Upload File

the rise of phishing - international telecommunication union

  • Home
  • Documents
  • The Rise of Phishing - International Telecommunication Union
18
The Rise of Phishing Dave Brunswick Tumbleweed Communications Anti-Phishing Working Group

Upload: others

Post on 03-Feb-2022

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: The Rise of Phishing - International Telecommunication Union

The Rise of PhishingDave Brunswick

Tumbleweed CommunicationsAnti-Phishing Working Group

Page 2: The Rise of Phishing - International Telecommunication Union

2SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

The Anti-Phishing Working Group

• Industry association focused on eliminating identity theft and fraud from the growing problem of phishing and email spoofing

• Founded in 2003 by Tumbleweed Communications, Financial Institutions, ISPs, Law Enforcement Organisations and TechnologyProviders

• First meeting November 2003

• Now over 250 member organisation

• www.antiphishing.org

• Report phishing to [email protected]

Page 3: The Rise of Phishing - International Telecommunication Union

3SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

What is Phishing

Phishing attacks use 'spoofed' e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc.

Page 4: The Rise of Phishing - International Telecommunication Union

4SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

History of Phishing

• First known attacks on AOL accounts in 1996• Sporadic attacks up until 2003, mainly AOL, eBay and

PayPal• Major growth from mid-2003 until present day

» Focus on English language – U.S.A, Australia and U.K.

• 2004 – first non-English language attacks on Swiss Banks

• Increasing sophistication of attacks

Page 5: The Rise of Phishing - International Telecommunication Union

5SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

The Growth of Phishing

Unique Phishing Attacks (to end May 2004)

0

50

100

150

200

250

300

350

08/1

1/20

03

22/1

1/20

03

06/1

2/20

03

20/1

2/20

03

03/0

1/20

04

17/0

1/20

04

31/0

1/20

04

14/0

2/20

04

28/0

2/20

04

13/0

3/20

04

27/0

3/20

04

10/0

4/20

04

24/0

4/20

04

08/0

5/20

04

22/0

5/20

04

Page 6: The Rise of Phishing - International Telecommunication Union

6SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Phishing Targets (May)

May-04 Apr-04 Mar-04 Feb-04 Jan-04 Dec-03Citibank 370 475 98 58 34 17eBay 293 221 110 104 51 33U.S. Bank 167 62 4 0 2 0Paypal 149 135 63 42 10 16Fleet 33 28 23 9 2 1Visa 21 0 7 8 2 4AOL 17 9 10 10 35 4Lloyds TSB 17 15 4 0 1 1Barclays 15 31 11 6 1 1Westpac 12 17 10 0 3 1Nationwide 10 0 0 0 0 0Halifax 9 6 1 0 1 0Natwest 7 6 2 0 0 1Bank One 6 4 5 0 0 1Chase 6 3 2 0 0 0Earthlink 6 18 5 8 9 6ANZ 4 7 4 0 0 3e-gold 3 5 2 2 0 2HSBC 3 3 4 0 1 0MSN 3 0 0 0 0 0Woolwich 3 0 0 0 0 0Yahoo 3 2 3 4 2 0

Page 7: The Rise of Phishing - International Telecommunication Union

7SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Phishing Targets (to May 2004)

0

200

400

600

800

1000

1200

1400

Dec-03 Jan-04 Feb-04 Mar-04 Apr-04 May-04

YahooWoolwichMSNHSBCe-goldANZEarthlinkChaseBank OneNatwestHalifaxNationwideWestpacBarclaysLloyds TSBAOLVisaFleetPaypalU.S. BankeBayCitibank

Page 8: The Rise of Phishing - International Telecommunication Union

8SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Typical Emails

Spoofed From Address

Faked and encoded URLhttp://%31%34%38%2E%32%34%34%2E%39%33%2E%39:%34%39%30%33

/%63%69%74/%69%6E%64%65%78%2E%68%74%6D

Page 9: The Rise of Phishing - International Telecommunication Union

9SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Typical Website

Genuine Citibank site

Popup Window on Phisher’s site

Page 10: The Rise of Phishing - International Telecommunication Union

10SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Attack trends

• Email sources» Majority relayed through compromised adsl/cable connected Windows

machines» 95% of FROM: addresses spoofed

Page 11: The Rise of Phishing - International Telecommunication Union

11SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Attack trends

• Websites» Compromised Windows Cable/ADSL machines

• Worms/trojans/backdoors• Open remote access services (VNC)

» Subverted legitimate sites• Wide open/badly configured machines• Unpatched vulnerabilities

» Throw away hosting

Page 12: The Rise of Phishing - International Telecommunication Union

12SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Key elements to phishing

• Email should not be traceable

• Web site should not be traceable

• Money should not be traceable

• User needs reason to give details:-» “your account will be deactivated…”» “fraud on your account…”» “win a prize…”

• Web site should look convincing:-» Correct colours/logos» Not given away by URL….

Page 13: The Rise of Phishing - International Telecommunication Union

13SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Hiding the URL

Legitimate unrelated domainSub-domain looks like

bank

Page 14: The Rise of Phishing - International Telecommunication Union

14SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Hiding the URL

Page 15: The Rise of Phishing - International Telecommunication Union

15SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Hiding the URL: Pop up name window

Page 16: The Rise of Phishing - International Telecommunication Union

16SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Hiding the URL: Pop up on top

Genuine Citibank site

Popup Window on Phisher’s site

Page 17: The Rise of Phishing - International Telecommunication Union

17SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Hiding the URL: Fake browser parts

bar

Fake padlock

Fake browser address

Page 18: The Rise of Phishing - International Telecommunication Union

18SOLUTIONS FOR MISSION-CRITICAL COMMUNICATIONS

Approaches to Countering Phishing

• Legislation» It’s already illegal!

• Spam filters» Can catch a proportion» Relies on continual updates» Needs action from recipients/ISPs

• Education» Tell people about phishing» Educate people about security vulnerabilities

• Two Factor Web Authentication» Cost of roll out

• Email authentication» Solves the underlying problem – spoofing of FROM addresses

• Sender-ID/Caller-ID/SPF• S/MIME digital signatures

» Will take time to roll out


Telecommunication for high rise building

Anti-Phishing Technologydocs.apwg.org/reports/phishing-sfectf-report.pdf1/19/2005 Anti-Phishing Technology 2 The frequency of phishing attacks has increased dramatically in recent

Phishing - Study Mafiastudymafia.org/wp-content/uploads/2015/03/CSE-phishing-report.pdf · Phishing software and computer programs are designed to prevent the occurrence of Phishing

Meet our expert - files.schudio.com · between users without your authorisation or consent. The rise in popularity of Zoom has led to a rise in hacking operations and phishing campaigns

Phishing attacks, Types Of Phishing Attacks, How To Avoid Phishing Attacks

Phishing and Trust. Agenda Questions? Questions? Phishing Phishing Project feedback Project feedback Trust Trust

Datacentrix Phishing ransomware on the rise in SA€¦ · Phishing, ransomware on the rise in SA due to lockdown A recent report by independent global business advisory firm, FTI

Anti-Phishing Technology - APWG › reports › phishing-sfectf-report.pdf · 1/19/2005 Anti-Phishing Technology 2 The frequency of phishing attacks has increased dramatically in

Phishing - OnCourse Learning...$3.7 Million a year dealing with phishing attacks. Phishing on the Rise The Anti-Phishing Working Group (APWG) continues to report a dramatic rise in

Phishing and Anti-phishing techniques

Phishing - info.allot.com · phishing messages are sent via email, however, recent trends indicate a rise of phishing attacks that use other messaging platforms. In 2018 Slack, Skype,

Phishing Awareness - Valdosta State University€¦ · Types of Phishing Attacks Spear phishing - Phishing attempts directed at specific individuals or companies have been termed

AWARENESS OF PHISHING SCENARIO - CYBERWISER.eu · 2020. 11. 19. · Phishing attack exercise •Identify phishing indicators in an email. •Distinguish phishing from legitimate emails

Phishing awareness from ramsac€¦ · Phishing is on the rise Spotting a phishing email is an important skill to master because phishing accounts for 90% of data breaches. And once

Phishing with Asterisk PBX - Black Hat | Home · Phishing with Asterisk PBX Jay Schulman Why Is Phishing Changing •Phishing e-mails are becoming less effective •Regulatory changes

Combating Phishing: A Proactive Approach Phishing... · COMBATING PHISHING: A PROACTIVE APPROACH | 4 Phishing: on the rise and more sophisticated As a well-known and trusted brand,

Who is Fighting Phishing: An Overview of the Phishing Lifecycle

Don’t Take the Bait...Don’t Take the Bait Phishing is big business. Don’t get hooked. In the last year, phishing a ks have seen a meteoric rise as a kers con to r re successful

TELECOMMUNICATION DESIGN GUIDELINES - Pretread · TELECOMMUNICATION DESIGN GUIDELINES . 2 | | 3 ... Vantage Systems 103 b) ... , Ware houses, Medium High rise in a campus

Telecommunication for high rise building presentation

Information Assurance - Federal Council · 2021. 1. 26. · •Phishing on the rise Classic phishing, i.e. sending e-mails with the intent to trick the victim into divulging personal

How prevalent is mobile phishing today? What do these ... · Mobile phishing attacks are on the rise because hackers are capitalizing on enterprise security gaps during the COVID-19

Why phishing still works: user strategies for combating phishing … · 2020. 9. 23. · Why phishing still works: user strategies for combating phishing attacks Mohamed Alsharnouby,

Phishing Email Attacks - AVAREN ITfor spear phishing attacks. Spear phishing is nearly identical to standard email . phishing – except it is more targeted. Rather than sending the

Phishing - Fred 151 · 2020-03-21 · di Phishing. 2 Identificare Come riconoscere il Phishing. Cosa fare se siamo vittime di Phishing 3 Esempi Esempi di email di Phishing. 4 Test

Mobile Phishing Protection · Mobile Phishing Protection Anywhere Zero-Hour Protection Against the Broadest Range of Phishing Threats for iOS and Android SlashNext Mobile Phishing

Phishing attack

Phishing ppt

Phishing-Aware: A Neuro-Fuzzy Approach for Anti-Phishing ...networking.khu.ac.kr/.../data/Phishing-Aware.pdfPhishing-Aware: A Neuro-Fuzzy Approach for Anti-Phishing on Fog Networks

What is Phishing | How to Spot a Phishing email or Website 2020 | Antivirus for Phishing Attack

Phishing awareness

How to Spot Phishing Attacks - MicroAge · How to Spot Phishing Attacks What is Spear Phishing? Like phishing ploys, spear phishing scams are designed to obtain sensitive information

Phishing Spear Phishing - ASSP Region I€¦ · Phishing& Spear Phishing attacks are similar -key differences: •Phishingcampaign -very broad and automated, think 'spray & pray’

My Phishing

COMBATTING MODERN EMAIL PHISHING ATTACKS · 2016-11-07 · Combatting modern email phishing attacks More effective than traditional phishing scams, spear-phishing attacks are carefully