Phishing

Escalation of Attacks

The numbers of phishing incidents have risen significantly in the past few years. According to the computer security firm RSA (Ron Rivest, Adi Shamir, and Leonard Adleman), there was on average 36,980 unique phishing attacks per month worldwide from August 2011 to August 2012, an increase of nearly 55%. A 2009 PhishTank study of 3 million banking customers over a 3-month period revealed that 45% of bank customers who were redirected to phishing sites divulged their bank login information. In 2011, the Federal Bureau of Investigation (FBI) received nearly 28,000 victim complaints of a type of phishing attack called advance fee frauds.

The escalation in phishing attacks can be attributed in part to the growing range of potential victims. Attackers are increasingly targeting users of smartphones, computer tablets, and other portable computing devices, which are increasingly used for online banking and e-commerce. In addition, social network users are being targeted by phishing scams. For example, one Facebook phishing scam baits users to click on a link, such as a viral video, which redirects the user to a phony account security verification page that solicits personal information.

Phishing attacks can be potentially more harmful in nature with the installation and spread of unauthorized software. Malicious software, or malware, is a broad term used to describe a variety of unauthorized computer code, such as viruses, worms, spyware, and adware that can compromise personal computer systems and networks. Computer viruses, for example, are self-replicating software that can spread to other computer systems, where they can steal sensitive information (spyware), propagate unwanted advertisements (adware), and disrupt larger networks. For example, an attacker can take control of a network of infected “zombie” computers, known as a “botnet,” that can be used for a variety of nefarious purposes, ranging from sending unsolicited advertisements (spam) to executing a distributed denial-of-service attack that disables websites by overwhelming their servers with requests or gaining access to networks, where information can be collected and sent to attackers.

...