Feeds

Whaling fraudsters harpoon 15,000 victims

Two gangs blamed for attacks on credulous high-rollers

Secure remote control for conventional and virtual desktops

Targeted phishing attacks against high-rollers reached new heights over the last two months, according to a study by iDefense.

The VeriSign security division recorded 66 instances of so-called whaling attacks between February 2007, around the time fraudsters adopted the tactic, and June 2008. More than one in four of these assaults happened during the last two months.

Whaling attacks typically use carefully tailored lures in personalised emails designed to trick senior executives into downloading malicious code. Thereafter crackers use compromised machines to gain access to sensitive data such as corporate banking credentials or customer databases. Attacks are frequently timed to coincide with diary events such as tax day. Fraudulent emails have appeared under the guise of the Better Business Bureau, Internal Revenue Service and the Department of Justice, for example.

Matt Richard, director of rapid response at iDefense, explained that fraudsters typically used unscrupulous "bullet proof" hosting services to host malicious code. After tracking the crooks for months, iDefense managed to get access to their control panel, providing an insight into the fraudsters' network.

VeriSign reckons over 15,000 corporate targets have been duped by the approach over the last 15 months. Victims include conglomerates, government agencies, financial institutions and legal firms. Reported victim losses can top $100,000.

The vast majority of these attacks - 95 per cent - are the work of only two groups, according to VeriSign. Each group is differentiated by the attack code it uses. One uses Browser Helper Objects (BHO) to log SSL encrypted sessions or to carry out man-in-the-middle attacks on two-factor authentication systems. Another group favours the use of key logging software.

The latter group is from Romania and Italy, based on the language used in the code and the patterns of fraudulent transactions associated with its activities. The other group is more international, with contacts in China and south east Asia.

iDefense advocates a mixture of staff training and URL filtering as the best defences against the whalers. It warns that the attack approach is only likely to become more common over coming months. "Awareness and education are the best defences against this growing fraud," said iDefense's Richard. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?