[ISN] Worldwide Phishing Attacks May Stem from Few Sources

[InfoSec News]

http://www.eweek.com/article2/0,1759,1679953,00.asp

By Dennis Fisher 
October 19, 2004 

Research from an e-mail security provider suggests that a handful of
people are responsible for the vast majority of the phishing attacks
on the Internet and the perpetrators are using a rotating series of
zombie networks to launch them.

Researchers at CipherTrust Inc. analyzed more than four million
e-mails collected from the company's customers during the first two
weeks of October and found that nearly a third of all of the zombie
machines sending the phishing messages are based in the United States.  
That's twice as many as the 16 percent that are found in South Korea.

However, these findings do not mean that these attacks are originating
from inside these countries. The global nature of the Internet allows
attackers anywhere in the world to compromise machines in any
location. In fact, many experts believe that the majority of phishers
are in some way connected to organized crime groups in Russia or
Eastern Europe and that most such attacks begin there.

The most surprising conclusion of the research is that the attackers
sending out the phishing messages are using zombie networks of only
about 1,000 PCs.

"That's a pretty small bot network for the volume of stuff that these
guys are doing," said Dmitri Alperovitch, the research engineer at
Atlanta-based CipherTrust Inc. who conducted the study. "But the trick
is that they rotate to a different set of compromised machines each
day. They don't keep going to the same ones each time."

Crackers for years have been accumulating large networks of machines
compromised with small programs that give them the ability to control
the PCs remotely. They routinely sell or trade access to the networks
to others in the cracker underground and the PCs typically are used
either for launching DDoS (distributed denial of service attacks).

But as authorities began cracking down on spammers in recent years,
the spammers have begun relying on these networks to send out their
messages, too. Now, phishers have gotten into the game.

Alperovitch said that there are fewer than five operators in control
of the zombie networks that he identified in his research. And, even
though they're generating thousands of fraudulent e-mails every day,
their output was still a tiny fraction.less than one percent--of the
four million messages CipherTrust examined.

Phishers seem to be concentrating their efforts on a few high-profile
targets, as well. In the sample CipherTrust looked at, 54 percent of
the phishing messages used CitiGroup's Citibank name to entice
recipients. Another 13 percent use Citigroup Global Markets Inc.'s
Smith Barney's brand and eBay Inc. is the victim in about four percent
of the scams.