W3C - Phishing remains root of flourishing e-crime

Phishing remains at the core of a host of scams creating by criminals using the Internet.

"The Web is under attack," said Phillip Hallam-Baker, principal scientist at VeriSign, who gave a session Thursday on Internet crime at the W3C (World Wide Web) conference in Edinburgh, Scotland, this week.

Internet crime often starts with phishing, the practice of duping a user into revealing bank account or log-in credentials via a fraudulent Web site.

Phishers send out reams of e-mail bait that say users' account information has expired or needs updating. The e-mail includes links to a site that may look very similar to their bank Web site, but isn't. Once those credentials are obtained, criminals use the information in a variety of creative and costly scams.

The tools to commit e-crime are for sale on the Internet. Mounting an attack on millions of Internet users can be done for a little as US$300, Hallam-Baker said. Networks of computers under the control of hackers, called botnets, can be rented to send spam. Also for sale are lists of up to 100 million e-mail addresses.

Hallam-Baker said one Russian hacker will create a custom rootkit -- a method to hide a piece of malicious software deep in a computer's operating system -- for about US$60.

If users are tricked into clicking on an attachment with a piece of malware, it can mean all of their personal data, such as passwords and credit card numbers, can be recorded and sent back to the hacker, who may resell them to other criminals.

The following are examples Hallam-Baker gave of the next steps clever e-criminals take after obtaining personal information:

Carding: Once credit card numbers are collected from a phishing site, the next step is putting the numbers to use in a way that can't easily be traced, a practice known as "carding." The fraud starts when scammers attract people through work-at-home schemes. The people, who believe they are doing a legitimate job as a packer or reshipper, assume the role of the "mule," an effective transit point to launder money or goods.

The scam works like this: The carder uses a credit card to order an item that's delivered to the mule. The mule's job is to move the goods to another person -- a fence -- who either sells the goods or moves them on to the carder.

When a fraudulent purchase is reported on the credit card, the mule is the first contact with law enforcement, and often, is liable.

Auction fraud: This scam involves users' log-in credentials for auction sites.

An Internet auction site user receives an e-mail asking about a laptop the user is supposed to send. The auction user is not supposed to send a laptop, and to resolve the misunderstanding the user is tricked into revealing information on a phishing site.

The perpetrator sells a camera on the auction site with the user's credentials. The camera buyer wires the money to the scammer, usually through a hard-to-trace wire transfer service such as Western Union, Hallam-Baker said.

The camera buyer e-mails the Web auction user asking for the camera. However, there is no camera.

Pump and dump: This hard-to-trace scam often crosses borders, making criminal investigations difficult.

A phisher will gain access to dozens of brokerage accounts and buy a few hundred dollars worth of "penny" stocks, typically those valued under US$1. The thinly traded stocks start to rise in value, and the criminals sell their own holdings on the market, Hallam-Baker said.

The U.S. Federal Bureau of Investigation has probes under way after several banks alerted the agency to this fraud, said Scott McGaunn, a special agent who investigates computer crimes.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?