NEWS

WHAT'S ON TV NOW

Recorded   Latest Recorded Program Feeds Click for more recently recorded TV feeds Kayotix's latest Audio Demo Sample CD Now Shipping. Click Here to order your free copy !

Online Fraud 08.11.04(BBC News 24) close X Running Time Approximately: 1 minutes Playlist Order: [N/A] Source Site: guardian.co.uk/ Hackers Jamming Websites / Bombarding Servers It's safe to bank on the net. As long as you've got a PhD by John Naughton The Observer You've probably received one of them by now - an email from your bank. It reminds you that it takes the security of your personal details very seriously and is in the process of strengthening its security measures even further. So it would be grateful if you could take a few moments to visit its secure website in order to confirm your details. 'Click here to be taken to our secure website.' So you click there, and in a moment up comes the site, complete with the corporate logo and the authentic 'look and feel' which you know so well. And there indeed are the two text boxes into which you type your username and password. You type them in and click on the 'submit' button. A nice message flashes up thanking you for taking the trouble to help the bank maintain its high level of service and customer care. What's happened is that you've just been hooked by a 'phishing' expedition and had your identity stolen. The email you received did not come from your bank, but from a fraudster, who is probably based in one of the former Soviet Bloc countries. The website that came up when you clicked on the link in the email was a fake designed to spoof your bank's real site. And the text boxes into which you typed your details were a conduit to a database of useful personal details being constructed by the phisher for use in subsequent bank frauds. In the last few months, Barclays and LloydsTSB customers have received phishing emails telling them that their debit cards will be cancelled unless they reconfirm their membership. They were then directed to a website where they were asked to enter Visa debit card details. Natwest customers were targeted twice in the closing months of 2003. And Citibank clients have been on the receiving end of so many unsolicited emails that even the most obtuse among them must have realised that there's something phishy going on. It's astonishing that people would be taken in by such a scam, but some obviously are. Phishing is increasing for two simple reasons: it works; and it can be massively profitable. In conversations with internet users who have been conned or nearly conned, two plaintive wails can be heard. The first is: 'But it came from my bank. How could a fraudster know I banked with LloydsTSB?' Answer: he doesn't; he just sends out a lot of emails knowing that every so often one will arrive in the inbox of a Lloyds customer. The second is: 'But the website looked exactly like my bank's site!' It takes only a small amount of expertise to do that. Many teenagers could do it. Nobody who knew about email or the web would be taken in for a moment by phishing expeditions. The trouble is that most email and web users don't understand the technology. The banks could do something about that. At the very least, every online banking customer should be required explicitly to confirm that he or she has read and understood a declaration that they will NEVER receive an email communication from the bank which requires or encourages them to reveal their personal details. Most online financial services have a declaration to this effect somewhere in their web material, but if it's not in their customers' faces, then it ought to be. The best defence against phishing - as against malicious software generally - is an alert and cautious internet user. But last week, Messagelabs, an email security firm, revealed that it had discovered a new phishing technique that does not even require the victim to click on an email-borne link. Simply opening the message is sufficient. Doing so triggers a covert script that rewrites the host files of the victims' computers - so the next time they attempt to legitimately access their accounts they are automatically redirected to a fraudulent website. So far, Messagelabs has only intercepted copies of emails targeting Brazilian banks, but I'm willing to bet that customers of Barclays, Lloyds TSB, Natwest and HSBC will be getting them soon. Whether people are hit by this threat depends on two things. The first is their general state of alertness. The second is whether they use Microsoft Windows - because the new technique exploits certain, ah, features of that wonderful system. To be safe, they need to ensure that something called 'Windows Scripting Host' is disabled on their systems. So folks with PhDs in computer science should be ok. Phew!

More ...