Phishing and Fraud Prevention Resources

APWG Report: What to do if your web site is hacked by phishers

I co-authored this report with Suzy Clarke of ASB Bank to serve as a reference guide for any web site owner or operator who suspects, discovers, or receives notification that it's web site is being used to host a phishing site. The report explains important incident response measures to take in the areas of identification, notification, containment, recovery, restoration and follow-up when an attack is suspected or confirmed.

The report provides a framework for response and highlights key actions for each stage of incident response. We do not attempt to provide an exhaustive list of actions but offer sufficient examples for seasoned web operators whilst not overwhelming readers who are less familiar with (and hence more vulnerable) to incident response following web attacks. More...

Phlavors of Phishing

Some of you no doubt recall your own awe and anticipation when presented with the opportunity to choose from 31 flavors of Baskin Robbins ice cream! Fifty years later, and I feel only angst and trepidation when I confront the imposing numbers of phlavors of phishing.

Phishing is commonly associated with financial scams and identity theft. As I scanned nearly six months of mail posted to an antiphishing list, I noticed how broad the phishing reach has extended. More...

Recognizing and responding to spoof email messages

Even the best of antispam measures may not be enough to protect you from spoof email messages. By spoof email, I mean a message that appears to be from a party you know - most commonly, an ecommerce site, financial institution, even your IT department - but in fact, is a bogus message, with a malicious intent. More...

Anti-phishing measure: User Behavior Modification

Recently, a fellow security professional asked if he could use some of my anti-phishing material in a presentation he was preparing for an upcoming CSI conference. Revisiting the presentation I gave at IPComm 2004, I recalled (and related) a dialog I had with an attendee about an interesting behavior modification program.

More...

Making Waves in the Phishers' Safest Harbors

Rod Rasmussen and I collaborated to publish an APWG Advisory that describes how phishers use subdomain registries to provide safe harbors for malicious and criminal activities. A subdomain registry is a naming service web hosting providers offer to customers. The provider allows customers to register a subdomain from one of its own registered domains as part of a hosting service package. Customers to choose a label (name) from the parent domain. For example, if the web hosting company has registered the domain freewebhosting.com, a customer could register Paypal.freewebhosting.com, BankofAmerica.freewebhosting.com... But wait, those names infringe on a brand! And couldn't someone use such a site to impersonate a brand and phish for accounts from such a site? More...

A simple test to detect a phishing or scam site

Suppose you attempt to to purchase a product with a credit card on a site you've never visited before. You find the product you want, add it to your cart, and proceed to checkout. You connect with HTTPS:// for that warm and comfy feeling everyone gets when they begin a *secure transaction*,-) But - oh my! - your browser warns you that some aspect of the certificate is suspicious. You are now faced with several choices. More...

Anatomy of a Phishing Expedition

Phishing is a serious problem, but it really is an ailment we can manage with education rather than technology. I've written a complementary article to my LOOP article, Recognizing and responding to spoof email messages.

The Wordspy defines phishing as, "Creating a replica of an existing Web page to fool a user into submitting personal, financial, or password data". A phishing expedition is a two-pronged attack. First, the phisher creates a spoof email message: posing as a legitimate e-merchant operator, the phisher tries to lure a victim into visiting a web page. More...

Do you trust your online banking home page?

More precisely, has your bank made it impossible for you to do so? After reading Adam Shostack's blog item at Emergent Chaos, How not to train users, and following the thread begun by Peter Gutmann on the Cryptography mailing list, US Banks: Training the next generation of phishing victims, I wonder once again why we always sacrifice security for performance.More...

Care and Handling of Credit and Personal Information

Despite the real and present dangers Internet Identity Thefts, Phishing and email scam attacks pose, we cannot afford to overlook measures we can take to protect our identities and credit from attacks in the real (physical) world.

Financial institutions, law enforcement agencies and attorneys recommend a number of ways you can protect against credit card theft and misuse, check fraud, and unintentional disclosure of personal information that can be used by impersonators, extortionists and other malicious or malevolent persons. More...