So, North Korea and its undoubted state-sponsored ability to conduct cyber warfare is in the frame and in the spotlight, but a new report shows that the real problem lies across the regime’s northern borders. According to research published in the latest report from the Anti-Phishing Working Group (APWG) The People’s Republic of China was directly responsible for 85 per cent of the world’s phishing scams over the first half of 2014.
Meanwhile, and in support of the APWG, research collated and analysed in ‘Global Phishing Survey, 1H 2014: Trends and Domain Name Use report concludes there were, at the minimum, 123,741 unique phishing attacks worldwide between January and June this year. The attacks hit 87,901 unique domain names, of which 22,679 were found to have been registered maliciously, mostly by Chinese phishers. The other 59,485 domains were almost all hacked or compromised domains.
Phishers expend most of their time and effort in attacking Apple. It suffered m 21,951 attempted hackings – or 17.7 per cent of all attacks. PayPal came next with 17,811 attacks, equivalent to 14.4 per cent of all cyber attacks. Third in order of phishing popularity is the Chinese online shopping site, Taobao.com. It faced16,418 attacks, or 13.2 per cent of the total.
It seems that the introduction of new top-level domains (TLDs) has not had any marked effects on the incidence of phishing. Attacks occurred in 227 TLDs, but 90 per cent of the malicious domain registrations (numbering 20,565) were in just five domains: .com, .tk, .pw, .cf., and .net. However, the new generic Top-Level Domains. including .agency, .center and .company were subject to phishing attacks over the first half of 2014.
Fortunately, defence against and aggressive reaction to such attacks is improving. The average uptime of a major phishing attack is now thirty-two and a half hours, but that is still far too long to prevent huge damage – as Sony and others can ruefully attest – and the Christmas and New year period are the ideal (and peak) times for phishing attacks to be perpetrated.