'Rock Phish' blamed for surge in phishing
445416
(InfoWorld) - The first thing you need to know about Rock Phish is that nobody knows exactly who, or what, they are. Wikipedia defines the Rock Phish Kit as "a popular tool designed to help nontechnical people create and carry out phishing attacks," but according to security experts, that definition is not correct. They say that Rock Phish is actually a person, or perhaps a group of people, who are behind as much as one-half of the phishing attacks being carried out these days. No one can say for sure where Rock Phish is based, or if the group operates out of a single country. "They are sort of the Keyser SÃ¶ze of phishing," said Zulfikar Ramzan, senior principal researcher with Symantec's Security Response group, referring to the secretive criminal kingpin in the 1995 film, "The Usual Suspects." "They're doing some pretty scary things out there," he added. This criminal organization first appeared in late 2004 and was given the name "Rock Phish" because the URLs (Uniform Resource Locators) on the group's fake sites included a distinctive subdirectory named "rock," a technique the group abandoned once phishing filters began looking for the word. Since then, it has grown to be one of the most prominent phishing groups in operation. It has developed a variety of new attack techniques that have earned the group a kind of grudging respect among security professionals, several of whom declined to be interviewed on the record for this story for fear of being physically harmed. They estimated that the criminal organization's phishing schemes have cost banks more than US$100 million to date. Rock Phish is not known for targeting the two most popular phishing targets -- eBay and PayPal. Instead, it specializes in European and U.S. financial institutions. At last count, the group had spoofed 44 brands from businesses in nine countries, sending out e-mails that try to trick victims into visiting phony Web sites and entering information such as credit card numbers and passwords. Rock Phish sites have spoofed CitiBank, E*Trade, Barclays, and Deutsche Bank, among others. Security experts estimated that Rock Phish is responsible for between one-third and one-half of all phishing messages being sent out on any given day. "They are probably the most active group of phishers in the world," said Dan Hubbard, senior director, security and technology research with Websense Inc. What causes particular concern among security experts such as Hubbard is Rock Phish's ability to stay one step ahead of both security products and law enforcement. For example, Rock Phish pioneered image spam: the technique of sending e-mail messages in graphic files in order to bypass spam filters, according to security experts. And just as browser makers have been building phishing filters into their products, the group has begun creating unique URLs for its phishing messages to get around blacklists of known phishing addresses. These single-use URLS make it extremely difficult for antiphishing researchers to identify and block phishing pages, Symantec's Ramzan said. This is bad news for products such as the Firefox browser, which uses a blacklist. "Ultimately, technologies that rely heavily on blacklists are going to be useless," Ramzan said. Rock Phish has contributed to a surge in the number of phishing Web sites over the past few months, according the Anti-Phishing Working Group. In August, the group counted 19,000 phishing URLs. By October, the most recent month for which data is available, that number had nearly doubled to 35,000. Security experts guess that Rock Phish is run by an extremely small group of technically savvy criminals -- probably about a dozen hackers -- who set up the phishing Web sites, manage the domain name registration and ensure that the stolen financial information is funneled into a central server, which researchers call "the Mother Ship." This group then sells the credit card and banking information in Internet-based chat rooms to a much wider range of money launderers who actually extract money from these accounts, according to researchers who asked not to be identified. Rock Phish uses a network of hacked computers to redirect Web visitors to the Mother Ship, and the group has been particularly adept at exploiting the decentralized nature of the Internet for its illegal activity. One successful trick has been to register new phishing addresses in little-used country domains -- SÃ£o TomÃ© and Principe (.st) and Moldovia (.md) have been recent targets -- where law enforcement and phishing take-down groups may not have establish contacts, according to researchers. During the time it takes to establish contacts with the domain name registrars and have them take down the fraudulent Web domains, Rock Phish can continue to collect information. "They're the innovators in the phishing space," said Symantec's Ramzan. "Whenever there's a new technique that comes out, it can be traced back to the Rock Phish group."
585881
Do-it-yourself phishing kits are being made available for download free of charge from the internet, security watchers have warned.
172876
Domains of several new phishing sites are cropping up with known Storm worm domains. F-Secure researchers think phishers are leasing parts of the larger botnet.
528680
(InfoWorld) - Phishers have been using compromised MySpace.com accounts to attack unsuspecting Web surfers, security experts said Thursday. The attack is thought to have infected several thousand PCs according to reports from ISPs, said Johannes Ullrich, chief research officer for the SANS Institute. Ullrich has documented the issue on the SANS Internet Storm Center blog. Lawrence Baldwin, chief forensics officer with security vendor MyNetWatchman, discovered the threat Tuesday, and The Washington Post reported on it late Wednesday. Criminals have managed to install fake navigation bars on the top of MySpace.com user profile pages that, when clicked, lead to malicious computers that attempt to infect the victim's computer. The attack uses several known Internet Explorer flaws that have been fixed, so users who have installed the latest Microsoft patches are not at risk, security experts said. The code was installed on "maybe a few dozen," MySpace.com pages, most of which have been removed by administrators at the social-networking site, Ullrich said. MySpace.com representatives did not respond to requests for comment on Thursday. Two components comprise the attack. It attempts to install malicious botnet software on victims' computers, and it uses these infected computers to try to steal MySpace credentials in a phishing attack. Computers that are compromised by the attack become infected with malicious botnet software known as "flux bot," which makes them unwitting participants in the phishing scam. After the malicious Web site attempts to install the flux bot code, it then presents victims with a fake MySpace.com login page, which tries to extract their MySpace.com user name and password. Baldwin allowed one of his test computers to be infected with flux bot and found that attackers were remarkably successful at stealing passwords. "I operated as a flux node for about 12 hours and did a full audit of all the traffic coming into my machine. I was probably getting close to 60 MySpace users an hour surfing to my flux node. And at least a quarter of those actually gave up their credentials." Baldwin estimates that the attackers were using another 200 compromised flux bot machines in their attack. Because MySpace.com allows users to install their own HTML code and isÂ visited by such a large number of technically unsophisticated users, it has becomeÂ an attractive target for these types of attacks. Last December, hackers created a worm that quickly spread across MySpace.com, stealing user names and passwords. That worm exploited a flaw in Apple's QuickTime media player.
463350
More than three out of four (76 percent) consumers are experiencing an increase in spoofing and phishing incidents and 35 percent receive fake e-mails at least once a week, according to a recent national study conducted by Ponemon Institute, a Tucson, Ariz
287780
The Anti-Phishing Working Group (APWG) reported today that the number of brands hijacked by phishers leapt to a record high of 154, up 20 percent from the previous month and more than 12 percent from the previous high.
757211
(InfoWorld) - Cybercriminals created a record number of phishing Web sites in July and also hijacked a record number of brands to help them do their work, a consortium that monitors online fraud said Monday. The number of phishing sites -- or fraudulent Web sites try to fool people into handing over sensitive personal information -- rose to 14,191 in July, an 18 percent increase over May, the previous all-time high, said the Anti-Phishing Working Group (APWG). The fraudulent sites mimicked a record 154 brands, up 20 percent over June and 12 percent over the previous high, also recorded in May, APWG said. The latest figures show that online criminals are diversifying to target smaller financial institutions, Internet service providers and even government agencies, the group said. However, theÂ financial services industry is still targetedÂ the most, with more than nine out of 10 phishing sites aimed at that sector. The technical sophistication of phishing attacks is also increasing. APWG said that 1,850 phishing sites attempted to download a Trojan horse, a program that conceals itself in another, harmless-looking file but can be used to harvest personal information or download other malicious programs to an infected computer. APWG also said that one security vendor, Websense, detected special toolkits for sale on Russian Web sites to construct this kind of attack when a user visits a Web page. They can be fairly cheap, too: prices range from $20 to $300, APWG said. Also on the rise are "traffic redirector" Trojans, which force users to certain Web sites without their consent, APWG said. Overall, the United States hosts nearly 30 percent of all phishing sites, followed by South Korea at 13 percent and China at 12 percent, APWG figures shoed.
384643
There's a new kind of theft growing in popularity -- be careful!
28148
Online phishing schemes increased significantly in October as financial institutions struggled to combat attempts to steal private account information from online consumers, according to the Anti-Phishing Working Group (APWG).
418284
GADFLY ALREADY the internet age has given us 'phishing', when criminals use emails to persuade you to give them your bank details.  Now it seems we have the less crooked but nonetheless enraging online experience of 'philfing'  an acronym for 'purposely hiding what I'm looking for'.
53314
Cyber criminals could soon be mounting sophisticated phishing attacks that are hard to detect warn experts.
145645
InfoWorld - The latest information on phishing indicates that fraudsters are increasingly using malicious software to direct users to their deceptive sites.
395819
It's a case of the professional fraudsters scamming the amateurs with a phishing tools supply site.
615540
A new online method for trying to resolve travelers' problems boarding planes looks like a typical phishing attack. In 27B Stroke 6.
231913
A phishing scam has been detected that doesn&#39;t require users to click on a link in order to jeopardise their personal data. Simply opening the email may be enough, according to Messagelabs.
110564
Click-kiddies Cybercriminals have created a "Plug and Play" phishing kit that dramatically increases the speed with which servers can be attacked. The toolkit - contained in a single file - makes it possible for even technically-illiterate would-be fraudsters to create phishing sites on a compromised server within the the blink of an eye (or two seconds, to be more exact).â¦
532476
With one in every 400 emails now a suspected phishing attack, computer users are being encouraged to increase their knowledge, open their eyes, and pay attention.