Dubious Australian honour as top 10 phishing attack host

Peter Dinham
Wednesday, 02 September 2009 14:59

Business IT - Security

Australia is still one of the top 10 countries to host phishing attacks, according to a new security fraud report out today,  while six countries -  the US, U.K, Italy, Canada, Spain and South Africa – have consistently suffered  the most phishing attacks.

Meanwhile, the attack rate against Australian brands remained steady, also positioning Australia in the top 10 of countries attacked by both brand and volume.

According to the RSA Anti-Fraud Command Center August report, online crime is constantly evolving, and fraudsters do not discriminate against any organisation or person, with online attacks involving phishing, pharming and Trojans now representing one of the most organised and sophisticated technological crime waves worldwide.
 
RSA warns that online criminals work day and night to steal identities, online credentials, credit card information, or any other information that they can efficiently monetize, targeting organizations in all sectors, as well as any person who uses the Internet at work or at home.
 
It also reports that these online criminals have new tools at their disposal and are able to adapt more quickly than ever with “advanced crimeware rapidly deployed using stealth mechanisms,” and says that their supply chains have evolved to match that of the legitimate business world, including the ability to provide what RSA coined “fraud-as-a-service”.

RSA also says that during its investigation of several Zeus Trojan attacks over the past three months, it covered and tracked a new online attack method employed by criminals that can quickly leverage compromised credentials. It says its research of several Zeus Trojan variants revealed that some online criminals have started using the Jabber instant messaging (IM) open protocol as a quick delivery mechanism of compromised user credentials.

“Using Jabber, stolen information is sent to these particular fraudsters as soon as it is collected from computers infected with the Zeus Trojan,” RSA says, adding that each of the Jabber IM modules detected by its team was configured to perform a different set of actions and was essentially "customized" according to the criminals' preferences.

“A typical Zeus Trojan drop server holds stolen information belonging to users with computers infected by the Trojan, and these users consist of customers of numerous financial institutions as well as other targeted organizations.”

According to RSA, in July the rate of attacks hosted by the US, in terms of its portion within the top 10 hosting countries, fell almost 30 percent to 42 percent, whereas Italy's portion, in contrast, rose by five percent, with the country hosting 26 percent of the top ten's attacks. RSA also reports that the UK resurfaced in the roster of hosting countries after a two-month absence, with nine percent, followed by Germany with eight percent.

The countries that have consistently hosted the most phishing attacks over the past year are the US, the UK, Germany, France, Russia and South Korea.