Foiling the Phishers

Jim Peter · Post by **Jim Peter** » 30 Jun 2005 9:31 am

Here is part of an interesting idea I read at the "i, Cringley' site where he talks about stopping phishers.

"Of course, there has to be a better answer to this problem, and five readers in the past week have suggested it. Forget Max Levchin's idea of using bounties. But let's embrace what was at the essence of Max's idea, which is enlisting millions of Internet users in the cause.

If the bad guys out-number the cops by 1,000-to-1, Internet users must outnumber the bad guys by 100,000-to-1 or more.

Fear of punishment won't deter phishing, yet that's all traditional law enforcement has to offer. It's fear of UNPROFITABILITY that will finally work.

The simple way to kill phishing is by making it harder for the phisher to make money from it. Right now, a phisher sends out a million e-mails and gets back 100 replies that yield positive data. There is almost no effort involved in sending out the e-mails after the first one, and the quality of the return data is very high. No wonder this is such a popular business!

Let's change that. If you get phishing e-mail, go the web sites and enter false data. Make up everything -- name, sign-on name, password, credit card numbers, everything. Instead of one million messages yielding 100 good replies, now the phisher will have one million messages yielding 100,000 replies of which 100 are good, but WHICH 100?

This technique kills phishing two ways. It certainly increases the phishing labor requirement by about 10,000X. But even more importantly, if banks and e-commerce sites limit the number of failed sign-on attempts from a single IP address to, say, 10 per day, theft as an outcome of phishing becomes close to impossible.

No bounties are required, no cops, no parallel webmail systems that force us to log-in to e-commerce sites when they tell us to. Phishing just becomes a very unprofitable business, which it should be.

Are you in?"

Bill Llewellyn · Post by **Bill Llewellyn** » 1 Jul 2005 8:27 am

Jim,

Interesting idea. But is there any downside to clicking on the login links these people include in their phishing messages? Can virii or spyware be snuck onto one's PC just by visiting these bogus login pages, even without entering data?

------------------
Bill, steelin' since '99 | Steel page | MSA U12 | My music | Steelers' birthdays | Over 50?

b0b · Post by **b0b** » 1 Jul 2005 9:47 am

Smart thinking, Bill. I looked at my PayPal and Ebay cookies, and there's no unencrypted personal data in them.

I get half a dozen phish emails a day for Ebay, PayPal and banks that I don't even have accounts at. I routinely forward (as attachments) to spoof@ebay.com and spoof@paypal.com. I think I'll start joining the activist effort here, especially with the various bank phish emails. Better than just deleting them.

My email address has been stable for about 8 years now, so I'm on every dam mailing list in the world. I wake up every morning to about 20 emails, and only 3 or 4 of them are real. I probably delete 50 junk emails every day.

------------------
<img align=left src="http://b0b.com/b0bxicon.gif" border="0"> Bobby Lee
-b0b- quasar@b0b.com 
System Administrator 
My Blog

Ken Lang · Post by **Ken Lang** » 1 Jul 2005 5:15 pm

There was an article in the LA Times about stringing along the phishers, giving some examples. Tho I failed to note it, there is a site dedicated to how to string along these bassholes for weeks. Sounds like fun if you have the time.

Bobby D. Hunter · Post by **Bobby D. Hunter** » 4 Jul 2005 2:15 pm

I alos report Phishing sites, but in addition to sending a report to the spoof addresses, I also file reports via Spamcop. ISPs usually pay attention when they are notified that one of their members is doing a criminal activity. Unfortunately, most of the current crop are hosted by Chinatong, who could care less about spammers, scammers, or phishers. Others are hosted in Russia, by similarly minded criminal hostmasters.

One can make a dent in these schemes by utilizing the services of http://friedspam.net (Internet Explorer users only).

------------------
Bobby D. Hunter
Security for SGF
Hunting down Slimeball Game
Reporting member of SpamCop
[This message was edited by Bobby D. Hunter on 04 July 2005 at 03:15 PM.]

Marty Pollard · Post by **Marty Pollard** » 5 Jul 2005 3:05 pm

I've been doing this for quite a while.