Hackers Shifting Their Focus To Pharming

[armjan]

IT departments are engaged in an arms race with hackers: As soon as the former puts security mechanisms in place to thwart attacks, the latter launches new assaults. As corporations and users take steps to reduce phishing, a technique that relies on bulk email, embedded Web links, and bogus Web sites to perpetrate identity theft, hackers are turning their attention to pharming, which exploits security holes in peer-to-peer applications and the Internet's Domain Name Services (DNS).

"Six months ago, hackers were launching pharming attacks more as a proof of concept than for profit," stated Lance Cottrell, president of Anonymizer Inc., a security product supplier. "Since they've proven pharming can be effective, there has been an increase in the level of activity associated with it."

 

How pharming takes place

Pharming can take place in a couple of ways. One form focuses on users' computers and starts when hackers take advantage of the every growing number of peer-to-peer applications to help spyware, a Trojan horse, or a virus slip past a computer's defenses and lodge itself in the background of a PC. The malicious code locates the host files in the computer's operating system and creates an IP address for a criminal's Web site that is designed to look like a legitimate site from a bank or credit card company. When a user types the bank's or credit card company's URL into his or her Web browser, the spyware bypasses a DNS (basically the Internet's white pages) search for the address and inserts the bogus destination. The second form of pharming attacks the DNS system itself, either breaking into a DNS server and inserting a fraudulent address or flooding a server and then diverting traffic to an illegitimate site.

 

After arriving at such a site, an unsuspecting user enters personal data, like credit card numbers, bank account information, or social security identifications. Most people feel comfortable doing this because they have visited the Web sites in the past without any problem. As far as they can tell, nothing out of the ordinary is occurring but they are giving personal information to criminals who are now in a position to steal their identity.

 

Unfortunately as they have honed their craft, pharmers have improved their lure. "The first pharming sites were relatively easy to spot: they were filled with typos, grammatical errors and skewed URLs," noted Richi Jennings, leader of the anti-spam practice at Ferris Research Inc., an email market research firm. "Recently, the attacks have become more difficult to discern because the fraudulent sites closely resemble legitimate Web sites."

 

Pharmers are attacking the weakest points in the security chain. While peer-to-peer applications are more efficient than client/server applications, their ability to open up processing tasks in the background means a hacker can discreetly slip into a computer and change a variety of computer settings. "Hackers have delivered software that will disable a user's virus protection system by having it look for updates on the system rather than a vendor's Web site," said Paul Luehr, vice president and deputy general counsel at Stroz Friedberg, LLC, a consulting firm specializing in computer security.

 

As the Internet evolved from a government sponsored research project into a commercial system, management of the DNS system shifted from government and academic enterprises to commercial companies. "The record keeping methods followed at some of the companies that hand out domain names are not very efficient; users with fake names and addresses often register," said Rich Miller, an analyst with Netcraft Inc., which makes anti-pharming software. That's only if the domain name distributors try to collect minimal information, such as a name and an address, as a new site is registered. Because they feel that publishing it is a violation of the First Amendment, some suppliers won't release the identity of the individuals and the companies. In effect, they make it easier for criminals to avoid prosecution from pharming.

 

Potential problem: DNS management

DNS server management can also be a problem. "Some of the DNS server management firms do not always support the latest versions of security software and thus leave their servers open to attack," stated Anonymizer's Cottrell.

 

Given the holes, it is not surprising that successful pharming attacks have taken place. The Troj Banker A/j worm, seen near the end of 2004, watched for users visiting banking sites and redirected to bogus locations run by pharmers. Other attacks were less harmful. "There have been a few instances where hackers have taken over search engines and redirected unsuspecting users to fraudulent Web sites," said Stroz Friedberg LLC's Luehr. In November 2004, Google Inc. and Amazon.com Inc. users were sent to Med Network Inc., an online pharmacy. In March 2003, a group dubbed the "Freedom Cyber Force Militia" hijacked visitors to the Al-Jazeera Web site and presented them with the message "God Bless Our Troops." Pharming has been viewed as the natural follow-on to phishing, an approach where hackers send users email messages, such as "You need to update your account," include a hyperlink to fix the problem, and then whisk them away to bogus sites where the users inadvertently hand over their personal data. As users have become more aware of phishing and vendors have enhanced their defense mechanisms against it, hackers have looked for another attack mechanism and pharming seems like a viable option.

 

But there are a few differences in the two approaches. "Pharming is a more methodical type of attack than phishing," stated Shawn Eldridge, chairman of the Trusted Electronic Communications Forum (TECF), a vendor consortium examining ways for companies to protect consumers from various online scams. "With pharming, a hacker sends out his work and then waits for the user to enter the link and end up in the wrong site. With phishing, the results are seen rather quickly." As a result, he thinks that two different groups of individuals are conducting the two attacks.

 

Regardless of who is launching the attacks, companies and end users want to take steps to limit their exposure to pharming. In response, vendors have been developing products specifically for it. Anonymizer funnels users onto its network, examines information flows, and creates encrypted paths between users' computers and Web sites. The service protects against pharming attacks by intercepting all browser requests and making sure a page is connected to the proper site before a user sends any personal data.

 

Enhancing a user's browser could also help to thwart attackers. Netcraft offers a browser plug-in that displays geographic information about the site being visited. If a user notices that a mortgage company's site is being supported by a server somewhere in Eastern Europe, he or she can assume the site is illegitimate. Another approach is enhancing browsers so they authenticate the identity of a particular Web site via the public DNS system, an approach that is gaining traction as users try to verify email transactions.

Stronger authentication encouraged

Corporations are also encouraging users to take advantage of stronger authentication techniques. Increasingly, companies are forcing users to rely on encryption techniques, such as those found with Secure Sockets Layer, for all transactions. eBay Inc. and PayPal Inc. have developed toolbars, similar to the Netcraft plug-in, that verify their transactions.

 

In addition to technical advances, companies are adding a few more steps to their authentication processes. Financial institutions have been experimenting with multi-factor authentication where a transaction is not completed until a user calls back and confirms that he or she did in fact moved money from an account. In some cases, banks rely on Simple Message Services and wireless handsets to notify users that money has been transferred from their bank accounts or items added to their credit cards.

 

As the pharming defense mechanisms mature, hackers are working on new attack schemes. "It seems like hackers have been moving to attack the networking layer of Internet connections," concluded Anonymizer's Cottrell. "Once pharming loses its appeal, I anticipate that criminals will shift their focus to routing based attacks. I'm not sure what type of attack they may perfect, but I do expect them to come up something new."

[Nakharar]

Foreign phishers go after Chinese targets

 

As online services grow more popular, so do scams

 

REUTERS

Updated: 10:59 p.m. ET March 28, 2005

 

BEIJING - Chinese consumers are becoming increasingly popular targets of international Internet scammers, or "phishers", hoping to con the country's growing ranks of Web surfers out of their money.

 

Phishing, in which hackers combine spam e-mails with slick imposter Web sites to trick consumers into giving out bank account numbers, passwords and other sensitive information, has emerged as a potent global threat.

 

"China reported 223 fake Web sites last year, a huge increase from only one reported from 2002 to 2003," Xinhua news agency said on Monday.

 

Bank of China and Industrial Commercial Bank of China said in December they had found fake versions of their Web sites. Apparently only one consumer was duped and both banks said they had taken further Internet security precautions.

 

Most of the fake pages had been created by foreign hackers that could manipulate Chinese host servers because they were not backed by up-to-date security software or firewalls, Xinhua said.

 

Nearly 100 million of China's 1.3 billion population were Internet users at the end of 2004. Debit and credit card use and electronic payments are surging in the fast-developing country, making many Chinese perfect prey for phishers.

 

"As e-commerce and online payment services and bank business become more popular, so do these Web site imitations," a centre official was quoted as saying.

 

© Reuters 2005. All rights reserved. Republication or redistribution of Reuters content, including by caching, framing or similar means, is expressly prohibited without the prior written consent of Reuters. Reuters and the Reuters sphere logo are registered trademarks and trademarks of the Reuters group of companies around the world.

[armjan]

china has the second largest internet population right after the U.S.

[Sip]

Pharming and phishers?

 

Next thing you know we'll have to start forming phamilies, getting phat on phudge brownies, and trying to have phun while whatching Phrasier reruns on Phox

[vava]

Pharming and phishers?

 

Next thing you know we'll have to start forming phamilies....

style_images/master/snapback.png

 

phorming phamilies?