Spam Phishing

Information Security Session
October 24, 2005
Bill Eaheart
Network Security Coordinator
DePaul University
What is spam?
 Email advertising for some product or service
 Unsolicited Commercial Email (UCE)
 Electronic version of junk mail
 Not necessarily virus or malware
02/18/22 Information Security 2

How do ‘spammers’ get my email?
 Harvesting WebPages
 Harvesting Newsgroups
 Guessing
 Buying lists from other spammers or companies
 From a mailing list
 By people themselves
 Other ways

Can you limit the amount of spam?
 Don't give your email address out arbitrarily
 Check privacy policies
 Be aware of options selected by default.
 Use filters
 Don't follow links in spam messages
 Disable the automatic downloading of graphics in HTML mail
 Consider opening an additional email account.
 Don't spam other people

What is ‘Phishing’?
 Scam to steal valuable information – Online Fraud
 Attacks use ‘spoofed’ emails and fraudulent websites
 Designed to fool users into divulging personal data –

credit card numbers, user ID’s, passwords and social
security numbers.
 Hijack trusted brands of well-known banks, retailers and

credit card companies
 Anti-Phishing Working Group – Up to 5% success rate

Why is ‘Phishing’ so popular?
 Effective Social Engineering
 Technique for manipulating people to disclose sensitive
information
 People trust information in emails or websites
 Simple for people to disguise email addresses

and location of websites

Gartner Study
 STAMFORD, Conn., June 23, 2005 — Increasing reports of lost
consumer data files and disclosures of unauthorized access to sensitive
personal data are taking a toll on consumers' confidence in online
commerce, according to Gartner Inc., the world's largest technology
research and advisory firm.
A Gartner survey of 5,000 U.S. adults showed that phishing attacks

grew at double-digit rates last year in the United States. In the twelve
months ending in May 2005, an estimated 73 million U.S. adults who
use the Internet said they definitely, or think, they received an average
of more than 50 phishing e-mails in the past year.
2.4 million online consumers report losing money directly because

of the phishing attacks. Of these, approximately 1.2 million
consumers lost $929 million during the year preceding the survey.
Survey participants indicated most of the money stolen was repaid by
banks and credit cards.

How do I spot a Phishing scam?
 Attempt to grab your attention
 Suspicious email
 Can be difficult to tell without research
 Closely resembles website – same graphics

Examples

Examples – Bank of America Phish
 Target: Bank of America customers
 Spoofed Sender: Online Banking Notice<[email protected]>
 Goal: Bank Username/Password and ATM card information
 Visible Link: ‘Sign in to Online Banking’
 www.bankofamerica.com : 171.159.193.173
 Phish site IP Address: 216.119.179.191

Recommended Steps
 Use Caution/Common Sense - Be suspicious of emails asking for sensitive information
 Reputable organizations will not request information through email
 Never respond to an email for personal information
 Never follow the links in an email you suspect might be phishing

 Use a browser to type in the site mentioned in the e-mail
 Check to see if the site has an announcement about phishing attacks targeting it.
 Check to see if the privacy policy of the website has a policy about collecting private
data.
 If you determine that a website is legitimate, make sure it encrypts your data by using
SSL.

How do I report Phishing scams
 Federal Trade Commission
 http://www.consumer.gov/idtheft
 FBI's Internet Fraud Complaint Center

 http://www.ifccfbi.gov/index.asp
 Attacks targeting DePaul University

 [email protected]

Additional Information
 If you think you are a victim to a phishing scam:

 http://www.antiphishing.org/consumer_recs2.html
 Anti-Phishing Work group

 http://www.antiphishing.org/
 Microsoft Video: Phishing and Identity Theft

 http://www.microsoft.com/athome/security/email/phishing/video1.mspx

The End!
Thank you
Any questions
[email protected]

Spam Phishing

Uploaded by

Copyright:

Available Formats

Spam Phishing

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Spam Phishing

Uploaded by

Copyright:

Available Formats

Information Security Session

October 24, 2005

 Unsolicited Commercial Email (UCE)

 Electronic version of junk mail

 Not necessarily virus or malware

02/18/22 Information Security 2

 Buying lists from other spammers or companies

 From a mailing list

02/18/22 Information Security 3

 Check privacy policies

 Be aware of options selected by default.

 Don't follow links in spam messages

 Disable the automatic downloading of graphics in HTML mail

 Consider opening an additional email account.

 Don't spam other people

02/18/22 Information Security 4

 Attacks use ‘spoofed’ emails and fraudulent websites

 Designed to fool users into divulging personal data –

 Hijack trusted brands of well-known banks, retailers and

 Anti-Phishing Working Group – Up to 5% success rate

02/18/22 Information Security 5

 People trust information in emails or websites

 Simple for people to disguise email addresses

02/18/22 Information Security 6

A Gartner survey of 5,000 U.S. adults showed that phishing attacks

2.4 million online consumers report losing money directly because

02/18/22 Information Security 7

 Attempt to grab your attention

 Can be difficult to tell without research

 Closely resembles website – same graphics

02/18/22 Information Security 8

02/18/22 Information Security 9

 Target: Bank of America customers

 Spoofed Sender: Online Banking Notice<[email protected]>

 Goal: Bank Username/Password and ATM card information

 Visible Link: ‘Sign in to Online Banking’

 Phish site IP Address: 216.119.179.191

02/18/22 Information Security 10

 Never respond to an email for personal information

 Never follow the links in an email you suspect might be phishing

02/18/22 Information Security 11

 FBI's Internet Fraud Complaint Center

 Attacks targeting DePaul University

02/18/22 Information Security 12

 If you think you are a victim to a phishing scam:

 Anti-Phishing Work group

 Microsoft Video: Phishing and Identity Theft

02/18/22 Information Security 13

02/18/22 Information Security 14

You might also like