Phishing takes off Attacking perfect strangers for the sake of attacking them must have become blasé in 2004, because the hackers all seem to have gone phishing. My first column of the year was about phishing attacks, but I am surprised at how common it is now to receive messages from support@somebankIdontdealwith.com.Just when you think phishers cant get any more immoral, they set the bar even lower. This year we saw a fake attempt to solicit contributions for the Kerry campaign. The campaigns Internet people seem to have been pretty savvy about it and were able to sabotage the effort. Phishing attacks were increasingly used exploit vulnerabilities and install Trojan horses, but social engineering is still the bread-and-butter technique. Specifically, a link to one Web page disguised to look like a link to another Web page; the true target of the link is a fake page. But weve also begun to see anti-phishing systems that specifically look for this. A vulnerable year There were a number of significant security vulnerabilities in a variety of products in 2004, but as usual the ones with the biggest impact were in Windows and Internet Explorer. Well consider three of this years major problems. Perhaps the most widely-exploited vulnerability of the year, used by several prominent worms, was a bug in the Windows LSASS (Local Security Authority Subsystem Service). The bug was remotely exploitable without any user intervention on the computera true nightmare of an exploit. To make matters worse, Microsofts first attempt to patch this problem was itself buggy. The most prominent worm exploiting this bug, Sasser, is still endemic, even though its author, also the principal author of the Netsky worms, was arrested in May. The ASN.1 bug was scary not just because it allowed for potential complete compromise of the system, but because the vulnerable component is so pervasive throughout Windows. The ASN.1 system, which describes the encoding of data used by the system, was also the source of vulnerabilities in other systems, including Kerberos and a VPN. But this bug, despite potential for widespread damage, was not the source of any serious wave of attacks. Later in the year, Microsoft revealed that the code in Internet Explorer and other programs that parsed JPEG graphics files had a bug that could allow an attacker to take over a system simply by getting a user to view the graphic. The potential for malicious JPEG files is particularly concerning since most anti-virus scanners dont scan graphics. The fallout from this was also not as bad as it might have been. SP2 to the rescue A new, stealth version of Windows was released in 2004, but Microsoft called it a service pack. Service Pack 2 for Windows XP made profound changes in the inner workings of the operating system, intentionally breaking existing third-party products in the name of improving the security of the system. It has been successful in both regards. Since SP2 was released in August, researchers have discovered only a few security problems in spite of unprecedented scrutiny. Its record compared with earlier versions of Windows is stellar, but it does have its drawbacks. Users have reported a large number of applications that dont work on it, and some have complained that their systems wouldnt come back up after they upgraded to SP2. Still, SP2 users are more resistant to attack than their counterparts. As they grow through new system shipments, especially in the consumer space, the opportunities for attack will decline. Next page: The appliance-ization of security.
The efforts to create an e-mail authentication system are not just motivated by stopping spam. The same efforts would make it difficult to send phishing attacksor at least most of them would. The real motivation behind adding the Microsoft Caller ID parts to the Sender ID specification was to fight phishing, because SPF, the other part of Sender ID, did nothing to stop spoofing of the From: address, the one the user sees (potentially as email@example.com).