Feeds

Google and eBay thwart phishing redirection ruse

Clean up campaign bears fruit

Top 5 reasons to deploy VMware with Tegile

High-profile websites have cleaned up their act after a small team of security researchers documented how they were unwittingly helping phishing fraudsters.

Phishing scams often use "open redirector" exploits on major sites to make their attack URL look more legitimate. The trick also makes it more likely that fraudulent emails that form the basis of phishing attacks will slip past spam filters.

Typically, security shortcomings on targeted sites allow scammers to furnish links that appear kosher but actually redirect to a fraudulent site.

Previous Register stories have covered examples of the ruse practiced on websites including Barclays Bank (story here), eBay (here), and others.

A campaign by SiteTruth to name and shame high profile firms that fail to block open redirector exploits is beginning to bear fruit.

SiteTruth cross-referenced the 10,000 sites listed in PhishTank (a clearing house for reports about phishing sites) with the 1.7 million sites in the Open Directory Project database to discover a list of problem domains. Domains listed typically have a security vulnerability which is being exploited by phishing fraudsters.

URL redirection isn't the only category for listing in this blacklist (hosting or otherwise unwittingly helping phishing scams also counts), but the sites allowing URL redirection included many high-profile organisations that ought to know better, including Google Maps, AOL, and eBay.

Recent updates by Google Maps and eBay since we wrote about SiteTruth's work have nipped the problem in the bud. Other organisations, such as AOL, are yet to address the problem. Nonetheless, SiteTruth is happy at making inroads into the number of high-profile sites open to abuse.

"You'll be pleased to know that the combination of your article, our reports, efforts at the Anti-Phishing Working Group, and a certain amount of nagging on our part has made a considerable dent in the 'open redirector' problem," SiteTruth's John Nagle told El Reg. Google fixed its problem last week, and currently has no active phishing attacks listed in PhishTank. eBay also cleaned up its act and it too is now out of the tank.

AOL, however, is yet to clear up its problem, first reported earlier this month, that allows open redirector exploits (harmless example that redirects from AOL to El Reg here).

That's just one example that illustrates the problem is a long way from being resolved. Nonetheless, SiteTruth's list of problem domains is shrinking.

"Our list of major sites with exploited vulnerabilities, not all of which are open redirectors, has been shrinking as the word gets out. There were 171 problem domains in early December, and we're down to 54 today. Publicity is working," Nagle added.

Phishing sites come and go rapidly, but some problematic domains have become a fixture of SiteTruth's phishing blacklist.

"Only 16 of those domains have been on our list since its inception in late November. Most of those are DSL service providers inadvertently providing connections for computers hosting phishing attacks. The others come and go as phishers find vulnerabilities and site operators plug the holes," Nagle concluded. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.