NL | FR | ES | PT | IT | DE | DK | NO | JP | CN | KR | RU | AR

Phishing, also known as carding or brand spoofing, has many definitions; we want to be very careful how we define the term, since it is constantly evolving. Instead of a static definition, let’s look at the primitive phishing methods and see the practice’s active evolution and possible future processes. For now, we’ll define the primitive approach ,as the act of sending a forged e-mail (using a bulk mailer) to a recipient, falsely mimicking a legitimate establishment in an attempt to scam the recipient into divulging private information such as credit card numbers or bank account passwords.The e-mail, in most cases, will tell the user to visit a Web site to fill in the private information.To gain your trust, this Web site is designed to look like the site of the establishment the scammer is impersonating. Of course, the site isn’t really the site of the legitimate organization, and it will then proceed to steal your private information for monetary gain.Thus the word phishing is obviously a variation of the word fishing in that these scammers set out “hooks” in hopes that they will get a few “bites” from their victims.

Phishing has actually been around for over 10 years, starting with America Online (AOL) back in 1995.There were programs (like AOHell) that automated the process of phishing for accounts and credit card information. Back then phishing wasn’t used as much in e-mail compared to Internet Relay Chat (IRC) or the messaging alert system that AOL used.The phishers would imitate an AOL administrator and tell the victim that there was a billing problem and they needed them to renew their credit card and login information. Back then, because personal computers in the home combined with Internet usage were a fairly new experience, this method proved quite effective but was not observed with as much population as phishing is today.

The sudden onslaught of phishing against financial institutions was first reported in July 2003.According to the Great Spam Archive, the targets were primarily E-loan, E-gold, Wells Fargo, and Citibank. The most remarkable twist about the phishing phenomenon is that it introduced a new class of attack vectors that was overlooked in almost every financial institution’s security budget: the human element.All the expensive firewalls, SSL certificates, IPS rules, and patch management could not stop the exploitation of online trust that not only compromises confidential user information but has had a major impact on consumer confidence regarding telecommunications between an establishment and its clients.
From the technical perspective, most antispam and e-mail security experts were not surprised at the impact of this threat, since it has been well documented since RFC 2821 (Simple Mail Transfer Protocol or SMTP Request for Comments; see www.faqs.org/rfcs/rfc2821.html), an updated version of RFC 821 written in 1982. Section 7.1 of the RFC, titled “Mail Security and Spoofing,” describes in detail how SMTP mail is inherently insecure:

SMTP mail is inherently insecure in that it is feasible for even fairly casual users to negotiate directly with receiving and relaying SMTP servers and create messages that will trick a naive recipient into believing that they came from somewhere else. Constructing such a message so that the “spoofed” behavior cannot be detected by an expert is somewhat more difficult, but not sufficiently so as to be a deterrent to someone who is determined and knowledgeable. Consequently, as knowledge of Internet mail increases, so does the knowledge that SMTP mail inherently cannot be authenticated, or integrity checks provided, at the transport level. Real mail security lies only in end-to-end methods involving the message bodies, such as those which use digital signatures (see [14] and, e.g., PGP [4] or S/MIME [31]).

Various protocol extensions and configuration options that provide authentication at the transport level (e.g., from an SMTP client to an SMTP server) improve somewhat on the traditional situation described above. However, unless they are accompanied by careful handoffs of responsibility in a carefully designed trust environment, they remain inherently weaker than end-toend mechanisms which use digitally signed messages rather than depending on the integrity of the transport system.

Efforts to make it more difficult for users to set envelope return path and header “From” fields to point to valid addresses other than their own are largely misguided: they frustrate legitimate applications in which mail is sent by one user on behalf of another or in which error (or normal) replies should be directed to a special address. (Systems that provide convenient ways for users to alter these fields on a per-message basis should attempt to establish a primary and permanent mailbox address for the user so that Sender fields within the message data can be generated sensibly.)

This specification does not further address the authentication issues associated with SMTP other than to advocate that useful functionality not be disabled in the hope of providing some small margin of protection against an ignorant user who is trying to fake mail.

This specification makes a point of detailing how trivial it is to trick a nonexpert e-mail recipient into believing they were sent a legitimate e-mail. SMTP was designed in 1982 at a time when it was intended for use between limited and “trusted” users. In 2001, with RFC 2821 and SMTP having been used by the public for more than six years, the lack of security was fully documented.

The forgery approach described in RFC 2821, Section 7.1, is what phishers and spammers utilize to send their e-mails to recipients. It is important to understand that this does not mean that phishers have any skills.The reason phishing is at an all-time high is actually due to the tool sets that are available, not because the phishers have skill.To prove this point, security experts have known about

SMTP flaws since 1982, and back in 1995-1998, the primary attack on e-mail was known as e-mail bombing, but that was because numerous tools, such as Avalanche, Kaboom, and Ghost Mail, were freely available.These tools automated the process with a click of the mouse, rendering an e-mail account useless and in many cases destroying all usability of the mail server that was hosting the account.This attack essentially performed a denial-of-service (DoS) attack against mail accounts and their mail service providers by overloading the accounts with an endless amount of e-mail that was arriving at an overly accelerated rate. Since the tools were available, the attacks weren’t uncommon.This is similar to the analogy of the possibility of freely accessible guns. If gun purchases were not controlled, especially if there were no age limitation, and they were freely available, we would probably witness more gun-related crimes.This analogy applies to phishing today, since phishing is just another form of spam. Spam is not exactly an ingenious concept and takes very little imagination to employ, and readily accessible attack tools open the door for criminals to exploit well-known security flaws for their nefarious opportunities, including what we are seeing today: spam and phishing.

The Web-spoofing techniques are more varied in exploitation and are usually exploited via publicly available proof-of-concepts known as full disclosure provided by security researchers.The HTTP protocol is not inherently insecure like SMTP, but it suffers from a lack of standardization and the heterogeneous usage of Web browser clients such as FireFox, Internet Explorer, and Safari. It isn’t necessarily HTTP that is the problem, but a combination of specific vulnerabilities found within certain browsers and server-side Web sites that allow these attacks, as well as a misunderstanding of the flexibility of uniform resource locators (URLs) and their trivial modifications. For example, to the common eye, the URL www.southstrustbankonline.com in a browser window may easily trick a user into believing it is the actual Southtrust bank Web site. We call these fuzzy domains or look-alike domains.This is not an HTTP or Web browser exploit; this is an attack against the human eye.This method is designed to trick the user into not noticing the extra s in the URL (southstrust) instead of the real site URL, southtrustbankingonline.com.