Encyclopedia of Computer Science and Technology

370 phishing and spoofing“Phishing” messages such as this fake IRS e-mail try to trick usersinto clicking on links to equally bogus Web sites that can steal personalinformation or infect computers with viruses.This all-too-common scenario is called “phishing,”alluding to “fishing” for unwary users with various sorts ofbait, with the f changed to ph in keeping with traditionalhacker practice. Phishing is similar to other techniques formanipulating people through deception, fear, or greed thathackers often refer to as “social engineering.” Unlike oneon-oneapproaches, however, phishing relies on the abilityto send large quantities of e-mail at virtually no cost (seespam), the availability of simple techniques for disguisingboth e-mail addresses and Web addresses (URLs), and theease with which the appearance of a Web site can be convincinglyreplicated.Although e-mail is the most common “hook” for phishing,any form of communication, including text or instantmessages, can be used. Recently sites such as MySpace havebecome targets for automated phishing expeditions thatchanged links on pages to point to fraudulent sites (seesocial networking).Defenses and CountermeasuresWary users have a number of ways to reduce their chance ofbeing “phished.” Some signs of bogus messages include:• The message is addressed generically (“dear PayPaluser”) or to the user’s e-mail address rather than theaccount name.• The text of the message contains spelling errors orpoor grammar.• The URL shown for a link in the message (perhaps viaa “tool tip”) does not match the institution’s real Webaddress.There are even interactive games such as “Anti-PhishingPhil” that users can play to test their ability to detect phishingattempts.Unfortunately, modern phishers are becoming increasinglysophisticated. Some phishing messages can be personalized,using the target’s actual name. URLs can bedisguised so that discrepancies do not appear. When indoubt, the safest thing to do is always to access the institutionby typing (not copying) its name directly in the Webbrowser rather than clicking on a link in e-mail. (In a practicecalled “pharming,” a legitimate Web site can in effectbe hijacked so that normal user accesses will be divertedto the fraudulent site. Users have no real defense againstpharming; this is a matter for security professionals at therelevant Web sites.)Fortunately there are ways in which software can helpdetect and block most phishing attempts. A good spam filteris the first line of defense and can block many phishing messagesfrom getting to the user in the first place. Anti-phishingfeatures are also increasingly included in Web browsers,or available as plug-ins. Thus “blacklists” of known phishingsites can be checked in real time and warnings given, orthe site’s address can be blocked from access by the system.Web sites can also introduce an added layer of security:Bank of America, for example, asks users to select and labelone of several images offered by the bank. The image andlabel are subsequent displayed as part of the log-in process.If the user does not see the image and the user’s label, thenthe site is presumably not the real bank site.Legislative ResponsePhishing has been one of the fastest-growing types of onlinecrime in recent years (see computer crime and securityand online frauds and scams). By mid-2007 the Anti-Phishing Working Group (an association of financial institutionsand businesses) was reporting the appearance ofmore than 30,000 new phishing sites per month (the largestnumber operating from China), though a site typically staysonline for only a few days. Phishing contributed significantlyto the $49 billion cost of identity theft in 2006 as estimatedby Javelin Research. Further, industry surveys havesuggested that phishing has aroused considerable consumerconcern, slowing down the adoption or continued use ofsome financial services (see banking and computers).In response to this growing concern, the U.S. FederalTrade Commission filed its first civil suit against a suspectedphisher in 2004. The United States and other countrieshave also arrested phishing suspects, generally undersome form of wire fraud statute. Starting in 2004, antiphishingbills have been introduced in Congress, thoughnone had passed as of 2007. However, the CAN-SPAM Actof 2003 was used in 2007 to convict a defendant accusedof sending thousands of phishing e-mails purporting to befrom America Online (AOL). Many states have also introducedanti-phishing legislation.Further ReadingAnti-Phishing Working Group. Available online. URL: http://www.antiphishing.org/. Accessed November 6, 2007.