Article Navigation

Click Here for more articles

Why Corporations Need to Worry About Phishing

by: Paul Judge, CTO, CipherTrust, Inc.

Phishing is a relatively new form of online fraud that focuses on fooling the victim into providing sensitive financial or personal information to a bogus website that bears a significant resemblance to a tried and true online brand. Typically, the victim provides information into a form on the imposter site, which then relays the information to the fraudster.

To view examples of phishing emails go to:
* Citibank: www.ciphertrust.com/images/example_citibank.gif
* US Bank: www.ciphertrust.com/images/example_usbank.gif

Although this form of fraud is relatively new, its prevalence is exploding. From November 2003 to May 2004, Phishing attacks increased by 4000%. Compounding the issue of increasing volume, response rates for phishing attacks are disturbingly high, sometimes as high as 5%, and are most effective against new internet users who are less sophisticated about spotting potential fraud in their inbox.

Corporations should be concerned with the following four issues:
* Protecting employees from fraud
* Reassuring and educating customers
* Protecting their brand
* Preventing network intrusions and dissemination of trade secrets

A failure to succeed in any of these areas could be catastrophic to a company�s ability to function in the marketplace. If employees are not protected, the company could be held accountable for not putting protections in place to prevent fraud. If a hacker impersonates a company, then the company�s reputation and brand may be tarnished or ruined because customers feel that they can no longer trust the organization with their sensitive information. And finally, the latest trend in phishing has been to socially engineer employees or business partners to divulge sensitive trade secrets to hackers. The implications of employee login information getting into the wrong hands could result in grave consequences once hackers are able to �log in� to an employee�s network account using VPN or PC Anywhere software.

Protecting Employees from Phishing
One of the best ways to protect employees from Phishing is to prevent spam from ever getting to the user�s inbox. Since most phishing attacks proliferate through unsolicited e-mail, spam filtering technologies can be very effective at preventing the majority of phishing attempts.

New technologies are also available to help prevent phishing. One such technology offered as a standard by Microsoft and supported by CipherTrust is the Sender ID Framework (SIDF), which prevents spammers from obfuscating their IP address by verifying the source of each email.

Of course, spam filtering and SIDF cannot solve the problem entirely. Many phishing attacks are actually sent on an individual basis to users not protected by cutting edge spam detection technologies. Other attacks are distributed through online email accounts such as Yahoo! Mail, Gmail, MSN, and others. In short, technology alone cannot solve the phishing problem. Employees must be educated about phishing and how to spot fraudulent emails and websites.

Reassuring and Educating Customers
Once a consumer receives a fraudulent email that appears to come from a trusted company, he or she may never trust that company�s email communications again. That is damage that is not easily undone. It is essential that organizations communicate openly and frequently about how customers can identify legitimate email communications, and the need to report fraudulent ones. For those organizations that frequently process consumer credit card transactions, it is recommended that a special section of the site be devoted to helping customers avoid fraud.

Companies that make efforts to educate their customers about phishing are much less attractive targets than those who make no efforts at all. Some examples of organizations that have developed extensive policies around this issue are:
* USBank
* Wells Fargo Bank
* Ebay and PayPal
* Citibank

Protecting the Company Brand
Each time a phishing attack is launched, a legitimate company�s trademark is tarnished and brand equity is eroded. The more attacks a company suffers, the less consumers feel they can trust the company�s legitimate email communications or websites. The value of this trust is difficult to quantify � at least until a company begins to lose customers. When customers no longer trust the company�s ability to protect their personal information, they often defect to competitors or opt to use more expensive commercial options such as telesales or retail locations.

Clearly, the goal is to convince the fraudsters that your customers will not fall for the scam. This is why having an obvious anti-phishing program that is public for all to see can be very effective. The fraudsters tend to follow the path of least resistance. Seeing that customers are well informed of how to avoid phishing attacks, the perpetrators simply turn their attention to other �softer� targets.

Preventing Network Intrusions and Dissemination of Trade Secrets
Employees must be educated not only about phishing generally, but also about how fraudsters might use social engineering and other methods to entice employees to divulge sensitive information to hackers outside the organization.

With little knowledge of an organization�s business methods, hackers can easily distribute hundreds or even thousands of spoofed messages to an organization�s employees. The messages may ask for network passwords and usernames, or may attempt to fool employees into providing sensitive information to competitors.

It is important to properly train employees about what information is appropriate to share through email, and specifically what steps employees should take if they are unsure about the authenticity of a request for information.

Information gleaned by fraudsters from corporate networks can be used in a variety of nefarious ways. In the financial services industry, criminals can use credit cards to deduct money straight from accounts of unsuspecting victims. Many other organizations hold private healthcare information, or personal financial information that could be used by criminals to extort payoffs from corporations wishing to avoid the bad publicity of a security breach becoming public knowledge.

Though deflecting this attack does involve a significant amount of education, providing content filtering on outbound e-mail traffic can flag suspicious communications. Looking for these regular expressions, like social security numbers and account numbers, can prevent a simple deception from becoming a major liability issue.

What to Do If You Are the Victim of a Phishing Scam
If you become aware of fraudsters imitating your organization to commit phishing fraud, you should:

* Immediately educate your customers on how they can correctly identify the phish
* Notify the authorities of your situation. Phishing Fraudsters may have violated all or some of the following Federal Laws:
-- 18 U.S.C. 1028(a)(7) � Identity Theft
-- 18 U.S.C. 1343 � Wire Fraud
-- 18 U.S.C. 1029 � Credit-card Fraud
-- 18 U.S.C. 1344 � Bank Fraud
-- 18 U.S.C. 1030 (a)(4) � Computer Fraud
-- 18 U.S.C. 1037 � CAN-SPAM Act
-- 18 U.S.C. 1028(a)(5) � Damage to computer systems and files
* Prosecute the criminals � when Spammers use your trademarks to commit fraud, they are violating U.S. Trademark laws as well as anti-fraud laws. Your organization has the right to defend its mark in court.

If you find that you are personally the victim of a phishing scam, then you should identify what information was compromised and then:

* If the fraudster obtained your Bank Account, Credit, ATM or Debit Card information:
-- Report the theft to your card issuer, and cancel the account
-- Check your statements for any unauthorized charges and follow up with your financial institution regarding their procedures for minimizing your liability to the charges

* If the fraudster has obtained your personal identification information
-- Contact the credit reporting agencies:
* Experian
* Equifax
* Trans Union
-- Request that a fraud alert be placed on your record
-- Request a copy of your credit report and follow up on any unauthorized credit inquiries
-- Request that unauthorized credit inquiries be erased from your record
-- Notify your bank of potential fraud
-- File a police report with your local police department
-- File a report with the Social Security Administration
-- Notify the Department of Motor Vehicles and determine if an unauthorized driver�s license number has been issued in your name
-- Notify the Federal Trade Commission (www.ftc.gov)
-- File a complaint with the Internet Fraud Complaint Center (www.ifccfbi.gov/index.asp). Additional Internet Fraud Sites:
* www.cybercrime.gov
* www.consumer.gov/idtheft/
* www.identity-theft-help.us/
* www.identitytheft.org/
* www.usdoj.gov/criminal/fraud/idtheft.html
* www.usdoj.gov/criminal/fraud/idquiz.html
* www.ifccfbi.gov/index.asp

About the author:

Dr. Paul Judge is a noted scholar and entrepreneur. He is Chief Technology Officer at CipherTrust, the industry's largest provider of enterprise email security. The company�s flagship product, IronMail provides a best of breed defense against phishing attacks and other email-based threats. Learn more by visiting www.ciphertrust.com today.

Circulated by Article Emporium

Read Articles:

11 Proven Methods For Maximizing Your...
What Is Spyware - An Overview Of Spy ...
The 10 Most Important Questions To As...
9 Steps to Protect your MS Windows Sy...
The Top Twelve Threats No Computer Us...
Tops in toolbars?
Does Your PC Have Worms?
So, Is It Possible To Earn Free Money...
How to protect yourself from online a...
The email blues
Tiscali Broadband
Anatomy Of A Reciprocal Linking Campaign
Do I Need an RSS Feed?
Banned By Google And Back Again.
My Top 10 Favorite Internet Tools
5 Good Reasons For Using Yahoogroups ...
What�s with all this fraud and theft ...
Predicting The Future Online
Amazing Explosive Ways To Turbo-Boost...
Are You A Spam Zombie?
What are the best strategies or ideas...
5 Linking Strategies that Work
The Money Keyword List - Superchrage ...
Honesty and the Internet
Simple Identity Theft Prevention
Niche Software Steals Microsoft's Thu...
Web Summary Authoring
The End of Spyware?
7 Great Tips on Driving Targeted Traf...
Your computer is infected with Spywar...
Increase in Customer Sales = Increase...
How to Avoid Problems and Errors of S...
Why offline advertising is so importa...
Keeping your pc healthy at little or ...
Finding An Internet Access Provider T...
5 Ways To Drive Visitors Away From Yo...
Internet ISP's
Spyware: What It Is and How to Combat...
Top 10 Tips for WinXP Users
How to Choose a Web Hosting Company?
Take back control of your inbox. Elim...
Malware: Computing's Dirty Dozen
Money Doubler Madness
M-Commerce Twice the Cash Value of E-...
Understanding the power of viral mark...
How To Use Spyware Elimination Software
Are Surf For Money Ventures For You?
BT Internet Broadband
Search Engine Placement - Most Overlo...
Simple Search Engine Optimization
Adware And The Case Against Bundled S...
An quick guide in Payment Processing ...
What is the Robot Text File?
Search Engine Optimization History
Reclaim Your PC from the Internet Spies
SEO And The Outsourcing Of Inbound Li...
Top Paying Keywords: How to Increase ...
Creating Online Communities
Professional Traffic Building Tips
Internet Scams 101 -- Attacking You T...
Uncle Sam Cracks Down Online!
What are doorway pages?
IT Support Services in London
5 Tips For An Unbreakable Password
Building Links To Your Site
Spyware Protection - The Only Way To ...
Registry Cleaner: Protection for Your PC
Shocking Facts about Updating Your PC...
Buying a laptop that you can use as a...
What To Look For In A Web Host

More Article Pages 1 - 2 - 3

Winning the War On Spam

For years I didn't worry much about spam.

But lately it's got out of control. Over half of my email is now spam, and it was growing by the week - until I took action.

This article shows you some strategies for winning the war on spam.

------------------------------------------------

How Do They Get Your Address?

------------------------------------------------

In the old days, spammers got their addresses mainly from Newsgroups - if you didn't post to Newsgroups, you were reasonably safe. But they're now using a much more efficient method to build their lists - email harvesters.

Email harvesters are robots that roam the Internet collecting email addresses from web pages. Examples are EmailSiphon, Cherry Picker, Web Weasel, Web Bandit and Email Wolf, to name just a few.

How can you protect yourself from email harvesters?

By 'munging' (mung = 'mash until no good') or cloaking your email address.

There are many ways of munging your address - the easiest technique is to use ASCII code for the punctuation in your email address (instead of symbols).

For the colon after mailto use : and for the @ symbol use @ and for the period use . . With this method, your email address would become:

mailto:yourname@yourdomain.com

but it will display as:

mailto:yourname@yourdomain.com

Your email address will appear exactly as it did before, and it will still be 'clickable', but email harvesters will ignore it and move on.

There are also JavaScript's that you can insert into your web page that will make your email address visible to humans but invisible to harvesting programs. Here's one that works very well: http://pointlessprocess.com/JavaScripts/anti-spam.htm

-----------------------------

How To Fight Spam

-----------------------------

The most important thing is never, ever, reply to spam.

Most spam contains an innocent-looking 'remove me' email address. Do not use it. Here's why:

Spammers typically buy a CD containing a million or so email addresses, but they have no idea how many of those addresses are active. So before beginning their marketing campaign in earnest, they send out a 'test message' to the entire list.

The test message contains an email address for removing yourself. When you reply to that address, it confirms to the spammer that your address is active and therefore worth spamming.

Worse still, the spammer may be distilling from that CD a list of confirmed active addresses that he will then sell to another spammer.

The key to dealing with spam is to report it to a 3rd party: (1) the affiliate program that the spammer is advertising, (2) the spammer's web host, or (3) the ISP the spammer used to connect to the Internet.

When you report spam to a 3rd party, remember to be polite - they didn't send the spam and they're probably just as anti-spam as you are.

(1) Reporting to Affiliate Programs

Many spammers are affiliates advertising someone else's products or services. So look for a website address that contains an affiliate link, something like this: www.affiliateprogramdomain/841526

Then just send an email to the affiliate program (abuse@affiliateprogramdomain.com), informing them that you are receiving spam from one of their affiliates.

Most affiliate programs have zero tolerance for spamming and will remove an affiliate spammer without warning.

Now, affiliate spammers don't want you to see their affiliate link, so many of them send their email as HTML. All you see in the message are the words 'Click Here and Order Now'.

But in your browser just click on 'View Source Code' and search for the letters 'http'. That will take you to the spammer's affiliate link.

(2) Reporting to Web Hosts

If the spam doesn't contain an affiliate link, it's likely that it is coming from the owner of the domain name. In that case you'll have to report it to the spammer's web host or their ISP.

To make a report to the spammer's web host just go to Whois, the directory of registered domain names: http://www.netsol.com/cgi-bin/whois/whois

Type in the spammer's domain (the website address that appears in the spam) together with the extension (.com, .org, .net etc).

The host for that domain will usually be listed as the Technical Contact in the Whois record and there will be an email address for contacting them.

(3) Reporting to ISPs

To report a spammer to his Internet Service Provider, you'll have to look at the spam's 'extended headers'.

Extended headers show the servers that the message passed through in order to get to you. The instructions for viewing extended headers will vary depending on what email client you are using.

=> In Pegasus Mail, open the offending message and then

right-click and choose 'Show raw message data'.

=> In Eudora Light, click on 'Tools' in the top menu

bar, and then 'Options', and then select the

checkbox option that says 'Show all headers (even

the ugly ones)' and click OK.

=> In Outlook Express, open the offending message,

select 'Properties' from the File menu and then

click the 'Details' tab.

Reading and understanding extended headers is quite a detailed subject. Here's an excellent free tutorial on how to decipher extended headers: http://www.doughnut.demon.co.uk/SpamTracking101.html

As an alternative to these reporting techniques, you could use a web-based spam reporting service such as SpamCop (www.spamcop.net). SpamCop deciphers the spam's message headers and traces the mail back to its source.

Wishing you every success in the fight against spam!

------------------------------------------------------------
Michael Southon has been writing for the Internet for over 3
years. He has shown hundreds of webmasters how to use this
simple technique to build a successful online business. Click
here to find out more: http://ezine-writer.com/
------------------------------------------------------------

This Static Spot is open for sponsor

This Static Spot is open for sponsor

Winning the War On Spam