Christopher Herot's Weblog

More Phishing

Shortly after writing yesterday's post on SiteKey I received two emails that claimed to be from Bank of America encouraging me to click on a link to "enroll in the SiteKey security upgrade."  The fraudsters that composed this particular email seemed to have made a limited effort to understand American corporate practices, since they wrote every instance of the bank's name as Bank of America® even though a cursory analysis of the legitimate BofA site would reveal that the bank does not festoon its name with the "®" symbol.

The headers visible in Outlook were:
    To: chris
    Cc: chris; chris; chris
which hardly seems like BofA practice.  A more detailed inspection revealed that the message had come from a Time-Warner cable subscriber, no doubt someone who's machine had been turned into a zombie and was spewing these things all over the country.

The "click here" link obscured the real target, although Outlook helpfully showed it in a tooltip as 31c5f18a7f.com, a domain in China registered to

XIN NET TECHNOLOGY CORPORATION
Administrative Contact:
ah wen
No.12 chang'an road
beijing Beijing 100001
China
tel: 86 010 20940294
fax: 86 010 24092049
[email protected]

I'll give Internet Explorer good marks for recognizing this as a phishing site, although the site already appears to be off the air.

PhishTank (Out of the Net, into the Tank) does have a screen shot what was there, which is a page that asks for so much information that it is bound to make most people suspicious: Online ID, Passcode, Location where the account was opened, Social Security Number, ATM Card Number, etc., etc.   One  wonders how many  people they would have tricked had they been a little less obvious.

Phishing

My father recently got his own email account and is still in that halcyon period before all the spammers have captured his email address.  Thus he was concerned when he got an email that appeared to be from PayPal warning him that his account had been compromised.  Never mind that he doesn't have a PayPal account, or that my PhD mother (who's been on the Internet since it was invented) told him to delete it.  He had to check with his son who has the graduate degree in computer science.  It turns out that he's hardly alone.  A paper in the 2006 CHI conference revealed that in a sample of 22 university students, good phishing sites fooled 90% of the participants.  (thanks to danah boyd for the link.)  It turns out that a quarter of them ignored all the security features in the browser chrome, such as the cute little padlock.  A full 15 out of 22 clicked through the SSL bad-certificate warning without hesitation.  Many relied on how sophisticated the site looked, similar to the way people used to evaluate the legitimacy of a business card or letterhead back in the day before everyone had word processing and laser printers.  The most effective strategy turned out to be taking a skeptical attitude about the email linking to the web site, although this could be fooled by an attacker who data-mined a social network to find plausible looking senders to spoof.

One technique that was promising for a brief moment was the PassMark (now RSA) SiteKey used by Bank of America.  This mechanism asks the user to select a distinctive image which will be displayed at login time.  Since this is a shared secret, and is displayed prominently in the content area, the user can use it to verify that he or she is connected to the real site.  The bank tried to prevent a man-in-the-middle attack by using some heuristics such as IP address to see if the request is coming from a known source.  If not, it first presents a challenge question.  Doug Ross points out that a phishing "false storefront" site could still pass this challenge question on to the user and then send the answer to the bank.  Ross suggests that the bank site display an "anti-fraud checklist" which should display such items as the users location (derived from the IP address) and some innocuous shared secret such as the most recent check number.  If these items were displayed as an image and the format was randomly changed, it would be difficult for the bad guys to screen scrape and pretend to be a legitimate user.

All of this will probably seem like to much trouble for the bank and the user alike, at least until such time as the occurrence of a well-publicized and large scale phishing attack.  In the meantime, any email that attempts to directly transact business should be viewed with extreme suspicion.