Monday, August 16. 2004
Why are the phishing schemes getting so sophisticated?
Another example of how nasty and sophisticated the phishing schemes are getting. It comes in an email from "U.S. Bank <html><p><font face="Arial"><A HREF="http : //www.usbank.com/cgi_w/cfm/confirmation/account_access/account_confirm.cfm" > <map name="FPMap0"> <area coords="0, 0, 633, 303" shape="rect" href="http : //%36 %39%2E%31%34 %36%2E %35%34%2E %31%30%34:%38%37/ %63%66 %6D/ %69%6E%64%65%78 %2E%68%74%6D" > </map><img SRC=" cid: part1.00030204.03070508@ anti-fraud.ref.num8188@ usbank.com" border="0" usemap="#FPMap0"> </A> </a> </font> </p><p> <font color="#FFFFFF">Oscar Jobs Horoscopes In short. in 1873 It's funny CDC: West Nile Young to see you When the I object to... haven't seen Look Smart Dragonball </font> </p> </html>
Note a few things: The image map is broken now, the site has been shut down. But the URL looks legitimate because it surrounds the image map, which overrides the A HREF URL. So instead of going to US bank, the user goes to that encoded URL. When they hit the URL, javascript pops open the dialog box (See image) and the actual US bank site is opened in the background. So for the user, it looks like USBank opened a login box. Also, the odd text at the bottom is a SPAMMING technique to get through SPAM filters by including "syntactically interesting" text.
If your bank opens a popup without an address bar to login, complain to them! These phishing schemes are dangerous.
According to news reports, the reason that these are getting more sophisticated and more dangerous is that Russian Organized Crime syndicates have recognized this "business opportunity" and have hired out-of-work programmers to clean up the original phishing schemes and make them much more dangerous.
Let's be careful out there!
MessageLabs has a quick report on the convergence of SPAM and Viruses -- something we've been noticing over the last couple of months. Add to this the convergence of Phishing and Malware (viruses and trojans) with the entry of Organized Crime into the
Tracked: Aug 18, 09:25