Re: HOW TO PREVENT FHISHING ATTACKS

[John Renne <john () gniffelnieuws net>]

Hi everyone, 

This problem is a bit harder then it seems at first sight. First of all, SPF's won't help you very much. In any case, 
it's not something a bank can enforce. It's the customers e-mail provider which will have to implement this. These 
however are out of the banks control. 

The second problem is a dilemma. You can always have a communication strategy that consists of a few simple steps
- Tell all your customers official bank correspondation goes by mail from a certain address (this however is easy to 
spoof so no solution)
- Tell all your customers all of your e-mail correspondation contains some sort header / footer etc. (this however is 
easy to include / manipulate)
- Exclude mail from the official channels of communication (but what if you -want- to e-mail users)

It mostly comes down to security awareness. This is something both customers and banks should realise

A number of more things can be thought of but mostly it all breaks down to finding a balance between a few things
- ease of use for customers (if customers think it's too hard they'll find another bank)
- cost effectiveness (never spend a dollar to secure a cent)
- trust (make sure the customer gets the idea you are secure)

But this is just my 2 cents
John



On Jan 31, 2011, at 8:44 PM, Filiberto Moreno wrote:

> Hello Everyone,
>
> We were experiencing a similar scenario here at my current place of employment and we ended up having to do the 
> following steps:
>
> 1. We had all the IT support technicians to list all the applications, scheduled tasks, and services that were 
> running under the administrator account. 
> 2. Once we got the list put together we had the IT technicians remove those accounts and replace them with their own 
> and had them confirm.
> 3. Once it was confirmed the IT director changed the password on the Domain Administrator account to a very long 
> passphrase with upper case, lower case, special characters, and numbers. 
> 4. The IT director typed it up in a document and printed it out, sealed it in an envelope, and deposited it in a bank 
> safe. 
>
> Hope this helps.
>
> Fili
>
> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Patrick Webster
> Sent: Sunday, January 30, 2011 7:43 PM
> To: mzcohen2682 () aim com
> Cc: security-basics () securityfocus com
> Subject: Re: HOW TO PREVENT FHISHING ATTACKS
>
> Hi Marco,
>
> Use Sender Policy Framework - see
> http://en.wikipedia.org/wiki/Sender_Policy_Framework and
> http://www.openspf.org/
>
> SPF is a DNS txt record which indicates whether a MTA (such as
> hotmail, gmail, good ISPs) should accept email purportedly from
> @bank.com when the source IP is i.e. a botnet.
>
> -Patrick
> http://www.osisecurity.com.au/
>
> On Fri, Jan 28, 2011 at 10:44 AM,  <mzcohen2682 () aim com> wrote:
> > Hi Guys,
> >
> > I am preparing a set of recommendation for a client of mine which is a bank
> > , a set of controls against fhisging attacks, besides of telling the bank to
> > teach there customers how to protect against those attacks ( not opening
> > suspicious mails etc etc) what other recommendations are good? are there
> > some technological tools to prevent those attacks that the bank can
> > implement? I heard something about imperva radar service which should
> > protect against fishing attack, some one has experience with that tool? what
> > about other tools that the bank can implement?
> >
> > many thanks!
> >
> > Marco
> >
> > ------------------------------------------------------------------------
> > Securing Apache Web Server with thawte Digital Certificate
> > In this guide we examine the importance of Apache-SSL and who needs an SSL
> > certificate.  We look at how SSL works, how it benefits your company and how
> > your customers can tell if a site is secure. You will find out how to test,
> > purchase, install and use a thawte Digital Certificate on your Apache web
> > server. Throughout, best practices for set-up are highlighted to help you
> > ensure efficient ongoing management of your encryption keys and digital
> > certificates.
> >
> > http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> > ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------