The Phishing Ecosystem

The Phishing Ecosystem Wednesday, March 22 nd 2006 – 3:00pm Andrew Klein Engineering Manager

… and sometimes it hits close to home! MailFrontier Employee/Contractor , Your e-mail account was used to send a large number of unsolicited spam messages during the past 5 days. We suspect your account has been compromised. Please click here to change your account password in the next 24 hours. Failure to change your account password will result in the suspension of your login to the system. Virtually yours, The MailFrontier Support Team

Phishing by the numbers ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

http://www.mbna-mail.com/ets/...

http://chaseonline.rewardprogramsurvey.us/

http://chaseonline.rewardprogramsurvey.us/ Phish

Checklist - Step 1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

“Give me some credit here”

Where we’ll send our phishing email from ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who will host our phishing site? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Attack launched Sending Machines Phish Web Sites 66.165.106.111 152.146.187.172 161.58.214.148 195.75.241.4 212.250.162.8 Receivers 61.152.175.161 210.114.175.226 211.23.187.151 Mary Tomas Andy Tonia George John Frank Tim Herman Luann Ramona Evan Jan Scott Venkat Charlie Phil Elisa Dom Joe Lana June Chao Vadim Oliver

Checklist – Step 6 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The results of our attack ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],In 2005 the David Levi made over $360,000 from 160 people using an eBay Phishing scam

A little phishing gang ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Caught – received sentences from 1 to 4 years each

The phishing ecosystem The Phisher Email list Sending Machines Hosting Sites Email & Web site Construct Launch Collect ,[object Object],[object Object],[object Object],[object Object],Phished information turned into Cash $

The money laundering “Mule” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The phishing ecosystem The Phisher Email list Sending Machines Hosting Sites Email & Web site Construct Launch Collect ,[object Object],[object Object],[object Object],[object Object],Phished information turned into Cash $ Harvested Information

The phishing ecosystem The Phisher Tools to the Trade Email list Sending Machines Hosting Sites Email & Web site Construct Launch Collect ,[object Object],[object Object],[object Object],[object Object],Phished information turned into Cash ,[object Object],[object Object],[object Object],Harvested Information $ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Botnets ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The name game ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The phishing ecosystem The Phisher Tools to the Trade The Malware Community Email list Sending Machines Hosting Sites Email & Web site Construct Launch Collect ,[object Object],[object Object],[object Object],[object Object],Phished information turned into Cash ,[object Object],[object Object],[object Object],Harvested Information $ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The phishing ecosystem The Phisher Tools to the Trade The Malware Community Email list Sending Machines Hosting Sites Email & Web site Construct Launch Collect ,[object Object],[object Object],[object Object],[object Object],Phished information turned into Cash Phishing Kit ,[object Object],[object Object],[object Object],Harvested Information $ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The phishing ecosystem The Phisher $ Tools to the Trade The Malware Community Email list Sending Machines Hosting Sites Email & Web site Construct Launch Collect ,[object Object],[object Object],[object Object],[object Object],Phished information turned into Cash Phishing Kit ,[object Object],[object Object],[object Object],Harvested Information $ $ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The phishing ecosystem $ Tools to the Trade The Phisher The Malware Community Email list Sending Machines Hosting Sites Email & Web site Construct Launch Collect ,[object Object],[object Object],[object Object],[object Object],Phished information turned into Cash Phishing Kit ,[object Object],[object Object],[object Object],Harvested Information $ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Scaling a phishing gang ,[object Object],[object Object],[object Object],[object Object],[object Object],Feb 2006 – 41 members caught, 24 more still on the run

The Four Parts of the Solution

The email process The Brand A company that sends email to it’s customers or employees and therefore is a target for phishing scams The Web Site The web site where you are directed to by the email You The person who receives email The Mailman A company that receives email and delivers it to its employees/customers

The brand ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The mailman ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The web site ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

You ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What did we do today ,[object Object],[object Object],[object Object],[object Object],[object Object]

Thank you Andrew Klein [email_address] www.sonicwall.com

The Phishing Ecosystem

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (17)

Similar a The Phishing Ecosystem

Similar a The Phishing Ecosystem (20)

Más de amiable_indian

Más de amiable_indian (20)

Último

Último (20)

The Phishing Ecosystem