Re: Survey sites used for Phishing attacks

[Chris Green <cmgreen () UAB EDU>]

I've seen an increasing number of these of late and they are a pain to deal with, especially if you take the IP based 
approach when responding.  Even URL-based ones can be of limited use since the actual form can change so often.   On a 
related note, I've been trying to look at encryption portal/email solutions so you can transport messages in an 
encrypted fashion without needing to deploy PKI.

Net result:  You send out emails that instantly ask people to click on something and enter a password. ;-)



From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Greg 
Russo
Sent: Monday, October 18, 2010 11:46 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Survey sites used for Phishing attacks

The URL being a legitimate business, has there been any contact with them for source-side measures?

Gregory Russo
Policy Program Associate, EDUCAUSE
1150 18th St NW, Suite 900, Washington DC, 20036
202-331-5371/fax: 202-872-4318
www.educause.edu<http://www.educause.edu/>

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Ram Smith
Sent: Sunday, October 17, 2010 10:37 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Survey sites used for Phishing attacks

Hi,

Just a heads up. The last Phishing attack we received used a "legitimate" survey site to solicit account information. 
With the increasing use of "The Cloud"/ Web 2.0 we are seeing the boundaries of what would be perceived by student and 
staff as legitimate correspondence from our University.

This attack made it through our spam filters too. There was no dodgy ReplyTo field, the url was a legitimate business 
and from where i sit no way of knowing if anyone had responded either.

I'm in the process of redefining our response to include some form of URL blocking involving the network team. But this 
needs to be as automated as possible.

Cheers,

ram

--

Ram Smith

Unix Team

IT&TS, Southern Cross University, Lismore, NSW, Australia

Email: ram.smith () scu edu au<mailto:ram.smith () scu edu au> Ph.: +61 2 6620 3337 Fax: +61 2 6620 3033