Phishing Attacks May No Longer Require Lure
451719
typically e-mailed as enticements to bogus sites that endanger users&#39; systems and expose their personal information -- is limited in scope
36812
In a twist, security researchers have discovered a group of hackers who are exploiting a new category of victims -- aspiring Internet scammers.A Moroccan group called &quot;Mr. Brain&quot; is offering free phishing kits on a Web site hosted in France, said Paul Mutton, Internet services developer at Netcraft, a security company in Bath, England.The software packages make it easy to quickly set up a fraudulent Web site mimicking a known brand in order to trick people into divulging credit card details or bank account numbers. Templates for spam e-mail are also included, targeting brands such as Bank of America, eBay, PayPal, and HSBC.Mr. Brain&#39;s Web site lists the kits and what kind of details each one is capable of collecting, such as usernames, passwords or Social Security numbers. Netcraft posted screenshots on its Web site.But what the aspiring scammer doesn&#39;t know is that the phishing kits are designed to send any sensitive information that&#39;s collected back to e-mail accounts controlled by Mr. Brain, Mutton said.&quot;Obviously, that&#39;s why they are offering this stuff for free,&quot; Mutton said. &quot;I was impressed by it.&quot;Mr. Brain hides the special e-mail function in a blend of PHP scripts, one of which is encrypted, Mutton said. Just in case someone decrypts it, Mr. Brain has written at the top of the file &quot;Don&#39;t need to change anything here. Created by Mr. Brain Morocco Team.&quot;The scheme seems to be targeted at new phishers, Mutton said. Mr. Brain benefits since other wannabe scammers shoulder the cost and risk of finding an ISP (Internet Service Provider) to host the phishing site, Mutton said.&quot;Essentially, they&#39;re exploiting all these novice phishers -- basically getting them to do all the hard work,&quot; Mutton said.It&#39;s difficult to tell without further research how many of the free phishing kits linked with this latest scam are live on the Internet, but Mutton said Netcraft noticed one earlier this month targeting Bank of America.&quot;Clearly, these are actively being used in phishing attacks,&quot; Mutton said.
466855
New service helps companies thwart online scams.
430013
Slashdot has a warning posted about the existence of a phishing scam directed toward Red Hat users. Read more to see the post. rixdaffy writes &quot;I just received an email from the &#39;Redhat Security Team&#39; telling
477301
Security firm Secunia has warned that most Web browsers are vulnerable to a simple &quot;phishing&quot; technique that could make fraudulent content appear genuine.
532297
(InfoWorld) - Financially motivatedÂ malwareÂ attacks areÂ on the rise,Â with automated software packages making it easy for unskilled hackers to earn a living by sending out spam, researchers at messaging security vendor Secure Computing say. A malware kit calledÂ MPack,Â released by Russian hackers last December, allows pretty much anyone with $200 to become a master spammer because it is easy to use and exploits vulnerabilities in FireFox, Internet Explorer and Apple's QuickTime, says Dmitri Alperovitch, principal research scientist for Secure Computing. The trend that "kind of defines 2007" is the convergence of traditional e-mail with Web-based attacks, in which message recipients are prompted to click on links to malicious Web sites, rather than to download attachments, Alperovitch says. "Certainly, exploiting Web browser vulnerabilities has been common. We've seen that for a long time," he says. "Now we're seeing that capability being merged with traditional e-mail worms that sort of blanket the Internet." Information-stealing malware now accounts for 10 percent of all threats, up from 8 percent in January, new research from Secure Computing has found. Trojans comprise 63 percent of all newly discoveredÂ malware, up from 58 percent in January. SpywareÂ and phishing are also becoming more problematic as attackers use more targeted attacks to steal personal and financial information. "The barriers to entry into cyber crime have been lowered so much," Alperovitch says. "People are realizing that they can make very serious money with almost no accountability, almost complete anonymity." Quoting the analyst firm Gartner, Secure Computing's researchers say that 75 percent of enterprises will be infected by "undetectable professional-grade malware" by year-end. About 90 percent of all e-mail is malicious, but that figure will rise as the holiday season gets closer, according to Alperovitch. "There's a good chance we'll reach 95 percent, maybe higher, of all e-mails being malicious by the end of the year," he says. As the storm worm showed, the automation of online attacks is allowing the creation of more botnets, he says. E-mail delivery mechanisms are also being optimized to bypass spam filters. Unfortunately, many Web surfers are far too trusting. "If you're walking down the street and someone asks you for your Social Security number or your bank account pin, you're not going to give it to them," Alperovitch says. "Yet on the Internet, people freely give them out to anyone who sends them an e-mail message." Here are some key security trends and events identified by Secure Computing in the first eight months of 2007: -- TheÂ Storm worm,Â named after subject lines like "230 dead as storm batters Europe," and similar worms became widespread in January and the following months, with new variants being created every 15 minutes. -- A password-stealingÂ Trojan hit visitors to the Miami Dolphins' stadium Web siteÂ during the Super Bowl, when attackers took advantage of a vulnerability in Internet Explorer's rendering of vector markup language documents. -- A mass-email with pictures of Britney Spears and Paris Hilton in April lured people to a Web site that hosted a zero-day exploit related to Windows' handling of animated cursor files. Microsoft released a patch to fix the vulnerability. -- More than 10,000 European Web sites hosted malware attacks in June after being compromised. "Hidden IFRAME's" were injected into the Web sites, referring visitors to malicious sites using MPack to deliver banking Trojans. -- So-called backdoor Trojans affect home users around the world, including nearly 100,000 PCs now infected by a new wave of storm malware. "The mailings that came with subject lines such as 'You've received a postcard from a family member!' directed users to Web-hosted exploits for several different vulnerabilities; they infect users' computers and attach them to the Storm family's P2P botnet," Secure Computing writes. Network World is an InfoWorld affiliate.
80272
Tool that identifies sites pretending to be connected to banks, eBay and more could help leave "phishing" scammers dead in the water.
758956
Hole could allow remote attackers to access your local search results.
587711
Hackers could bypass security warnings and download malicious content.
190172
Blog: Phishing and drive-by downloads are possible if you stumble across an infected profile.
657115
&quot;It&#39;s the same old stuff we&#39;ve seen in all the Bagle variants over the last months. The authors have just modified it to evade detection of most antivirus programs and spammed it widely,&quot; said Mikko HyppÃ¶nen of F-Secure.
762204
Science & environment: Creators of malware are no longer script kiddies after kudos - they're criminals after your cash. Wendy M Grossman asks if protection can keep pace with them.
236787
With consumers finally getting wise to phishing attacks, scammers are hitting the phones.The U.S. Federal Bureau of Investigation&#39;s Internet Crime Complaint Center (IC3) warned Thursday that so-called &quot;vishing&quot; attacks are on the rise. These are scams where criminals send an e-mail or text message to a victim, saying there has been a security problem and the victim needs to call his or her bank to reactivate a credit or debit card.&quot;Upon calling the telephone number, the recipient is greeted with &#39;Welcome to the bank of ...&#39; and then [is] requested to enter their card number in order to resolve a pending security issue,&quot; the IC3 said in its alert.In the past few years, inexpensive VoIP&#160;technology and open-source call-center software has made it inexpensive for scammers to set up phony call centers, paving the way for these new types of scams. Security experts say that vishing can be more effective than traditional phishing techniques -- which direct victims to fake Web sites -- because the voice-based attacks have not been as widely publicized.A new vishing scam involves sending text messages to cell phones, instructing victims to contact the fake online bank to renew their accounts, the IC3 said.Those who are unsure whether they have been targeted by this scam should look up the bank&#39;s phone number and call the bank directly, the IC3 advises.Operated in partnership with the FBI and the National White Collar Crime Center, the IC3 is a clearing house for Internet crime complaints.
319517
That email from your bank may be more than a friendly enquiry. It could be the hook of a Phisher, the new breed of Internet fraudster intent on stealing money by tricking customers into divulging online account details.
145645
InfoWorld - The latest information on phishing indicates that fraudsters are increasingly using malicious software to direct users to their deceptive sites.
521445
Phishing scams, already one of the main nemesis on the Net, have apparently just become even more sneaky -- and ingenious. Now, it appears phishing authors are borrowing some time-tested tactics
331142
A few months ago I wrote about Web browser hijacking. It&#39;s a problem a lot of computer users are facing these days. You open your Internet Explorer, but instead of being directed to your homepage, you&#39;re sent to some search engine you&#39;ve never heard of.