size=2>Warnings On New Phishing Threat
Nov.
3, 2004

New, "more insidious"
phishing scam is triggered when unsuspecting users open an
E-mail.
By Thomas Claburn

Opening
the wrong E-mail may soon be enough to empty your bank account. In an effort to
woo security-conscious computer users, "phishers" have come up with a new
technique to harvest online banking details without requiring users to click on
a Web link and enter personal information on a submission form.

This new form of attack, directed specifically at users of online banking,
runs a script when a phishing E-mail message is opened, according to E-mail and
virus security company MessageLabs Ltd. The script tries to rewrite the host
files on the machine of the recipient. On subsequent attempts to access online
banking services, victims will unknowingly be redirected to a fraudulent Web
site designed to capture their log-in details.

Alex Shipp, senior antivirus technologist at MessageLabs, says such
developments only make it harder to defend against phishing. Traditional
phishing attacks rely on tricking the user into following a Web link and then
entering personal information. "This one is much more insidious," he says.

Some 3% of those targeted by phishers reveal personal information, according
to a study released in April by research firm Gartner.

Shipp adds that this new technique, which has only been detected in Brazil,
is probably being tested for wider deployment. That's what happened with
first-generation phishing attacks that were tested in Australia before being
directed at users in the United States.

Only systems that have enabled Windows Script Host are vulnerable to this
attack. WSH lets users run VBScript and JScript scripts within the Windows
operating system. Sophos plc, an antivirus company, offers href="http://www.sophos.com/support/wsh.html" target=_blank>instructions on how
to disable WSH.

"Most businesses these days probably have this disabled," Shipp says. "But
home users are more vulnerable