Subject: [Fwd: [isdf] need help from the ietf list...can someone post this for me? or allow me to post directly?]

From: Franck Martin <[email-masked]>
Date: 21 Dec 2003 11:32:28 +1200

-----Forwarded Message-----
From: Parry Aftab <[email-masked]>
To: [email-masked]
Subject: [isdf] need help from the ietf list...can someone post this for
me? or allow me to post directly?
Date: 20 Dec 2003 16:50:33 -0500

We have been experiencing a huge growth in phishing (e-mails designed to
trick people into providing sensitive information (creditcard, account
passwords, etc.) to a spoofed website masquerading as a trusted
financial institutional site.

For example, you receive an e-mail telling you that there has been a
security breach at PayPal, and you need to log into the site and correct
your info, by using the bogus link they provide.

Every time we announce a way to confirm that the site is what it claims
to be (checking the certificate, history bar, etc.) the phishers find a
tech solution to improve their frauds.

Now IE has a bug that allows them to mask the real site more easily, by
showing the spoofed site in the navigation bar.

Do any of the IETF members have suggestions for easy ways of confirming
that the site you just linked to is really the site you wanted to
access?

I am asking in my capacity of the world’s largest online safety and help
group, WiredSafety.org.

Parry Aftab

________________________________________________________________________

_______________________________________________
Isdf mailing list
[email-masked]
http://www.isoc.org/mailman/listinfo/isdf
----
Franck Martin
[email-masked]
SOPAC, Fiji
GPG Key fingerprint = 44A4 8AE4 392A 3B92 FDF9  D9C6 BE79 9E60 81D9 1320
"Toute connaissance est une reponse a une question" G.Bachelard

---

From: shogunx <[email-masked]>
Date: Sun, 21 Dec 2003 03:26:05 -0500 (EST)

perhaps the solution is to not use insecure microsoft software.  or
banking systems.

On 21 Dec 2003, Franck Martin wrote:

> I am asking in my capacity of the world¢s largest online safety and help
> group, WiredSafety.org.
>
>
>
> Parry Aftab
>
>
>
>
>
>
>
>
>

sleekfreak pirate broadcast
world tour 2002-3
live from the pirate hideout
http://sleekfreak.ath.cx:81/

---

From: Mark Smith <[email-masked]>
Date: Sun, 21 Dec 2003 13:25:47 +1030

And don't trust emails asking for sensitive information. Verify their requests independantly via the phone, for example, and just _don't_ use a phone number that is supplied in the email.

On Sun, 21 Dec 2003 03:26:05 -0500 (EST)

---

From: [email-masked]
Date: Sat, 20 Dec 2003 22:29:41 -0500

> your info, by using the bogus link they provide.

"Some mornings it just doesn't seem worth it to gnaw through the leather
straps." -- Emo Phillips

The attached note certainly gave me that sort of feeling...

Subject: [Full-Disclosure] PayPal issues another blow to user security
From: Aaron Horst <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Date: Mon, 15 Dec 2003 14:08:54 -0800 (PST)
List-Id: Discussion of security issues <full-disclosure.lists.netsys.com>

Just when I thought that PayPal may actually care for
their customers, I get the following message in my
inbox:

-------------------------------

Dear *********, 

This holiday season...

Put PayPal Visa® at the top of your list!

0% Intro APR* for purchases.  PLUS:

- $5 credit the first time you use your card

- No PayPal sending limit - up to available credit on
your card

- No annual fee

- New card designs to choose from! 

https://www.paypalcreditcard.com/paypalbanner?banner_id=paypal/email/

You'll have an online response in about 30 seconds. 

* The intro APR on purchases applies for 3 billing
periods after account opening. For complete pricing
information and important terms and conditions, click
here.  

https://www.paypalcreditcard.com/paypalbanner?banner_id=paypal/email/

This PayPal notification was sent to
******. Your notification preferences
are set to receive the PayPal Periodical newsletter
and Product Updates when you create a PayPal account.
To modify your notification preferences and
unsubscribe, go to https://www.paypal.com/PREFS-NOTI
and log in to your account. Changes may take several
days to be reflected in our mailings. For more
information about the security of your information,
read our Privacy Policy at
https://www.paypal.com/privacy. Replies to this email
will not be processed; if you would like to contact
PayPal, please go to our online Help Center. 

If you previously asked to be excluded from Providian
product offerings and solicitations, they apologize
for this e-mail. Every effort was made to ensure that
you were excluded from this e-mail. If you do not wish
to receive promotional e-mail from Providian, go to
http://removeme.providian.com. 

Copyright© 2003 PayPal, Inc. All rights reserved.
Designated trademarks and brands are the property of
their respective owners.  

-------------------------------

(NOTE: UID's removed)

I put it off as just another ploy to get your vital
information such as Social Security number, but decide
to check it out anyway. What do you know, it's an
"official" PayPal site! (See:
https://www.paypal.com/cgi-bin/webscr?cmd=_help-ext&leafid=1782
)

After all the work that others have done to help
people keep their vital details safe, Providian spams
all of the PayPal user base with advertisements to put
your personal details into a "PayPal" site that is
hosted on "www.paypalcreditcard.com"! This even goes
against their own stated policy on avoiding web scams:

“The term "spoofing" and "phishing" have been used to
describe the act of collecting personal information
using a fake email in order to commit identity theft,
credit card and Internet fraud. If you receive an
email that appears to come from PayPal and you click
on a link, check to make sure the web address at the
top of your web browser reads exactly www.paypal.com.”
--
https://www.paypal.com/cgi-bin/webscr?cmd=_help-ext&leafid=56413

This issue is a blow to me personally, as I have told
many people time and again not to click on any links
in any email that claims to be from PayPal, Ebay, or
other scammer oriented target. This massively
undermines the efforts that many people have put into
ensuring that less then savvy users still are able to
keep their private info private. I hope that PayPal or
any of their affiliates never do something like this again.

__________________________________
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

---

From: Mark Smith <[email-masked]>
Date: Sun, 21 Dec 2003 14:15:39 +1030

There are more scary stories at 

http://stupidsecurity.com

Some people think publishing stories like these are wrong ... in security, it is far better to learn from other people's mistakes than your own.

btw, [email-masked] and [email-masked] won't receive this ... they are rejecting my emails as "spam" purely based on my IP address, which is pseudo dynamic, via a residential  ADSL connection.

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 21 Dec 2003 14:06:17 +0900

Franck Martin (Parry Aftab);

> that the site you just linked to is really the site you wanted to

As  you know, an easy way is to just believe Microsoft and its
products.

If you are asking a way guaranteed to work, answers depend on
how much guarantee you need.

It should be noted that nothing gives absolute guarantee.

It should also be noted that PKIs are not so useful, as their
typical guarantee is mere "money back guarantee" form CAs.

							Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 22 Dec 2003 05:59:26 +0900

Parry Aftab;

> What do you suggest short of an absolute guarantee?

Common senses.

> How do I advise consumers to tell the difference between legitimate
> e-mails with embedded links and the phished ones using spoofed sites?

What if, you go to a branch office of a bank and, in a lobby of the
bank, hand a 1M USD of cash to some person whom you don't know but
who claims to be a personnel of the bank?

> I am concerned that this could seriously undermine the use of e-mail and
> websites for e-commerce and financial transactions.

Exactly.

Who said e-mail and websites are useful for e-commerce and
financial transactions with absolute guarantee?

They are only as trustworthy as e-commerce and financial
transactions over e-phones (note that most phones are
electric).

If some reseachers of cryptography have convinced you
differently, it is merely that they are more elegant
in deceiving you than most spammers.

If you want to use cryptographic technology, shared
secret cryptography works. That is, you share long
enough secret directly with a bank and have a transaction
with challenge and response authentication, the transaction
is as reliable as a bank personnel you directly know.

However, PKI does not help e-commerce or financial transactions,
as discussed in my recent paper: "Meaninglessness of Public
Key Cryptography for Authentication on Consumable Credential"
(presented in Japan in Japanese):

	Abstract: For electric transactions, the essential benefit
	of public key cryptography over shared key cryptography is
	that it is not necessary to communicate with Certificate
	Authority on each transaction. However, it is meaningless
	to use public key cryptography for authentication on
	consumable credentials, such as authentication of remaining
	credential in account for electric payment, as fraud with
	tremendous damage is easily performed, unless communication
	with authorities to manage the account decrease remaining
	credential is required on each transaction.

The problem of PKI without realtime management of remaining
credential is that an attacker can use 1K USD worth of certs
from 1000 different locations for 1000 seconds 1000 times a
second, total amount of damage of which is 1T USD.

Credential can be created only with direct communication.

						Masataka Ohta

---

From: Dean Anderson <[email-masked]>
Date: Sun, 21 Dec 2003 16:44:30 -0500 (EST)

Most scams involve things that the institutions themselves would never do,
such as calling you on the telephone or sending as email to have you
update your confidential finanical information.

The email scams are fundamntally no different from telephone scams or
door-to-door confidence scams, where the "bank" (imposter) calls you and
asks you for confidential information.  The real institution already has
this information, and they don't need it again.

The question of how to verify the Website is the wrong question to ask.  
Assume you can't verify it, and instead get the website address, phone
number, etc from your genuine bank statement.  If you get something
unusual or confusing, print it out and take it to your financial
institution.

		--Dean

On Sun, 21 Dec 2003, Mark Smith wrote:

> And don't trust emails asking for sensitive information. Verify their
> requests independantly via the phone, for example, and just _don't_ use
> a phone number that is supplied in the email.

---

From: Dean Anderson <[email-masked]>
Date: Sun, 21 Dec 2003 19:28:32 -0500 (EST)

People need to rely on their common sense.  This isn't a technical
problem. It is a social engineering problem. Your best bet is to read
Kevin Mitnick's book "The Art of Deception". Of course, there will be
instances were banks will send their customers emails.  But you should
treat those emails with the same degree of caution that you treat other
communications.  People are going to buy things over the net, and they'll
also get emails with links in them.  Not all of those emails are going to
be genuine.  Not all will be fake, either.

The scenario "your account has been hacked, you need to act fast and give
out your confidential finanical information" is never a realistic scenario
for a financial or other institution.  People need to know that when
someone tries to rush them, they need to be suspicious.  The communication
media format used (phone, email, physical presence) doesn't matter.  If
people are savvy enough to know that the person on the phone or at the
door might not really be from the bank, they should be savvy enough to
realize that the email they just got might not really be from the bank
either.  Common sense usually suggests the right answer to a particular
case.  But, some people are going to be duped, anyway.  People are taken
in by "Matchstick Men"  (movie with Nicholas Cage playing a con-artist)
every day.  There is nothing that can be done technically to protect them.

		--Dean

On Sun, 21 Dec 2003, Parry Aftab wrote:

> I agree. But frankly many Internet users (if not most) are already
> distrustful and at the same time we want to teach them to be cautious,
> asking them to pull a bank statement and compare telephone numbers when
> they have just been told their account has been hacked and they need to
> act fast, isn't realistic. Is it enough to say "never give out this
> information pursuant to an e-mail, or link sent to you online, or via
> phone for that matter?"
> 
> While we can always argue the societal issues, I was hoping you techies
> could help me on hard tech tips :-)
> Parry Aftab
> 
> -----Original Message-----
> From: Dean Anderson [mailto:[email-masked]] 
> Sent: Sunday, December 21, 2003 4:45 PM
> To: Mark Smith
> Cc: shogunx; [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [Fwd: [isdf] need help from the ietf list...can someone
> post this for me? or allow me to post directly?]
>

---

From: shogunx <[email-masked]>
Date: Mon, 22 Dec 2003 04:33:43 -0500 (EST)

> be genuine.  Not all will be fake, either.

They could probably read the packet headers.

Scott

---

From: Mark Smith <[email-masked]>
Date: Mon, 22 Dec 2003 17:13:39 +1030

On Mon, 22 Dec 2003 04:33:43 -0500 (EST)

> They could probably read the packet headers.

Two reasons not to or they won't be  :

(a) they could be faked

(b) how many mums and dads, grandmas and grand, joe six packs etc do you know who both know how to run a protocol analyser, and understand what it is saying ? Getting them to understand and use PKI will be the first challenge before that one.

I'd also recommend Bruce Schneier's "Secrets and Lies, Digital Security in a Networked Word" and his "Beyond Fear, Thinking Sensibly about Security in an Uncertain World " books.

Regards,
Mark.

---

From: "Parry Aftab" <[email-masked]>
Date: Sun, 21 Dec 2003 11:26:19 -0500

Thanks,
Parry

-----Original Message-----
From: Masataka Ohta [mailto:[email-masked]] 
Sent: Sunday, December 21, 2003 12:06 AM
To: Franck Martin
Cc: [email-masked]; [email-masked]
Subject: Re: [Fwd: [isdf] need help from the ietf list...can someone

 

							Masataka Ohta

---

From: "Parry Aftab" <[email-masked]>
Date: Sun, 21 Dec 2003 11:34:51 -0500

Is it real?
I noted that the certificate is held in paypalcreditcard.com's name, not
PayPal
Parry

---

From: "Parry Aftab" <[email-masked]>
Date: Sun, 21 Dec 2003 18:37:07 -0500

-----Original Message-----
From: Dean Anderson [mailto:[email-masked]] 
Sent: Sunday, December 21, 2003 4:45 PM
To: Mark Smith
Cc: shogunx; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Fwd: [isdf] need help from the ietf list...can someone

Most scams involve things that the institutions themselves would never
do,
such as calling you on the telephone or sending as email to have you
update your confidential finanical information.

		--Dean

---

From: "Parry Aftab" <[email-masked]>
Date: Sun, 21 Dec 2003 18:55:57 -0500

If your e-mail is being rejected, it is being rejected at the ISP lever
(Earthlink). I'll check out the site you recommended.

Thanks,
Parry

-----Original Message-----
From: Mark Smith
[mailto:[email-masked]] 
Sent: Saturday, December 20, 2003 10:46 PM
To: [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Fwd: [isdf] need help from the ietf list...can someone
post this for me? or allow me to post directly?]

Some people think publishing stories like these are wrong ... in
security, it is far better to learn from other people's mistakes than
your own.

btw, [email-masked] and [email-masked] won't receive this ... they
are rejecting my emails as "spam" purely based on my IP address, which
is pseudo dynamic, via a residential  ADSL connection.

---

From: "Parry Aftab" <[email-masked]>
Date: Sun, 21 Dec 2003 19:42:57 -0500

If not to protect them, how can you verify that s site is not being
spoofed, technically?

-----Original Message-----
From: Dean Anderson [mailto:[email-masked]] 
Sent: Sunday, December 21, 2003 7:29 PM
To: Parry Aftab
Cc: [email-masked]
Subject: RE: [Fwd: [isdf] need help from the ietf list...can someone

People need to rely on their common sense.  This isn't a technical
problem. It is a social engineering problem. Your best bet is to read
Kevin Mitnick's book "The Art of Deception". Of course, there will be
instances were banks will send their customers emails.  But you should
treat those emails with the same degree of caution that you treat other
communications.  People are going to buy things over the net, and
they'll
also get emails with links in them.  Not all of those emails are going
to
be genuine.  Not all will be fake, either.

The scenario "your account has been hacked, you need to act fast and
give
out your confidential finanical information" is never a realistic
scenario
for a financial or other institution.  People need to know that when
someone tries to rush them, they need to be suspicious.  The
communication
media format used (phone, email, physical presence) doesn't matter.  If
people are savvy enough to know that the person on the phone or at the
door might not really be from the bank, they should be savvy enough to
realize that the email they just got might not really be from the bank
either.  Common sense usually suggests the right answer to a particular
case.  But, some people are going to be duped, anyway.  People are taken
in by "Matchstick Men"  (movie with Nicholas Cage playing a con-artist)
every day.  There is nothing that can be done technically to protect
them.

		--Dean

---

From: [email-masked]
Date: Mon, 22 Dec 2003 09:34:35 -0500

The only solution is to stop distributing this type of information via email.

Microsoft had a similar issue this autumn with a group sending emails as "Microsoft Security Bulletin" and Microsoft sent the following note to all MCPs:

"STAY ALERT: MICROSOFT NEVER DISTRIBUTES SOFTWARE VIA E-MAIL

From time to time, malicious individuals circulate e-mail messages that purport to be a Microsoft Security Bulletin or patch. These messages might contain (or link to) an executable file that contains a virus. Visit TechNet and learn to look for clues that e-mail messages are not bona fide security bulletins or patches.

http://go.microsoft.com/?linkid=262639"

Frederic
MCP,  IT Project+, i-Net+, CIWA, A+
member of: CompTIA-ITPRO, HDI, IETF
------------------------------------------------------
http://fredsfastcram.netfirms.com
------------------------------------------------------
 
  ----- Original Message ----- 
  From: Parry Aftab 
  To: 'Masataka Ohta' ; 'Franck Martin' 
  Cc: [email-masked] 
  Sent: Sunday, December 21, 2003 11:26 AM
  Subject: RE: [Fwd: [isdf] need help from the ietf list...can someone post this for me? or allow me to post directly?]

  Thanks,
  Parry

  -----Original Message-----
  From: Masataka Ohta [mailto:[email-masked]] 
  Sent: Sunday, December 21, 2003 12:06 AM
  To: Franck Martin
  Cc: [email-masked]; [email-masked]
  Subject: Re: [Fwd: [isdf] need help from the ietf list...can someone
  post this for me? or allow me to post directly?]

   

  Masataka Ohta

---

From: shogunx <[email-masked]>
Date: Mon, 22 Dec 2003 16:46:40 -0500 (EST)

> Microsoft had a similar issue this autumn with a group sending emails as "Microsoft Security Bulletin" and Microsoft sent the following note to all MCPs:

Yeah, I got those too.  They came from hosts inside British Telecom.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 22 Dec 2003 15:20:20 -0500 (EST)

> If not to protect them, how can you verify that s site is not being

When you connect to a secure website, you can examine the SSL Certificate
for the site, usually by clicking on the "lock" symbol on many browsers.  
People should learn how to do this, and make it a habit of doing so when
they connect to secure sites, so they recognize when something changes.

Unfortunately, like other components of scams, the certificate might have
a similar sounding name You think you've got (eg paypal.com), but you got
Paypal-business.com. The certificate (we assume for argument) really does
belong to an entity called paypal-business.com, but is paypal-business.com
the same as paypal?  You don't know.

The best thing to do is start from (eg) paypal.com from your account
statement, etc, and examine the site certificate.  Then you have a good
chance that it is not spoofed. But it is only a chance, as it could still
be spoofed in various ways. There are lots of scenarios for this:  But
here's one:  Your computer could be infected with a virus which installed
a web proxy--then the attacker sends you a message to go update your
stuff. You type in paypal.com, but your infected browser goes to the fake
site instead.  When you try to view the certificate, your infected browser
shows you the real certificate information.  You can't easily know this
didn't happen.  But examining the certificate is a good practice.

So there are things to do that will make the con-artist's job harder, but
you can't make it impossible to be conned.  But hopefully, the police will
be able to track down the con-artists, and by doing so, will deter others.  
There is no perfect system, so we can't give any assurances that there is
a perfect system.  Nor is the case that if you do or don't do certain
things, you can't be victimized.  The best we can do is tell people to use
their common sense, so they aren't victimized by the lowest-grade of
con-artists.

The issue is not a technical issue, but a social and policy issue. You can
also be sure, as a point of policy, that if the law enforcement community
doesn't reactly swiftly and harshly to cons and frauds, then the
lowest-grade cons will be attracted to the internet, where experience and
close calls will improve their skills.  A large number of high-grade (by
that I mean very sophisticated) con-artists would be a disaster.  A large
number of low-grade con-artists creates momentum for increases in the
number of high-grade con-artists.  The policy implications are clear.

Law enforcement tends to focus on the most serious criminals: Bank robbers
who take control of a bank and enter the vault get more attention than the
person who passes a note to a teller.  This is good policy, but the "note
passers' who rob real banks aren't completely ignored.  In contrast, in
the virtual world, that's just what's been happening:  'note-passers' are
ignored altogether until they graduate to the major 'seizing control'
level.  This is bad policy.

Consider the microsoft worm perpetrator who coincided with the East Coast
Blackout. When it was suspected that it might be related to the blackout,
the police found this guy right quick. It is not hard to track these
things down with law enforcement powers.  But nearly all virus operators
are ignored, even when reported.

I operate an ISP in Boston.  I've reported several computer breakin's over
the years the Feds. They take the report and nothing happens. Now, I don't
bother. I have enough to do.  By trial and error, the crackers and 
con-artists get better.   

		--Dean

---

From: "Parry Aftab" <[email-masked]>
Date: Tue, 23 Dec 2003 18:59:28 -0500

Dean, this is very helpful. Thank you!
Parry
-----Original Message-----
From: Dean Anderson [mailto:[email-masked]] 
Sent: Monday, December 22, 2003 3:20 PM
To: Parry Aftab
Cc: [email-masked]
Subject: RE: [Fwd: [isdf] need help from the ietf list...can someone

> If not to protect them, how can you verify that s site is not being

When you connect to a secure website, you can examine the SSL
Certificate
for the site, usually by clicking on the "lock" symbol on many browsers.

Unfortunately, like other components of scams, the certificate might
have
a similar sounding name You think you've got (eg paypal.com), but you
got
Paypal-business.com. The certificate (we assume for argument) really
does
belong to an entity called paypal-business.com, but is
paypal-business.com
the same as paypal?  You don't know.

The best thing to do is start from (eg) paypal.com from your account
statement, etc, and examine the site certificate.  Then you have a good
chance that it is not spoofed. But it is only a chance, as it could
still
be spoofed in various ways. There are lots of scenarios for this:  But
here's one:  Your computer could be infected with a virus which
installed
a web proxy--then the attacker sends you a message to go update your
stuff. You type in paypal.com, but your infected browser goes to the
fake
site instead.  When you try to view the certificate, your infected
browser
shows you the real certificate information.  You can't easily know this
didn't happen.  But examining the certificate is a good practice.

So there are things to do that will make the con-artist's job harder,
but
you can't make it impossible to be conned.  But hopefully, the police
will
be able to track down the con-artists, and by doing so, will deter
others.  
There is no perfect system, so we can't give any assurances that there
is
a perfect system.  Nor is the case that if you do or don't do certain
things, you can't be victimized.  The best we can do is tell people to
use
their common sense, so they aren't victimized by the lowest-grade of
con-artists.

The issue is not a technical issue, but a social and policy issue. You
can
also be sure, as a point of policy, that if the law enforcement
community
doesn't reactly swiftly and harshly to cons and frauds, then the
lowest-grade cons will be attracted to the internet, where experience
and
close calls will improve their skills.  A large number of high-grade (by
that I mean very sophisticated) con-artists would be a disaster.  A
large
number of low-grade con-artists creates momentum for increases in the
number of high-grade con-artists.  The policy implications are clear.

Law enforcement tends to focus on the most serious criminals: Bank
robbers
who take control of a bank and enter the vault get more attention than
the
person who passes a note to a teller.  This is good policy, but the
"note
passers' who rob real banks aren't completely ignored.  In contrast, in
the virtual world, that's just what's been happening:  'note-passers'
are
ignored altogether until they graduate to the major 'seizing control'
level.  This is bad policy.

Consider the microsoft worm perpetrator who coincided with the East
Coast
Blackout. When it was suspected that it might be related to the
blackout,
the police found this guy right quick. It is not hard to track these
things down with law enforcement powers.  But nearly all virus operators
are ignored, even when reported.

I operate an ISP in Boston.  I've reported several computer breakin's
over
the years the Feds. They take the report and nothing happens. Now, I
don't
bother. I have enough to do.  By trial and error, the crackers and 
con-artists get better.   

		--Dean