Posts with keyword: phishing

3 entries

SMS Phishing Attack

Fri Feb 20 08:45:00 2009

Image by Chaddycakes via Flickr I received several texts this morning, allegedly from my bank that said: FRM: FARWESTBANK MSG: Urgent Far West Bank message AUTHORIZATION. To verify call TOOL FREE 8662249038. Being the curious sort, I called and played around with it. The system was an IVR that asked for credit card information (all of it). I recorded the call so you can listen too. Click here for the MP3 file. The places with low audio are me typing my responses. Of course, I didn't give it a real credit card number but I did give it a
Continue reading {SMS Phishing Attack}

Man In the Browser Attack

Wed Feb 21 15:08:00 2007

Russ Jones, a professor at Arkansas State University gave a presentation on phishing and mentioned a term I'd not heard before the "man-in-the-browser attack." The idea is to install a trojan on the browser that presents a small, borderless window in the browser that overlays the login fields of the target site in a way that can't be detected by the user. The user is at the real site (so the cert will check out), but the credentials are stolen when the user tries to login. Here's a paper that describes the attack and some potential countermeasures.
Continue reading {Man In the Browser Attack}

Security Indicators Are Largely Ignored

Tue Feb 6 18:19:00 2007

A paper to be presented at the IEEE Symposium on Security and Privacy in May called "The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies" (PDF) shows that users largely ignore security indicators like whether a site is using HTTPS, customer-selected images, and even warning pages. I believe a large part of the problem is inconsistent user experiences. For example, if you go to a Web site and picture you selected to indicate that this site is real isn't there for some reason, most people would just assume that
Continue reading {Security Indicators Are Largely Ignored}