Revoke the phishing licence
The effect of having your details stolen via a bogus website can be devastating. Danny Bradbury looks at what the big players are doing to stamp out the problem
Carl Robertson still shudders when he remembers it. "You have to live through it to understand the damage that can happen, not only emotionally, but financially." A death? A robbery? No. The 63-year-old California-based estate agent is talking about phishing, the stealing of personal credentials using spoof emails pointing to fake websites.
Robertson had been a casual internet user for three years when he followed a link in an email purporting to come from eBay. The mail led him to enter personal details into what he thought was an account confirmation page.
Security flaws in computer systems can be patched and upgraded, but phishing relies on gullibility, frightening people into action with emails that threaten dire security consequences unless they comply straight away. "They wanted my password and all this other information about me. Bank accounts, everything. I thought it was all going to eBay," Robertson says.
Education campaigns
Heavily phished brands such as eBay, PayPal and the leading banks run extensive education campaigns about the dangers of phishing emails, but some users will always ignore warnings until it's too late, says David Jevans, chair of the Anti-Phishing Working Group, a consortium of companies trying to combat it.
The numbers may be small, but they add up to enough to make it very profitable for the scammers, according to a paper by Richard Clayton and Tyler Moore at the University of Cambridge. The paper (tinyurl.com/2e6w9j) found that an average phishing site attracts up to 30 user inputs per day before being taken down. Most phishing sites were removed within 48 hours - but the remainder could be hard to eradicate, lasting up to six weeks.
"They only get 10 to 20 people," says Michael Barrett of PayPal. "But if you work on the basis of a couple of hundred bucks per customer, then the bad guy has made four grand for little work."
Anti-phishing techniques have included browser technology that alerts users to suspicious sites using an online blacklist of known phishing sites. However, the effectiveness of such alerts is limited. "Phishing is so effective because users often ignore the security indicators, and even if they do notice them, they don't always understand what they mean," warns Rachna Dhamija, a postdoctorate fellow at Harvard's centre for research on computation and society.
A 2006 study co-researched by Dhamija (tinyurl.com/k5jau) showed that almost one user in four ignores browser-based warnings. And a followup study (tinyurl.com/2d42gd) showed that people will ignore all sorts of clues that a site is not really their bank's, including the padlock in the menu bar or the bank's own security images; conversely, if they do see such an image (which can easily be relayed or copied), they'll ignore direct warnings from their browser not to use the page.
If you can't educate users could you build the intelligence into the internet instead? This is what David Ulevitch is hoping for. OpenDNS, founded by Ulevitch, provides free domain name server (DNS) services. A DNS looks up a website's domain name (such as guardian.co.uk) and forwards the surfer to the underlying IP address that the web server lives at (212.187.153.30). OpenDNS automatically blocks web servers it knows to be hosting malicious sites, including phishing sites.
But OpenDNS's 750,000 customers are a drop in the internet ocean. Network-based protection must reach the largest number of users possible. PayPal is using its muscle with giant email providers such as Yahoo!, AOL and Microsoft.
Callow net users gravitate to these free webmail services, which Barrett hopes can choke off fake emails purporting to be from PayPal by blocking them unless they are signed with PayPal's own electronic certificate. If the approach works when it starts later this year, PayPal may expand the system to create a clearing house for other companies to use.
This could do what other network-based email security schemes failed to do. S-MIME, a system that authenticates emails by digitally signing them, has been around for almost 20 years, says Jevans.
PayPal is also working on two-factor authentication (2FA) as a way of solving the phishing problem. 2FA uses two things to authorise you: something you know (a password or PIN) and something you have (a hardware device). The company has already tested hardware tokens in some countries, and will roll them out in the UK around the end of the year, says Barrett.
Meanwhile, the UK payment industry association APACS has been working with the credit card companies to design similar systems, and Sean Gilchrist, head of electronic banking at Barclays, says that it will ship card readers to a quarter of its online customers in the next few months.
The reader is designed to support money transfers to recipients not on Barclays' pre-authorised list. It uses the chip on your bank card to calculate a one-time code for transactions, using a combination of your PIN, the amount to be paid and the recipient's account number
But Ross Anderson, professor of security engineering at Cambridge University's computer laboratory, worries about multiple potential attacks. These include crooks reading the worn buttons on the reader to guess your PIN, through to unscrupulous retailers harvesting information from the card (along with your PIN) using hacked point of sale terminals. He is also concerned about "man in the middle" attacks, where codes are relayed to the bank via fake websites.
The move to 2FA is "driven by liability engineering rather than security engineering", says Anderson. "Everyone is trying to dump the risk over the fence, so it ultimately ends up with the customer." At present, though, most banks reimburse customers who suffer card fraud.
Warnings ignored
But Anderson and Dhamija point to another area that needs urgent attention: the software designers building both the e-commerce sites and the browsers that present them. "I think we're discriminating against humans. We're not trained to think about their capabilities, and their skills, and what they understand," Dhamija says.
For example, users have been conditioned to ignore warnings, through repeated exposure to verbose security warnings about unimportant things, such as Windows throwing up an exclamation mark saying that this operation will overwrite the existing file, or that a cable "has come unplugged". Being told to look for the padlock sign in the browser window as a sign of security makes it easier for scammers to simply post an image of a padlock and a security logo on the website to give it an air of legitimacy, she adds.
And despite the sophisticated network engineering, industry initiatives and talking shops on phishing countermeasures, that layer of unreachable people remains who simply don't listen, don't learn and definitely don't read the manual remains huge. Last year, they accounted for £33.5m of the £428m lost by UK banks in card fraud.
Danny Bradbury
Thursday June 21, 2007
Guardian Unlimited
; Guardian News and Media Limited 2007
The effect of having your details stolen via a bogus website can be devastating. Danny Bradbury looks at what the big players are doing to stamp out the problem
Carl Robertson still shudders when he remembers it. "You have to live through it to understand the damage that can happen, not only emotionally, but financially." A death? A robbery? No. The 63-year-old California-based estate agent is talking about phishing, the stealing of personal credentials using spoof emails pointing to fake websites.
Robertson had been a casual internet user for three years when he followed a link in an email purporting to come from eBay. The mail led him to enter personal details into what he thought was an account confirmation page.
Security flaws in computer systems can be patched and upgraded, but phishing relies on gullibility, frightening people into action with emails that threaten dire security consequences unless they comply straight away. "They wanted my password and all this other information about me. Bank accounts, everything. I thought it was all going to eBay," Robertson says.
Education campaigns
Heavily phished brands such as eBay, PayPal and the leading banks run extensive education campaigns about the dangers of phishing emails, but some users will always ignore warnings until it's too late, says David Jevans, chair of the Anti-Phishing Working Group, a consortium of companies trying to combat it.
The numbers may be small, but they add up to enough to make it very profitable for the scammers, according to a paper by Richard Clayton and Tyler Moore at the University of Cambridge. The paper (tinyurl.com/2e6w9j) found that an average phishing site attracts up to 30 user inputs per day before being taken down. Most phishing sites were removed within 48 hours - but the remainder could be hard to eradicate, lasting up to six weeks.
"They only get 10 to 20 people," says Michael Barrett of PayPal. "But if you work on the basis of a couple of hundred bucks per customer, then the bad guy has made four grand for little work."
Anti-phishing techniques have included browser technology that alerts users to suspicious sites using an online blacklist of known phishing sites. However, the effectiveness of such alerts is limited. "Phishing is so effective because users often ignore the security indicators, and even if they do notice them, they don't always understand what they mean," warns Rachna Dhamija, a postdoctorate fellow at Harvard's centre for research on computation and society.
A 2006 study co-researched by Dhamija (tinyurl.com/k5jau) showed that almost one user in four ignores browser-based warnings. And a followup study (tinyurl.com/2d42gd) showed that people will ignore all sorts of clues that a site is not really their bank's, including the padlock in the menu bar or the bank's own security images; conversely, if they do see such an image (which can easily be relayed or copied), they'll ignore direct warnings from their browser not to use the page.
If you can't educate users could you build the intelligence into the internet instead? This is what David Ulevitch is hoping for. OpenDNS, founded by Ulevitch, provides free domain name server (DNS) services. A DNS looks up a website's domain name (such as guardian.co.uk) and forwards the surfer to the underlying IP address that the web server lives at (212.187.153.30). OpenDNS automatically blocks web servers it knows to be hosting malicious sites, including phishing sites.
But OpenDNS's 750,000 customers are a drop in the internet ocean. Network-based protection must reach the largest number of users possible. PayPal is using its muscle with giant email providers such as Yahoo!, AOL and Microsoft.
Callow net users gravitate to these free webmail services, which Barrett hopes can choke off fake emails purporting to be from PayPal by blocking them unless they are signed with PayPal's own electronic certificate. If the approach works when it starts later this year, PayPal may expand the system to create a clearing house for other companies to use.
This could do what other network-based email security schemes failed to do. S-MIME, a system that authenticates emails by digitally signing them, has been around for almost 20 years, says Jevans.
PayPal is also working on two-factor authentication (2FA) as a way of solving the phishing problem. 2FA uses two things to authorise you: something you know (a password or PIN) and something you have (a hardware device). The company has already tested hardware tokens in some countries, and will roll them out in the UK around the end of the year, says Barrett.
Meanwhile, the UK payment industry association APACS has been working with the credit card companies to design similar systems, and Sean Gilchrist, head of electronic banking at Barclays, says that it will ship card readers to a quarter of its online customers in the next few months.
The reader is designed to support money transfers to recipients not on Barclays' pre-authorised list. It uses the chip on your bank card to calculate a one-time code for transactions, using a combination of your PIN, the amount to be paid and the recipient's account number
But Ross Anderson, professor of security engineering at Cambridge University's computer laboratory, worries about multiple potential attacks. These include crooks reading the worn buttons on the reader to guess your PIN, through to unscrupulous retailers harvesting information from the card (along with your PIN) using hacked point of sale terminals. He is also concerned about "man in the middle" attacks, where codes are relayed to the bank via fake websites.
The move to 2FA is "driven by liability engineering rather than security engineering", says Anderson. "Everyone is trying to dump the risk over the fence, so it ultimately ends up with the customer." At present, though, most banks reimburse customers who suffer card fraud.
Warnings ignored
But Anderson and Dhamija point to another area that needs urgent attention: the software designers building both the e-commerce sites and the browsers that present them. "I think we're discriminating against humans. We're not trained to think about their capabilities, and their skills, and what they understand," Dhamija says.
For example, users have been conditioned to ignore warnings, through repeated exposure to verbose security warnings about unimportant things, such as Windows throwing up an exclamation mark saying that this operation will overwrite the existing file, or that a cable "has come unplugged". Being told to look for the padlock sign in the browser window as a sign of security makes it easier for scammers to simply post an image of a padlock and a security logo on the website to give it an air of legitimacy, she adds.
And despite the sophisticated network engineering, industry initiatives and talking shops on phishing countermeasures, that layer of unreachable people remains who simply don't listen, don't learn and definitely don't read the manual remains huge. Last year, they accounted for £33.5m of the £428m lost by UK banks in card fraud.
Danny Bradbury
Thursday June 21, 2007
Guardian Unlimited
; Guardian News and Media Limited 2007
