'Evil Twins' and 'Pharming'
Hackers Use Two New Tricks
To Steal Online Identities;
Scams Are Harder to Detect
By KEVIN J. DELANEY
Staff Reporter of THE WALL STREET JOURNAL
May 17, 2005; Page B1
Phishing is so 2004. This year's new Web threats are "pharming" and "evil twins."
Many consumers have grown savvy to "phishing" scams, which use fake emails that appear to come from banks or other businesses to con recipients into supplying personal data over the Web. So fraudsters have come up with new tricks to steal identities online that are even harder to detect. Security experts say two of these scams with some of the most damaging potential are called evil twins and pharming.
Evil twins are wireless networks that pretend to offer trusty Wi-Fi connections to the Internet like those available at some coffee shops, hotels and conferences. On a laptop screen, an evil-twin Wi-Fi hotspot can look identical to one of the tens of thousands of legitimate public networks that consumers log on to every day, sometimes even copying the sign-in page. But that's just a front, and fraudsters who set up the connections attempt to capture any passwords or credit-card numbers that consumers using the link may type.
To protect themselves, consumers should turn a laptop's Wi-Fi function off when not in use to avoid accidentally connecting to an evil twin, security experts recommend. Some advise users to sign up for Wi-Fi services, such as the T-Mobile networks available in many Starbucks coffee shops, from computers with fixed-line Internet access so they don't have to send credit-card numbers over a wireless connection. T-Mobile provides free connection software for laptops that automatically checks a Wi-Fi network's digital ID certificate to make sure it's legitimate.
Full Story
By Michelle Delio
Pharming Out-Scams Phishing
The latest identity theft scam is even more clever than the recent rash of phishing, which I reported in an earlier Tech Tip.
Pharmers simply redirect as many users as possible from the legitimate commercial websites they'd intended to visit and lead them to malicious ones. The bogus sites, to which victims are redirected without their knowledge or consent, will likely look the same as a genuine site. But when users enter their login name and password, the information is captured by criminals.
The most alarming pharming threat is DNS poisoning, which can cause a large group of users to be herded to bogus sites. DNS -- the domain name system -- translates web and e-mail addresses into numerical strings, acting as a sort of telephone directory for the internet. If a DNS directory is "poisoned" -- altered to contain false information regarding which web address is associated with what numeric string -- users can be silently shuttled to a bogus website even if they type in the correct URL.
Experts say pharming could be combated if browsers would authenticate websites' identities. Web browser toolbars like one offered by Netcraft can alert users by displaying the true physical location of a website's host. U.S. customers, for example, would likely pause before typing in their passwords when a website that looks like their local bank's site is reported to be hosted in Russia.
"What would go a long way to protecting people would be server-side certificates," said Hinojosa. "But any certificate system would have to be widespread to be effective."
Some financial institutions, whose users are the prime targets of phishing and pharming scams, are experimenting with "multi-factor authentication" logins, including things like single-use passwords and automatic telephone call-backs confirming that a transaction is about to take place. Such practices can limit the havoc a malicious hacker can wreak with a collection of stolen logins and passwords.
Story location: Wired.com