National Threat Assessment 2008. Organised Crime - Politie

takes them to a counterfeit website where they are asked to enter personal
information. Potential victims are approached in an increasingly personal manner
(spear phishing). The risk of discovery is smaller with this type of targeted attack.
Security packages do not recognise these emails as phishing emails and the
personal nature of the message makes victims less suspicious.
In cases of pharming, victims who contact an institution or company online are
secretly redirected to a counterfeit version of the website of that institution or
company. They are then asked for personal details. The redirection is caused by
‘malware’ (which is a contraction of ‘malicious software’) with which the victim’s
computer is infected. Victims arrive at the wrong sites because the links used
for looking up domain names have been changed by malware.
Phishing with malware without using counterfeit web pages is called ‘spy
phishing’. In spy phishing the behaviour of computer users is spied on. For
example, ‘key loggers’ are used to record key strokes, which are then sent to the
fraudsters. Infection with malware not only for spy phishing, but also for pharming,
is primarily achieved through email messages, website visits, the downloading of
software, the use of search engines and the use of Instant Messaging.
The development of phishing techniques has not stopped in the past two years.
Two trends that have developed are ‘phishing by proxy’ and ‘man-in-the-middle
phishing’. ‘Phishing by proxy’ is aimed at hiding the actual location of the
phishing website and to keep it up and running for as long as possible. In this
phishing technique ‘botnets’ 68 are used as proxy servers. Large numbers of IP
addresses are linked to a phishing URL and therefore form an intermediate step
en route to the counterfeit website. As a result, having these sites blocked and
tracking down the offenders is a highly complex operation.
Man-in-the-middle phishing also makes it possible for phishers to gain access
to websites that are secured by two-factor authentication. In two-factor
authentication a second code is entered after the login details; this second code
is often generated per transaction. As a result, this method is safer than using
a single password. A man-in-the-middle attack allows phishers to intercept the
second code. After using the details for their own criminal purposes, the
phishers send the details on to the customer, which makes it seem to the
customer that the order has arrived in the usual manner.
68
A ‘botnet’ is a robot network, which is a collection of infected computers that are remotely
controlled by Internet criminals. Botnets can be used, for example, to send phishing emails
or to infect other computers.
196 National Threat Assessment 2008 – Organised crime