Feeds

Man-in-the-Middle phishing kit netted

Sinister haul

Security for virtualized datacentres

A new kit for sale in the digital underground makes it easier for fraudsters to run more sophisticated phishing fraud attacks.

The Universal Man-in-the-Middle Phishing Kit enables fraudsters to sit between prospective marks and legitimate businesses. Rather just setting up a bogus website that's promoted through spam email, crooks set up a fraudulent website as a conduit through a legitimate website to communicate with their victims. The technology allows con men to automatically capture victims' personal information in real-time.

Such attacks have been seen before, but until now were restricted to the realm of skilled hackers. Man-in-the-Middle puts the approach in reach of s'kiddies.

The kit was discovered by the anti-fraud unit of RSA, the security division of EMC, after it came across a free trial on a online fraudster forums it monitors. For fraudsters the software offers a number of benefits that spell added danger for consumers and online banks, the typical target of phishing attacks.

For one thing, the kit can be easily configured to suit different targets. An attack can be configured to "import" pages from any target website. Unlike standard email scam attacks, which only collect specific requested data (typically login and card-related credentials), using the man-in-the-middle approach means its possible to intercept any type of credentials submitted to a target site.

"While these types of attacks are still considered 'next generation,' we expect them to become more widespread over the course of the next 12-18 months. We are working with many organisations to ensure they are positioned to withstand whatever threats fraudsters may create," he said. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.