Worldwide Phishing Attacks May Stem from Few Sources

A new study suggests that only a handful of people are responsible for the vast majority of the phishing attacks on the Internet, and that they're using fewer zombie machines than expected.

Research from an e-mail security provider suggests that a handful of people are responsible for the vast majority of the phishing attacks on the Internet and the perpetrators are using a rotating series of zombie networks to launch them.

Researchers at CipherTrust Inc. analyzed more than four million e-mails collected from the companys customers during the first two weeks of October and found that nearly a third of all of the zombie machines sending the phishing messages are based in the United States. Thats twice as many as the 16 percent that are found in South Korea.

However, these findings do not mean that these attacks are originating from inside these countries. The global nature of the Internet allows attackers anywhere in the world to compromise machines in any location. In fact, many experts believe that the majority of phishers are in some way connected to organized crime groups in Russia or Eastern Europe and that most such attacks begin there.

New measures against phishing attacks may be gaining traction. Read more here about the moves to counter cyber-crime.

The most surprising conclusion of the research is that the attackers sending out the phishing messages are using zombie networks of only about 1,000 PCs.

"Thats a pretty small bot network for the volume of stuff that these guys are doing," said Dmitri Alperovitch, the research engineer at Atlanta-based CipherTrust Inc. who conducted the study. "But the trick is that they rotate to a different set of compromised machines each day. They dont keep going to the same ones each time."

Resource Library:

Crackers for years have been accumulating large networks of machines compromised with small programs that give them the ability to control the PCs remotely. They routinely sell or trade access to the networks to others in the cracker underground and the PCs typically are used either for launching DDoS (distributed denial of service attacks).

Click here to read about how to identify phishing attacks and fight back.

But as authorities began cracking down on spammers in recent years, the spammers have begun relying on these networks to send out their messages, too. Now, phishers have gotten into the game.

Alperovitch said that there are fewer than five operators in control of the zombie networks that he identified in his research. And, even though theyre generating thousands of fraudulent e-mails every day, their output was still a tiny fraction—less than one percent--of the four million messages CipherTrust examined.

For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.

Phishers seem to be concentrating their efforts on a few high-profile targets, as well. In the sample CipherTrust looked at, 54 percent of the phishing messages used CitiGroups Citibank name to entice recipients. Another 13 percent use Citigroup Global Markets Inc.s Smith Barneys brand and eBay Inc. is the victim in about four percent of the scams.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

Be sure to add our eWEEK.com Security news feed to your RSS newsreader or My Yahoo page

Reader Comments: Worldwide Phishing Attacks May Stem from Few Sources >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Dennis Fisher