April 13, 2005 2:30 PM PDT
Bigger phishes ready to spawn
That figure seems to mark a significant lessening of the threat, given that the average growth rate has been 26 percent per month since July 2004. But during the January-February period, phishing attacks also became dramatically more complex, experts said.
The rate of growth in online fraud attacks has slowed, but the scams are getting smarter.
Attackers are using more sophisticated social-engineering techniques and advanced technology to perpetrate phishing fraud.
"Phishers are thieves, and thieves in the online world, as in the real world, are working very hard to separate personal financial information and other data from their victims," Microsoft attorney Aaron Kornblum said.
The software maker recently filed 117 lawsuits against alleged operators of phishing Web sites--a major step forward in thwarting online criminals, according to Kornblum.
However, he acknowledged that there may be as much to fear in the future of phishing as there is to learn from its past.
"People will continue to think up news ways to apply phishing techniques and deceive consumers," he said. "The sophistication is growing, and it's not that surprising at all."
New crooks, more-effective tricks
The first wave of phishing attacks played on the ignorance of unsuspecting consumers, spamming their in-boxes with e-mails that looked like they linked to Web sites belonging to banks, investment companies and e-commerce businesses such as eBay. In reality, they were fake pages designed to lure people into divulging account login data, or other sensitive personal information that could enable the crooks to commit identity fraud.
Recent attacks have gotten more sophisticated, with advances in phishing schemes that use e-mail and the creation of fraudulent Web pages that appear almost identical to their legitimate counterparts.
One of the most telling examples of improved social-engineering techniques is a recent attack that didn't seek to nab victims' names, addresses or Social Security numbers.
Instead, the scheme targeted customers of Salesforce.com, with the aim of stealing information stored on the company's databases.
The campaign began with an e-mail sent to Salesforce customers that promised new application features under a free trial if the
3 commentsJoin the conversation! Add your comment