Phishing: InformationWeek > Parry Aftab > Phishing Vulnerabilities In Microsoft's Internet Explorer, Plus A New Server-Access Ploy > January 26, 2004

InformationWeek > Parry Aftab > Phishing Vulnerabilities In Microsoft's Internet Explorer, Plus A New Server-Access Ploy > January 26, 2004

Until recently, consumer advocates recommended that you check the browser's URL window and make sure it confirms that you've linked to the site you expected. If the two didn't match, you knew you were being spoofed from a phished link.

However, Internet Explorer allows the spoofed site to appear to be the one you trusted. People relying on consumer-safety tips to avoid becoming victims of spoofed and phished links would find themselves tricked into compliance.

When the vulnerability was discovered in mid-2003, Microsoft responded by saying it was looking into the problem. When I consulted one of their spokesmen in December 2003, the company still hadn't taken any action or made any firm decision about what, if anything it will do to close the vulnerability. The spokesman indicated that perhaps Micrososft would include a patch in its monthly patch updates, but wasn't certain. But since the real answer here isn't turning our customers into cybersleuths to spot the latest fraud, it really doesn't make much of a difference if or when it patches the vulnerability.

Roundabout Server Access
Although phishing incidents involving third-party E-mails are the most common, a new scheme has arisen involving cybercriminals seeking access to your company's servers.

An E-mail is sent to those within the corporation, appearing to be from internal legal, IT, or security administrators. The E-mail announces a security breach, or problem within the network. It advises the employee to log into the company's network, using the link provided in the E-mail. Once the employee types in their login and password, the phishing expedition was successful. They now have access to the company's communications and password protected network. By targeting employees with all levels of access, to all segments of the server, they are able to gain access to most, if not all, of the server data and infrastructure.

So, look within, as well as to outside communications when warning your employees about intrusions and fraud. It's well known that the fastest way to break security on a secure network is to fool someone with access into letting you in. Don't let your employees provide the key to the burglars. Set up a confirmation process and make sure your employees know how you will communicate any security breach. Make sure they have a contact E-mail or telephone number where they can confirm the validity of any communication, and a network posting of any emergency announcements. Forewarned is forearmed.