Another DNS-level strategy that appeared early this year is the use of wildcard DNSto construct URLs that convincingly mimick the legitimate sites of banks. This technique, combined with numerous redirects, was used in a sustained attack on Barclays in March.
Still more trickery with DNS: Botnets controlled by fraudsters began hiding their DNS nameservers on compromised computers, complicating the task of shutting down malicious sites. The technique can keep phishing sites accessible longer by making the nameservers a moving target, shifting amongst thousands of compromised machines within a bot network.
Cross-site scripting, while not a new technique, continues to be an effective strategy for skilled attackers. Cross-site scripting (XSS) is a well known technique which involves injecting the text of code to be executed by the browser into urls that generate dynamic pages. Despite widespread attention to the phishing threat, several bank web sites were successfully targeted by these attacks in 2005, including SunTrust and Citizens Bank. Several phishing scams also were able to use cross-frame scripting to inject a spoofed data collector page into a bank’s official site, taking advantage of frame-based layout that allowed the display of outside content.
Phishing scams also developed strategies to evade detection by content filters on e-mail and proxy servers, which can detect and block sites masquerading as popular phishing targets such as Paypal. An example is phishing e-mails using images to display text that includes terms that might be caught by filters.
At mid-year we also saw an increase in phishing attacks that eliminated the spoofed web page altogether, with data collection forms embedded directly in the HTML “bait” HTML e-mails. The technique eliminates a step in the process, allowing phishing scams to steal sensitive information without constructing an elaborate fraudulent web site. The HTML form within the email lets phishers set the destination email address, allowing for easy re-routing of submissions as mailboxes are shut down.
What can we help you find?
Still can't find what you are looking for?
Let's talk. Contact us and a member of our team will reach out to you shortly.
