untangling_the_web

DOCID: 4046925
UNCLASSIFIEDliliOft OFflOIl8tL I:JSE ONbY
Don't Become "Phish" Food
While "phishing" (or carding) is a scam that has been around for years, it has
become an enormous problem recently. Phishing is the use of "spoofed" emails and
fraudulent websites that appear to be authentic emails from and links to legitimate
company websites designed to lure an unsuspecting user to a fake website where
the user will be prompted to enter personal information. Phishing emails have tricked
many hapless customers of reputable companies into providing personal data, such
as user names, passwords, account numbers, social security numbers, etc. How
does phishing succeed? These particular kinds of scam emails, which are criminal in
nature, are very professional-looking and use the real companies' logos and, so it
seems, web addresses to lure a user to a fraudulent website. Phishing attacks
sometimes employ very convincing image spam to trick users. Even the link looks
valid to the average user. Phishers are reportedly able to convince up to five percent
of recipients to respond to them, and it doesn't take many successful phishing
scams to pay big dividends for the criminals behind them.
One celebrated case of phishing involved Citibank. Here's how it worked. Let's say
you are a Citibank customer and you get an email "from Citibank" (the email has the
Citibank logo and looks as though it came from Citibank). One of the numerous fake
Citibank emails says, "We encountered a billing error when attempting to renew your
Citibank online banking services." The email then goes on to detail member
information from the "Citibank" database and says, "Please take a moment to update
your credit card information by clicking here and submitting your information." The
email ends with the warning that if you do not take this action, "your service will be
terminated!"
On the face of it, the "Citibank" link in the email may look completely legitimate:
https:llwww.citibank.com/s(gnin/citifilscripts/user_setup.jsp
However, such links are fake. If the user "mouses over" (moves the mouse over) the
link, he will see this:
http://www.citibank.com:ac=8tcBs829uY3T23ue76Hg@FaStWay2StUlpqwrCh7L09j
Now this link might be legitimate, too, except that everything between the http:// and
the at sign (@) in this uri is irrelevant, so the real uri in this link is what follows the at
sign. Not exactly a Citibank website!
As consumers became more cautious and aware of these scams, new "bait"
appeared in phishing scams that can fool even savvy Internet users. This attack
uses a custom JavaScript to replace the Address or Location bar at the top of a web
550 UNCLASSIFIEDHFOR OFflell8tL tlSE ONLY