Phishing

Who’s Who phish

And here, I thought I was finally famous.  It’s so disappointing.

I got a “Weekly Follow-up from the National Academic Association.”  I suppose it doesn’t really matter that I’d never heard of them, let alone weekly, because it came from the “Academic Association.”

“Hello Candidate,” it starts, and goes on to tell me that “As the school year opens, the Who’s Who Among Executives and Professionals begin a global search for accomplished individuals in both faculty and administrative roles at post-secondary institutions of learning.”

Could this possibly be a job offer?  They apparently need me to “verify your contact information so that we can properly publish your updated credentials alongside 30,000 of your prestigious peers. Such a listing can only bring you increased visibility and networking opportunities within the scholastic community.”  Only 30,000!  Such a select group!

Alas, when I actually went to the site http://www.wittersphere.info/YM40/53/1338/710177.1/4/13295/1600293/3O80?gy=?qqu06/vc/ld-99505.g78 (tested with a safe browser, but it doesn’t actually seem to be feeding malware) it turned out to be the “International Association of Successful Individuals.”  Therefore, I don’t qualify, but no doubt a number of you do, so I’m letting you know  :-)

Amex clueless about security–so what else is new?

American Express is, as far as I know, alone among major financial institutions (for large values of “major”) in sending out phish-like messages.  Pretty much every other bank has gotten the message: don’t send email to your customers, and alert them that if they receive email, it’s not from you.

(I’m still getting those messages, by the way.  Ironically, it’s because I don’t want them.  If I want to tell Amex to turn them off, the only way I can do that is to register to receive them.  Explain to me the logic underlying that process …)

Amex is also alone in not providing an email account to which you can send phishing messages.  I guess Amex doesn’t want to do any more takedowns than they absolutely have to.

As a security pro, I’ve got contacts; personal contacts; in many major banks and financial institutions.  These are people who work in phishing and malware takedowns, and I’ve encountered them in the course of my research into same over the years.  I’ve never come across anyone from Amex.  I’ve never had anyone from Amex in any of my seminars.

So, it is no great surprise that when a researcher recently found a gaping hole in Amex security, he had a very hard time letting Amex know about it.

RSA APT thoughts

By now people are starting to hear that RSA has been hit with an attack.  Reports are vague at best, and we have very little idea how this may affect RSA customers and security in general.  But I’d like to opine about a few points.

First, we, in the profession of information security, are still not taking malware seriously enough.  Oh, sure, most people are running antivirus software.  But we don’t really study and understand the topic.  Malware gets extremely short shrift in any general security textbook.  Sometimes it isn’t mentioned at all.  Sometimes the descriptions are still based on those long-ago days when boot-sector infectors ruled the earth.  (Interesting to see that they are coming back again, in the form of Autorun and Autoplay, but that’s simply another aspect of Slade’s Law of Computer History.)  Malware has gradually grown from an almost academic issue to a pervasive presence in the computing environment.  It’s the boiling frog situation: the rise in threat has been gradual enough that we haven’t noticed it.

Second, we aren’t taking security awareness seriously enough.  These types of attacks rely primarily on social engineering and malware.  Security awareness works marvelously well as a protection against both.  RSA is a security corporation: they’ve got all kinds of smart people who know about security.  But they’ve also got lots of admin and marketing people who haven’t been given basic training in the security front lines.  For a number of years I have been promoting the idea that corporations should be providing security awareness training.  Not just to their employees, but to the general public.  For free.  I propose that this is not just a gesture of goodwill or advertising for the companies, but that it actually helps to improve their overall security.  In the modern computing (and interconnected communications) environment, making sure somebody else knows more about security means that there is less chance that you are going to be hit.

(Third, I really hate that “APT” term.  “Advanced Persistent Threat” is pretty meaningless, and actually hides what is going on.  Yes, I know that it is embarrassing to have to admit that you have been tricked by social engineering [which is, itself, only a fancy word for “lying”] and tricked badly enough that somebody actually got you to run a virus or trojan on yourself.  It’s so last millennium.  But it’s the truth, and dressing it up in a stylish new term doesn’t make it any less so.)

IEEE eCrime Researchers Summit 2010

The fifth IEEE eCrime Researchers Summit 2010 (http://ecrimeresearch.org) will be held in conjunction with the 2010 APWG General Meeting between October 18-20, 2010 at Southern Methodist University in Dallas, TX.

Topics of interest include:

* Phishing, rogue-AV, pharming, click-fraud, crimeware, extortion and emerging attacks.
* Technical, legal, political, social and psychological aspects of fraud and fraud prevention.
* Malware, botnets, ecriminal/phishing gangs and collaboration, or money laundering.
* Techniques to assess the risks and yields of attacks and the success rates of countermeasures.
* Delivery techniques, including spam, voice mail and rank manipulation; and countermeasures.
* Spoofing of different types, and applications to fraud.
* Techniques to avoid detection, tracking and takedown; and ways to block such techniques.
* Honeypot design, data mining, and forensic aspects of fraud prevention.
* Design and evaluation of user interfaces in the context of fraud and network security.
* Best practices related to digital forensics tools and techniques, investigative procedures, and evidence acquisition, handling and preservation.

Important dates: (11:59pm US EDT)
Full paper and RIP (Research in Progress) paper submissions due: June 30, 2010
Paper notification: Aug 1, 2010
Poster submissions due: August 29, 2010
Poster notifications: September 5, 2010
Conference: October 18-20, 2010
Camera ready due: October 27, 2010

For more information on the submission process, visit
http://www.ecrimeresearch.org/2010/cfp.html