1. Phishing: Trends and Countermeasures Blaine Wilson

2. Phishing What is Phishing History of Phishing Types of Phishing Examples What can we do

3. What is Phishing Phishing is the criminally fraudulent process of attempting to acquire sensitive information such as user names, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication

4. History of Phishing First documented in 1987 First called Phishing in 1996 Switched to financial institutions in 2001 2005, 1.2 million impacted, $929 million 2006, half done by Russian Business Network 2007, 3.6 million impacted, $3.2 billion

5. Targets of Phishing Phishing Spear Phishing Whaling

6. Types of Phishing Link manipulation Phone phishing

7. Link manipulation Tampering with the link to fool users – www.greatamercianinsurance.com www.greatamercianinsurance.com – www.google.com@badsite.com www.google.com@badsite.com Text not matching the link Using images for links

8. Phone phishing Leaving a phone number instead of a website

9. Examples

13. What can we do Law enforcement Industry Consumers us

14. Law enforcement Law – CAN-SPAM Act of 2003 – Anti-Phishing Act of 2005 Enforcement – 2004 Federal Trade Commission files charges – 2005 files 117 federal lawsuits – 2007 – first defendant of CAN-SPAM

15. Industry Eliminating phishing emails Monitoring and takedown of phishing sites Browsers alerting users to fraudulent websites

16. Users and Consumers Training like Anti Phishing Phil – Trains users to look at the URL – TCP/IP addresses – Misspelling

17. us Take training ourselves and pay attention Don’t condition users to click on TCP/IP addresses Get a consistent domain and suffix Don’t reduce the security settings of the browser Personalize the login process Protect against cross site forgery requests

18. Questions?