Phishing Scams - What Can Financial Institutions Do?

Phishing is online identity theft for criminal purposes. Phishers typically use spoofed e-mails designed to lure recipients to fraudulent websites which attempt to trick them into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking the trusted brands of well-known banks, online retailers and credit card companies, phishers are able to convince recipients to respond to them. As a result of these scams, an increasing number of consumers are suffering credit card fraud, identity theft, and financial loss.

Of even greater concern is that phishers are increasingly deploying crimeware to create sophisticated blended attacks such as keylogging, transaction generators and DNS hijackers (pharming). These attacks are not just targeted at obtaining consumer identity and financial information. Numerous new attacks are targeting the authentication credentials of corporate and government users, indicating that the attackers are attempting to compromise databases and networks, and may have political as well as financial agendas.

Different Kinds of Phishing

Phishing emails typically look like they are coming from a financial institution, e-commerce site or government agency. Because the Internet lacks a mechanism for authenticating email, phishing e-mail uses the ‘From’ address of the company it is attempting to spoof. At first glance, phishing e-mails, and the websites associated with such e-mails, may appear completely legitimate. What Internet users may not realize is that criminals can easily copy logos and other information from legitimate businesses’ websites and place them into phishing e-mails and websites.

Most phishing e-mails include false statements intended to create the impression that there is an immediate threat or risk to the bank, credit-card, or financial account of the person who receives that e-mail. In some cases, phishing e-mails have promised the recipients a prize or other special benefit. Although the message sounds attractive rather than threatening, the object is the same: to trick recipients into disclosing their financial and personal data.

There are now reports of phishers attempting to steal passwords and access credentials from corporate network users by sending e-mails to employees posing as emails from the human resources department or the IT security department. These e-mails are extremely convincing, as they appear to originate from inside a company, as internal communication. We have seen some e-mails that go so far as to ask users to change their email server settings, which would allow a scammer to monitor all the outgoing e-mail of a user.

Industries Being Targeted

The most targeted industry sector for phishing attacks is Financial Services, from the perspective of total number of unique baiting sites as well as number of companies targeted. This sector averaged 71 per cent of all hijacked brands in 2004. The ISP sector now has a solid hold on second place with up to 14 per cent of attacks, and retail and miscellaneous sectors accounting for the remaining brands.

The Growth of Phishing

Phishing is a growing phenomenon. On average, the Anti-Phishing Working Group has been seeing a monthly increase of 15-25 per cent a month in phishing activity on the Internet over the last year. The Anti-Phishing Working Group has been tracking phishing attacks since late 2003, and has amassed the world’s largest archive of phishing attack data.

Active Reported Phishing Sites by Month October-May

Recently phishers have been using networks of thousands of zombies to send the phishing e-mails and host the data collection servers and even the DNS servers that serve up the location of many phishing sites.

Use of Zombies

Starting in October 2004, the Anti-Phishing Working Group started seeing a massive increase in the amount of phishing sites. Evidence indicated that the phishing exploits were not targeting one particular brand, but several targeted simultaneously. The one common theme of these phishing sites is that nearly all are being hosted on IP addresses and mostly outside of the US. It appears as though some sort of toolkit is available and/or a set of tools that are being used to produce similar exploits. The sudden large spike is indicative of the increasing use of distributed automation, used by the phishers.

We are also seeing multiple brands being spoofed from the same machine over a few days. For example a site will be an Ebay spoof one day, and then Paypal, then Citibank, etc. The content of the attacks is quite varied. There are several versions of content that move from site to site.

Countries Hosting Phishing Sites

The United States is the ‘leader’ in the number of hosted phishing sites, with 29 per cent of detected phishing sites being hosted in the US. China, Korea, and Russia are next on the list with 16 per cent, 9 per cent, and 8 per cent respectively of the total sites hosted. The number of sites that are being hosted on what appear to be compromised broadband PCs has risen to more than 50 per cent.

Technological Sophistication is Increasing

A wide variety of disguising techniques used by phishing baiting sites are currently in use. These include attacks using Internet Web browser vulnerabilities, embedded images with nested MAPs, embedded forms with cross-site-scripting styled buttons disguised as links, and exploitation of “marketing partner redirect” features in the websites of the hijacked brands themselves (so-called cross-domain scripting).

In 2004, a dangerous type of phishing attack was detected that replaces the “Address” bar at the top of a Web browser with a working fake, using JavaScript. This technique allows the phisher to display a completely fraudulent Web address URL, while taking the victim to the phisher’s spoofed site.

Even more concerning is crimeware called JS/QHosts21-A that first circulated on the Internet in October 2004. This software can be installed on a consumer’s PC simply by viewing a Web page that takes advantage of a weak ActiveX security setting in the Windows browser. If installed, the software creates entries in the user’s Hosts file, and will redirect the user to fake bank websites, even if they type the correct Internet address of the bank into their browser. Fortunately this exploit has not been widely used (yet).

What Financial Institutions can do to Protect Against the Threat

Unfortunately there is no silver bullet that a financial institution can deploy to eliminate phishing. This is a complex and evolving problem, because it is not a direct attack on a corporation’s network. Rather, it is an attack against end-users on the Internet, spoofing the brands of financial institutions and e-commerce sites. These credentials are then used for financial fraud, identity theft and network compromises. No existing firewall or intrusion detection system can help.

There are a number of things that financial institutions can do to help reduce the risk of phishing and mitigate against attacks:

1. Customer Education. Educate your customers about the existence of phishing attacks and their threat. Advise users about what kind of e-mails they may legitimately expect to receive from your company, and what types of e-mails might be fraudulent. For example, informing users that you will never ask them for identity information or passwords in an email or on a site linked from an email is a good start. It’s probably a good idea to not try and educate your customers via email though, as this itself could be viewed as phishing.
2. Employee Education. It is exasperating for the IT security departments of many financial institutions to discover that their marketing departments and business units may be sending out emails to customers that do in fact request personal information or login credentials. Educating your own employees about what kind of emails and offers to send to customers and what might be mistaken for phishing is a good idea.
3. Domain Name Management. Approximately 20 per cent of phishing attacks use so-called “cousin domain names”. These are legitimately registered Internet domain names that appear to be related to your institution. For example, if a phisher wishes to launch an attack against the customers of ExampleBank.com, they may set up a website named ExampleBank-Security.com or ExampleBank-CreditCardOffer.com. Financial institutions, and any company concerned about the integrity of their brand online, should work with vendors who can scan the domain registrations and make recommendations about which cousin domain types are often used for phishing, and will monitor those domains. Companies should ensure that they own the most common cousin domains related to their brand.
4. Web Application Security. Most phishing attacks can be detected and even mitigated at the Web application security level. A number of vendors offer Web application security firewalls and log analysis tools that can detect where a phishing site is being hosted, and even when a customer’s account might have been taken over due to phishing. These systems can also prevent typical vulnerabilities from being exploited by phishers to create convincing phishing emails and sites such as cross-site scripting and image referrals.
5. Takedown Services. Once a phishing attack has been launched and the servers hosting it have been identified, it is vitally important to get the site taken down as soon as possible to prevent customers from divulging their confidential information and credentials. Because most sites are not hosted in the country where the company being phished is located, this can be very difficult and time consuming for IT managers. It is recommended to contract with a company that can arrange for sites to be taken down. These companies have tools and relationships with Internet Service Providers and law enforcement agencies around the global to get sites taken down in a timely fashion.
6. Strong Authentication. Companies operating business-to-business financial services sites, where the risk of a phishing compromise is unthinkable, should consider using stronger authentication than just names and passwords. A variety of options are available, ranging from image-based authentication to digital certificates, smartcards and USB tokens.
7. Email Authentication. One reason why phishing is so prevalent is that Internet email has no means of being authenticated, meaning that consumers cannot tell if an email legitimately was sent by the person in the ‘From’ address. There are several proposed standards being discussed in the Internet technology community to remedy this situation. Financial institutions are strongly recommended to publish Sender-ID/SPF email server authentication records and to participate in pilots of digitally signed email such as Domain Keys.

Conclusion

Phishing is a social engineering scam that is increasingly criminal and hostile to business on the Internet. It is merging with sophisticated hacker, Trojan and DNS takeover attacks. There is evidence that organized crime and foreign antagonists are involved, and the technological stakes are continuing to escalate. Fortunately there are a number of best practices and technology offerings that can help financial institutions combat this growing menace.