Business Security Information

If you have not read my two articles on phishing, I would recommend that you do that before reading this article.

1. Do I need My Boat to Go Phishing?
2. VOIP Phishing Scam

A new twist on this scam has come out recently, and I wanted to make sure everyone was aware of it.  RSA Security, a security firm that provides businesses with a variety of consulting services and products, has discovered what they call “chat-in-the-middle” attack.  Like most phishing scams, the attacker uses a fake web page which is set up to look like a banking website.  They get people to go to the site by sending out e-mails which contain a link to the fake website.  The difference in this attack is that the website has live chat support so the attackers can interact with their victims.

As usual, the fake website prompts the person to enter their log-in information and other sensitive information.  After the person enters the information, the attacker has a browser window open up which is meant to look like a live support or chat window.  The attacker then claims to be from the fraud department of the bank and asks the person for additional information such as name, phone number, e-mail address etc.  Currently, the attackers are using open source chat software called Jabber.  Also, according to RSA Security, only customers of one U.S. Bank are currently being targeted.  Like all scams, though, if things go well for the attackers, other banks and financial institutions will also be targeted in the future.

Even though the attackers are using e-mail to contact people to get them to go to the fake banking site, I would presume they will use other methods of contact in the future such as used in VOIP Phishing scams.  Also, the live chat support is set up to gather additional information from those visiting the fake website but it also helps provide a level of trust for people when they visit the site.  If you have concerns or questions, you have someone right there to chat with who will address your concerns.

Be aware, also be suspicious.  Do not follow links from e-mails, but go directly to the business’s website to log-in, etc., if you receive e-mails from your bank or other financial institution.  Also, read the other phishing articles noted above which will provide you with additional measures you can take to protect yourself.

Related posts:

1. VOIP Phishing Scam
2. Do I Need My Boat To Go Phishing?
3. Changes in Spear Phishing Attacks