CIS0
Phishing – ―A scam to steal private information‖
Background
Summary: Phishing is when an attacker sends an e-mail or displays a
Web announcement that falsely claims to be from a legitimate
organization. The intention of the messenger is to trick the user into
surrendering private information.
Description: A more specific definition is offered by the Anti-phishing Working Group (APWG):
―Phishing is a criminal mechanism employing both social engineering and technical subterfuge
to steal consumers’ personal identity data and financial account credentials.‖ The victim in a
phishing attack is asked to respond to an e-mail or is directed to a Web site to update personal
information, such as passwords, credit card numbers, Social Security numbers, bank account
numbers, or other information. This is often information that the legitimate organization would
already have. However, the web site or email recipient is actually a fake, and any information
given is stolen.
Risk: A successful Phishing attack can lead to online identity theft. By capturing a user’s
personal information, an attacker can gain access to the user’s account on a legitimate Web
site. The activities of the attacker could lead to substantial financial loss to the user, denial of
access to e-mail, or other losses.
Example of Occurrence: On the weekend of January 3, 2009, several users on the social
network Web site Twitter became victims of a phishing attack. The users were deceived into
giving away their passwords when they received an e-mail similar to one that they would receive
from Twitter with a link that read, ―hey, check out this funny blog about you…‖. The link seemed
to go to the real Twitter site, but was actually a fake site at another domain (that is, not on
Twitter's computers) designed to look the same. Any personal information entered by the user
on the fake site was then captured by the attacker.
Twitter responded by reporting the offending domain, and changing the affected users’
passwords.
What sort of Twitter would give away their password?
http://www.guardian.co.uk/technology/2009/jan/08/twitter-barack-obama-britney-spears-micro-blog-networking
