Ramblings & ephemera

The various participants in phishing schemes

From Chapter 2: Botnets Overview of Craig A. Schiller’s Botnets: The Killer Web App (Syngress: 2007):

Christopher Abad provides insight into the phishing economy in an article published online by FirstMonday.org (http://www.firstmonday.org/issues/ issue10_9/abad/). The article, “The economy of phishing: A survey of the operations of the phishing market,” reveals the final phase of the phishing life [...]

Details on the Storm & Nugache botnets

From Dennis Fisher’s “Storm, Nugache lead dangerous new botnet barrage” (SearchSecurity.com: 19 December 2007):
[Dave Dittrich, a senior security engineer and researcher at the University of Washington in Seattle], one of the top botnet researchers in the world, has been tracking botnets for close to a decade and has seen it all. But this new piece [...]

To combat phishing, change browser design philosophy

From Federico Biancuzzi’s “Phishing with Rachna Dhamija” (SecurityFocus: 19 June 2006):
We discovered that existing security cues are ineffective, for three reasons:
1. The indicators are ignored (23% of participants in our study did not look at the address bar, status bar, or any SSL indicators).
2. The indicators are misunderstood. For example, one regular Firefox user told [...]

A profile of phishers & their jobs

From Lee Gomes’s Phisher Tales: How Webs of Scammers Pull Off Internet Fraud (The Wall Street Journal: 20 June 2005):
The typical phisher, he discovered, isn’t a movie-style villain but a Romanian teenager, albeit one who belongs to a social and economic infrastructure that is both remarkably sophisticated and utterly ragtag.
If, in the early days, phishing [...]

Do it yourself phishing kits

From John Leyden’s DIY phishing kits hit the Net (The Register: 19 August 2004):
Do-it-yourself phishing kits are being made available for download free of charge from the Internet, according to anti-virus firm Sophos.
Anyone surfing the Web can now get their hands on these kits, launch their own phishing attack and potentially defraud computer users of [...]

Credit cards sold in the Underground

From David Kirkpatrick’s “The Net’s not-so-secret economy of crime” (Fortune: 15 May 2006):
Raze Software offers a product called CC2Bank 1.3, available in freeware form - if you like it, please pay for it. …
But CC2Bank’s purpose is the management of stolen credit cards. Release 1.3 enables you to type in any credit card number and [...]

Bruce Schneier on phishing

From Bruce Schneier’s “Phishing“:
Phishing, for those of you who have been away from the Internet for the past few years, is when an attacker sends you an e-mail falsely claiming to be a legitimate business in order to trick you into giving away your account info — passwords, mostly. When this is done by hacking [...]

Phishing by altering the bank’s server

From Computerworld’s “Florida banks hacked in new spoofing attack“:
Three Florida banks have had their Web sites compromised by hackers in an attack that security experts are calling the first of its type.
Earlier this month, attackers were able to hack servers run by the Internet service provider that hosted the three banks’ Web sites. They then [...]

Free markets need visibility to work

From Slashdot’s “Pay-per-email and the ‘Market Myth’“:
But I think there’s a bigger problem underlying all of this. It’s not about specific problems with GoodMail’s or AOL’s or Hotmail’s system. The problem is that many advocates of these systems say that any flaws will get sorted out automatically by “the market” — and in this case [...]

Cybercrime more profitable than drug trafficing

From Reuters’ “Cybercrime yields more cash than drugs: expert“:
Global cybercrime generated a higher turnover than drug trafficking in 2004 and is set to grow even further with the wider use of technology in developing countries, a top expert said on Monday.
No country is immune from cybercrime, which includes corporate espionage, child pornography, stock manipulation, extortion [...]