[ISN] Worldwide Phishing Attacks May Stem from Few Sources

R.A. Hettinga rah at shipwright.com
Wed Oct 20 08:00:23 EDT 2004

--- begin forwarded text

Date: Wed, 20 Oct 2004 01:41:32 -0500 (CDT)
From: InfoSec News <isn at c4i.org>
To: isn at attrition.org
Subject: [ISN] Worldwide Phishing Attacks May Stem from Few Sources
Reply-To: isn at c4i.org
List-Id: InfoSec News <isn.attrition.org>
List-Archive: <http://www.attrition.org/pipermail/isn>
List-Post: <mailto:isn at attrition.org>
List-Help: <mailto:isn-request at attrition.org?subject=help>
List-Subscribe: <http://www.attrition.org/mailman/listinfo/isn>,
	<mailto:isn-request at attrition.org?subject=subscribe>
Sender: isn-bounces at attrition.org


By Dennis Fisher
October 19, 2004

Research from an e-mail security provider suggests that a handful of
people are responsible for the vast majority of the phishing attacks
on the Internet and the perpetrators are using a rotating series of
zombie networks to launch them.

Researchers at CipherTrust Inc. analyzed more than four million
e-mails collected from the company's customers during the first two
weeks of October and found that nearly a third of all of the zombie
machines sending the phishing messages are based in the United States.
That's twice as many as the 16 percent that are found in South Korea.

However, these findings do not mean that these attacks are originating
from inside these countries. The global nature of the Internet allows
attackers anywhere in the world to compromise machines in any
location. In fact, many experts believe that the majority of phishers
are in some way connected to organized crime groups in Russia or
Eastern Europe and that most such attacks begin there.

The most surprising conclusion of the research is that the attackers
sending out the phishing messages are using zombie networks of only
about 1,000 PCs.

"That's a pretty small bot network for the volume of stuff that these
guys are doing," said Dmitri Alperovitch, the research engineer at
Atlanta-based CipherTrust Inc. who conducted the study. "But the trick
is that they rotate to a different set of compromised machines each
day. They don't keep going to the same ones each time."

Crackers for years have been accumulating large networks of machines
compromised with small programs that give them the ability to control
the PCs remotely. They routinely sell or trade access to the networks
to others in the cracker underground and the PCs typically are used
either for launching DDoS (distributed denial of service attacks).

But as authorities began cracking down on spammers in recent years,
the spammers have begun relying on these networks to send out their
messages, too. Now, phishers have gotten into the game.

Alperovitch said that there are fewer than five operators in control
of the zombie networks that he identified in his research. And, even
though they're generating thousands of fraudulent e-mails every day,
their output was still a tiny fraction.less than one percent--of the
four million messages CipherTrust examined.

Phishers seem to be concentrating their efforts on a few high-profile
targets, as well. In the sample CipherTrust looked at, 54 percent of
the phishing messages used CitiGroup's Citibank name to entice
recipients. Another 13 percent use Citigroup Global Markets Inc.'s
Smith Barney's brand and eBay Inc. is the victim in about four percent
of the scams.

Open Source Vulnerability Database (OSVDB) Everything is Vulnerable -

--- end forwarded text

R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com

More information about the cryptography mailing list