Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

A new kit for sale in the digital underground makes it easier for fraudsters to run more sophisticated phishing fraud attacks.

The Universal Man-in-the-Middle Phishing Kit enables fraudsters to sit between prospective marks and legitimate businesses. Rather just setting up a bogus website that's promoted through spam email, crooks set up a fraudulent website as a conduit through a legitimate website to communicate with their victims. The technology allows con men to automatically capture victims' personal information in real-time.

The kit was discovered by the anti-fraud unit of RSA, the security division of EMC, after it came across a free trial on a online fraudster forums it monitors. For fraudsters the software offers a number of benefits that spell added danger for consumers and online banks, the typical target of phishing attacks.

For one thing, the kit can be easily configured to suit different targets. An attack can be configured to "import" pages from any target website. Unlike standard email scam attacks, which only collect specific requested data (typically login and card-related credentials), using the man-in-the-middle approach means its possible to intercept any type of credentials submitted to a target site.

"While these types of attacks are still considered 'next generation,' we expect them to become more widespread over the course of the next 12-18 months. We are working with many organisations to ensure they are positioned to withstand whatever threats fraudsters may create," he said. ®

Agentless Backup is Not a Myth