Lack of Unity Halts Progress in Fraud Battle
By Jeffrey Roman, August 22, 2012. Credit Eligible
Targeted phishing attacks are at an all-time high, and one reason for the proliferation is a non-unified response from industry and government, says Peter Cassidy of the Anti-Phishing Working Group.
Industry and government, on the one hand, are bogged down by rules and regulations, says Cassidy, secretary general of the APWG, which recently released its report on Q2 2012 global phishing activity [see: Phishing Update: ‘No Brand is Safe’].
“Therefore it has made it really difficult for us in the government and industry to be more unified in efforts to counter cybercrime in a consistent, systematized way,” Cassidy says in an interview with Information Security Media Group’s Tom Field [transcript below].
“The bad guys have one great thing going for them,” says Cassidy. “They have no rules. They have one imperative – make money.”
Organizations know these phishing attacks are going on, Cassidy explains. “But we haven’t come to the conclusion where we have decided how to make systematic and to automatically respond to these things and put them down quickly so that we close the window of opportunity of profit on these perpetrators.”
In an exclusive interview about the latest phishing trends, Cassidy discusses:
- Highlights of the APWG’s new report;
- Where organizations are gaining/losing ground;
- How to improve employee/customer resistance to phishing.
Cassidy is the secretary general of the Anti-Phishing Working Group (APWG). He has cultivated the organization since 2004 into an internationally-recognized authority on electronic crime, with more than 3,200 members from more than 1,850 information technology companies, law enforcement agencies, government ministries, universities and research institutions worldwide.
He is a product development consultant, software designer, industrial analyst and widely- published writer, speaker and commentator on information security, white collar crime and electronic crime. Cassidy has been investigating the intersection of security technologies, electronic commerce, public policy and financial crime for decades in his many capacities.
Global Phishing Activity
TOM FIELD: Let’s talk about a couple of the highlights. One of the things that jump out from the report is that attacks on brands are at an all-time high. How should we interpret that statistic?
PETER CASSIDY: It seems as if the bad guys have continued their campaign against a diversified set of brands, diverging from the big brands that have been the focus of their efforts for the first few years. Now there’s just about no brand that seems to be safe, or no kind of company or enterprise that seems to be safe from the surge of phishing. The phishers are creative in looking at any kind of relationship between a consumer and an enterprise and trying to figure out a way that they could get between those parties, pretend to be the enterprise and figure out a way that would convince the customer that he/she needed to trust them and then hand over some information that will be useful for their criminal enterprise.
FIELD: One of the other things that jumps out is that there’s a spike in the number of unique phishing sites as well. How should we read that?
CASSIDY: That statistic is really about the efficiency of the bad guys in deploying vast numbers of phishing sites, sometimes in single campaigns, to make it more difficult for the good guys to put down the campaign and to end the financial violence against the consumers. It speaks more to their strategies that are continuing to get more efficient all the time in terms of opaquing their activity through vast amounts of activity, sort of clouding it.
Trojans
FIELD: And Trojans seem to be the dominant means of infecting PCs. My question for you is: why are Trojans still so successful and what can we do better to combat them?