdot.org]

  • "Spear" phishing? (Score:4, Funny)

    by Entropy ( 6967 ) on Monday December 05, 2005 @10:36AM (#14184593)
    Spear Phishing? Because it "targets specific people" ?

    Okay:

    Jelly phishing - targeting politicians.

    Salmon phishing - targeting gays.

    Flounder phishing - targeting christians.

    Tuna phishing - targeting pianists.

    Shark phishing - targeting lawyers.

    I am sure we could come up with others :)
  • I placed a local classified ad (print newspaper in rural Idaho) to sell a puppy a couple weeks back. It included my e-mail address if anyone wanted pictures.

    One response I received was one in broken English asking for pictures and if the price was firm. I responded with photos and the price. The next response was 4 paragraphs of an overdraft money order scam, telling me they'd arrange for someone to pick up the dog, but to wire the excess funds back to an account in London, etc.

    I was sort of impressed, c
  • I am amazed to no end that once in a long while the media gets its hands around a concept that has been around for years. They then trump it up as this Next Big Thing (tm), only to shamefully admit later on that, no, it's actually been done before.

    This is really not much different from remote dumpster diving. If I wanted specific, personal information from someone, I wouldn't need to go through very much trouble in getting it. Just as a security-conscious person would shred sensitive documents before com

  • What gets me about this is that it's not new. Telephone scams of a similar nature have been around forever. And the defense is the same for both: never trust the other party if you didn't originate the call. Whether I'm getting an e-mail from PayPal about my account being locked or a phone call from American Express about potentially fraudulent activity on my card, my first reaction is to simply ignore everything the caller/sender tells me. I go to my own bookmarks and get to my account on the respective we

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close