Phishing is no longer a nuisance crime. Sophisticated identity thieves are targeting customers of financial institutions and high-profile e-tailers in big numbers--and starting to get big results.
Unlike spammers, phishers' messages aren't aimed at selling male enhancement drugs, cut-rate mortgages or porn. Rather, phishers use common spamming techniques to generate vast numbers of e-mails that lure customers to spoofed Web sites and trick them into giving up passwords, credit card numbers and other personal information.
The problem has exploded since Earthlink issued its first warning a year ago. E-mail security provider Brightmail (recently acquired by Symantec) reported it detected 2.3 billion phishing messages in February alone. A study released by Gartner Research in May estimates that 76%of all known phishing attacks had occurred since last December. The Anti-Phishing Working Group (www.antiphishing.org), an industry association of more than 200 organizations, reported 1,125 unique phishing attacks in April, up from 402 in March and nearly seven times the number reported in January. Citibank was the overwhelming target of choice, with 475 attacks against it in April alone, followed by eBay, PayPal, US Bank and Barclays.
The startling growth of this threat has given the bad guys a head start. Fortunately, there are steps you can take to protect your organization, combining innovative technology and proactive policies and processes.
Phish Hooks
Phishers follow the money, so it's no surprise that organized crime, based largely in Asia and the former Soviet Bloc, appears to be behind the surge of attacks.
"Online usage of financial service has grown dramatically over the last two years," says Naftali Bennett, CEO of Cyota, a provider of antifraud and security products. "The universe and size of reward for the fraudster has increased dramatically." Security providers have been quick to respond, offering new techniques and repurposi
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
ng existing tools to address the threat.
In January, Cyota launched Cyota FraudAction, a modular suite of services that combats phishing attacks. At the core of FraudAction is Cyota's antifraud command center, which detects potential phishing attacks by analyzing data pulled in by various probes, decoys and several of Cyota's partners.
Cyota's analysts create damage assessment reports based on parameters such as the number of hits, quality of the e-mail and type of information the attacker is trying to obtain. This gives Cyota's clients an early warning so they can shut down the phisher's site and alert their customers and provides forensics data to aid in possible prosecution.
In May, MarkMonitor, an Internet brand protection and corporate domain registration specialist, announced Fraud Protection, which uses distributed honeypots and sophisticated baiting techniques to draw in and identify potential attacks. The firm monitors chat rooms, newsgroups and domain registries, processing the data through its correlation engines to determine potential threats.
MarkMonitor gathers data to help customers shut down attackers. It also provides evidence should the customers decide to prosecute.
Cyveillance, an online risk monitoring and management services provider, gives early attack warnings through its Cyveillance Intelligence Center Technology, which monitors hundreds of thousands of junk e-mails daily and cases the Web for potential attack intelligence.
Brightmail offers e-mail security products and services, including Brightmail Anti-Fraud, which leverages Brightmail's Probe Network, consisting of more than 2 million decoy e-mail accounts and antispam technology to detect spoofing attempts characteristic of phishing attacks. If fraud is detected, Brightmail creates rules to block subsequent spoofed e-mails from reaching customer accounts.
Numerous other vendors--such as Tumbleweed Communications, CipherTrust and NetIntelligence--feature antispam and e-mail filtering products and services and are good sources of phishing intelligence.
Tumbleweed founded the Anti-Phishing Working Group last fall. Membership is open to financial institutions, online retailers, law enforcement organizations and vendors.
Fighting Back
Early warnings are good, but service providers have no control over how customers respond to spoofed e-mails. Since phishing attacks target customers at their homes and workplaces, it's critical to have a clear policy governing the solicitation of personal information. Many companies warn customers that they will never solicit authentication information through e-mail.
Make sure everyone in your organization is on the same policy page; imagine the damage if one of your divisions solicits personal information after your customers have been warned to watch out for it.
Consider these additional steps:
Growing Stakes
If you still don't think phishing is a problem, consider what's at risk:
The Gartner study estimates that 30 million Americans have received a phishing attack, and about 3% (1.78 million) submitted personal and/or financial information. This percentage is likely many times greater than the response to typical spam messages and more than enough to assure phishers a high return on a minimal investment. Other sources say the response rate is as high as 5 percent.
There isn't enough evidence to accurately estimate how much money phishers net, but Gartner estimates the direct cost to companies was $1.2 billion in 2003, and, given the dramatic increase in attacks this year, it's easy to foresee growing losses.
In addition to direct losses, add downtime in the face of concerted attacks, the cost of issuing new credentials to customers who have been compromised, the security spending and potential liability, and you have the potential for a serious problem.
And, it's hard to put a dollar value on trust.
"Losses are high," says Mark Shull, president and CEO of MarkMonitor, "but the growing concern is having consumers reluctant to do business online."
About the author
Nalneesh Gaur, CISSP, is a manager with Accenture's Security Specialty practice.
This article orginally appeared in Information Security magazine
