1 / 30

Agenda

George Mason University and SonicWALL The Phishing Ecosystem Analyzing the Dynamics for Maximum Defense Tuesday, April 11th 2006 – 2:45pm. Agenda. Overview of the Phishing Ecosystem Questions for the panel Scope of the problem What did GMU do Results Phishing education Other email issues

melosa
Télécharger la présentation

Agenda

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. George Mason University and SonicWALLThe Phishing EcosystemAnalyzing the Dynamics for Maximum DefenseTuesday, April 11th 2006 – 2:45pm

  2. Agenda • Overview of the Phishing Ecosystem • Questions for the panel • Scope of the problem • What did GMU do • Results • Phishing education • Other email issues • Ask questions as we go • Wrap up & lessons learned

  3. Let’s Go Phishing

  4. The Phishing Checklist • Get an email list • Develop the attack • Locate sites to send phishing email from • Locate sites to host the phishing site • Launch the attack • Collect the information • Transform into cash

  5. A bad day phishin’, beats a good day workin’ • 2,000,000 emails are sent • 5% get to the end user – 100,000 (APWG) • 5% click on the phishing link – 5,000 (APWG) • 2% enter data into the phishing site –100 (Gartner) • $1,200 from each person who enters data (FTC) • Our potential reward: $120,000 In 2005 David Levi made over $360,000 from 160 people using an eBay Phishing scam

  6. A little phishing gang • The David Levi phishing gang – UK • 6 members • Operated for 12 months • At least $360,000 from 160 people • Segmentation of jobs • Techie • Creative designer • Money laundering – mule driver Caught – received sentences from 1 to 4 years each

  7. The phishing ecosystem Collect Construct Launch • Account Info • Credit Info • Identity Info • Logins & Passwords Phishing Kit Sending Machines Email list Hosting Sites Email & Web site $ The Phisher Tools to the Trade Harvested Information Phished information turned into Cash • Hacks & Attacks • “Real” Domain Names • Botnets • Trojans • Worms • Keyloggers • DHA • Site Crawlers • Spyware • Templates • Sitecopy & wget $ The Malware Community

  8. The money laundering “Mule” • “Make Money at Home” • Recruits receive funds in their accounts • Transfer funds from their account via Western Union wire transfers to a 2nd (phishers) account • Paid 10% of the sum of each money transfer • One or two transfers each week - $3,000 to $5,000 each • “Nations Welfare Foundation” • Looking for a “Financial Operations Manager” • Transfer money for young cancer patients in USSR • Real looking web site complete with pictures • Paid 7% - can make $500 to $2,000 per week

  9. Botnets • Botnet: A collection of compromised computers that are run under a common control structure • Functions • Email senders • DHA, spam, phishing, virus • DOS attacks • Rented out for $300 to $700 per hour • Jeanson James Ancheta made $60,000 by selling access • Over 10,000 botnets become active each day (Symantec)

  10. Hacks and Attacks • 9,715 – Number of phishing sites operational in January 2006 (APWG) • 34% – The percentage of phishing sites hosted in the United States for December 2005 (APWG) • 31% - The percentage of phishing sites that are being hosted on “real” web servers (SonicWALL) Hacked bank server hosts phishing sites March 13, 2006 (IDG News Service) – Criminals appear to have hacked a Chinese bank’s server and are using it to host phishing sites to steal personal data from customers of eBay Inc. and a major U.S. bank.

  11. Scaling a phishing gang • The Campina Grande - Brazil • 65 members • Operated for at least 3 months • 200 accounts in six banks • $4.7 million stolen from bank accounts Feb 2006 – 41 members caught, 24 more still on the run

  12. The phishing ecosystem Collect Construct Launch • Account Info • Credit Info • Identity Info • Logins & Passwords Phishing Kit Sending Machines Email list Hosting Sites Email & Web site The Phisher Tools to the Trade Harvested Information Phished information turned into Cash • Hacks & Attacks • “Real” Domain Names • Botnets • Trojans • Worms • Keyloggers • DHA • Site Crawlers • Spyware • Templates • Sitecopy & wget $ The Malware Community

  13. Roles of the Education in Phishing • Victim • Receive and respond to phishing attack • Bad for victim / Bad for you • Labor • Mules • Coders • Phisher • Organized cooperative environment • Participant • Hosting phishing sites • Sending email – Botnets

  14. GMU Slides

  15. Email and Academia: The Challenge • Email supports communications, academic projects and business administration, but also makes you vulnerable • Diverse user needs • Limited resources and need to reduce operating costs

  16. Email At George Mason University • 30,000 active email accounts • 400,000 inbound messages/day (82% junk) • Decentralized, ineffective protection for spam • No protection from phishing • Six AV appliances • Costly maintenance

  17. Determine The Requirements • User Town Hall Meetings • Quarantine is required • Ability to opt-out • Systems Management • No new staff – minimize daily tasks • Solaris-based • Management reporting

  18. Evaluation Requirements • Effective - we receive only the emails we want to receive • Easy to manage – something that doesn’t require additional IT time (actually, less time than what we’re spending is better) • Easy for end users – little to no training required, also something they can self-manage

  19. The Process… • Product analysis, review requirements • Vendor questionnaire • Review responses • Invitation to technology day • Each vendor given 50 minutes • Present same info in specified order • Must include pricing and references • Q&A • Vendors cannot see other vendor presentations

  20. Evaluation • All vendors that satisfied all requirements invited • Solutions placed in production mail flow for 15 days

  21. spam, spam, spam, spam, spam, spam

  22. Wrap-up

  23. Wrap-up • Overview of the Phishing Ecosystem • Phish School • Scope of the problem • What did GMU do • Results • Phishing education • Other email issues

  24. Thank you Andrew Klein aklein@sonicwall.com www.sonicwall.com

  25. The Four Parts of the Solution

  26. The email process The Brand A company that sends email to it’s customers or employees and therefore is a target for phishing scams The Mailman A company that receives email and delivers it to its employees/customers The Web Site The web site where you are directed to by the email You The person who receives email

  27. The brand • Cut-and-Paste links, minimize links • Use personal information where possible • Dear John J. Smith • Account ending in 1234 • Your zip code is 94304 • Provide non-email ways to verify • Use standard company domain names • Identify your partners • Set and follow standard communication practices • Internally and externally

  28. The mailman • Preemptive • Protect your email address • Phishing is more than spam – think Virus • Technology • Multi-faceted solution – No silver bullet • Sender authentication and reputation, content, contact point divergence, URL exploits, real-time phish lists, etc. • World-wide community collaboration • Change is part of the business • Psychology • Educate your customers/employees – their PhishingIQ • Email is still Good! Really it is!

  29. The web site • Company and personal sites • Monitor your site • Know your content • Practice good passwords • Keep logs, report phishing to authorities • Hosting services • Monitor new customers • Take phishing seriously • Unless they are eBay, assume they are not eBay! • Domain name registration services • Be diligent about domain registrations • Actively work to shut down phishing sites

  30. You • Know your senders • Is this someone I do business with? • Is this something I was told I’d receive? • Look for other ways to respond • Be aware • Look for clues – improve your PhishingIQ • Don’t be afraid to ask • Protect your system • Know how your system is updated • Check your records

More Related