[ news_security_news ]
Thieves Using VoIP To Phish Information
David Utter
Staff Writer
2006-04-28
 Insider Reports RSS Feed
Instead of luring victims to a maliciously crafted website to steal bank login information, some enterprising criminals use VoIP to mimic a bank telephone voice system.
(We wanted to expand upon an earlier report posted on SecurityProNews on this topic. Chris Crum contributed that previous report.)
When victims call the number listed in a phishing email and enter their personal info, the criminals record the account information and personal identification numbers. That gives them easy access to the customer accounts, security firm Cloudmark said in a report on its website.
The scheme takes advantage of the familiarity people now have with IVR systems. A phishing email urges the recipient to call the bank about a problem with an account.
Calling the number listed in the phish routes the victim over VoIP into a PBX just as a legitimate system would do. Everything has been made to sound like the legitimate bank's phone system.
A report in Sci-Tech Today said those responsible for the scam were using Asterisk, an open source software package that converts a PC into the fake PBX answering those calls. Cloudmark would not identify the VoIP provider the criminals used to obtain numbers for the phishing scam.
"We've seen two separate VoIP attacks hit our network this week, the first we've been able to analyze in detail," Adam J. O'Donnell, Ph.D., senior research scientist at Cloudmark, said in the report. "The result can be personally financially devastating."
This type of phishing scheme negates any particular advances in web browser anti-phishing technique, since the phish does not attempt to bring the victim to a website. Email addresses can be spoofed and appear legitimate should the typical user not look closely at the header of the message.
Looking at the source code of a HTML email would not reveal the problem, since the thieves could completely copy legitimate links and elements from a bank's web presence. After all, they are trying to lure victims into making a phone call instead of visiting a website.
---
Tags: VoIP, Phishing
Add to | DiggThis | Yahoo! My Web | PreFound.com
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
