Twenty-Four Seven Security« Many Internet Consumers Don't Feel Safe | Main | Update Adobe Reader Immediately!!! »
January 04, 2007Frightening New "Man-in-the-Middle" Phishing Scam
A frightening new type of phishing fraud, described recently by Brian Krebs, is being called the “Man-in-the-Middle” scam.
In this instance, an email arrived in an inbox that looked like it was from Amazon and warned that there had been some unauthorized activity on their account. When clicking through the attached link, the browser merely passes through a secondary, man-in-the-middle, proxy site, and then proceeds directly to Amazon’s actual site. This type of scam is actually easier to create than the old type of phishing scam because the scammer has no need to make a duplicate site. Functioning as a proxy, which is like having someone standing behind you and staring over your shoulder, the phisher is able to steal whatever data the user is conned into typing in.
While this scam does have its weaknesses, in that there is no attempt to disguise the fake proxy address with Amazon’s real one in the browser's address bar, its ease of creation and believability means we will be seeing much more of it.
As I wrote in a blog earlier, the simple fact is, any true security solution in the future simply has to perfect real time client and server authentication. Because once we get that, and it's infallible, I simply cannot conceive how phishing could continue to thrive.
Tags: Man-in-the-Middle Phishing, Client Authentication
Tags:
Posted by pschooff in
Phishing
|
Digg This|
Add to del.icio.us
Trackback Pings
TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/1139
Thanks for bringing this to people's attention.
As a result of scams such as this -- and all phishing in general -- email is no longer a credible means of communication between businesses and consumers. Ironically, this is forcing businesses back to using regular paper-based snail mail.
Posted by: Joe McKendrick at January 4, 2007 09:57 PM
Sad to say, Joe, that I agree with you that phishing just might render email totally counterproductive.
I'm trying to think of something comparable, something so useful suddenly rendered useless, and all I can think of is the CB radio, but that was more of a fad, and it's not like everyone swept up in the fad was a trucker dependent on their CB radio.
I'm still hoping the security sector can once again gain the upper hand.
Also, Joe, I want to say how much I enjoy reading your blog, "SOA in Action," and recommend it to everyone. SOA really is the wave of the future, and am excited to see how it develops.
Posted by: Peter Schooff at January 4, 2007 10:32 PM
Post a comment
