Phishing – what it is, and how it relates to your webmail credentials

Recently, the webmail industry experienced what was believed to be a phishing incident where several thousands of credentials from Gmail, Yahoo and Hotmail accounts were exposed on a third-party site.

For those who are wondering exactly what phishing is, and how it relates to general spam: phishing  is a criminally fraudulent attempt to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy person or institution in e-mail or on a website. These credentials are used for identity theft, financial transactions and other potentially harmful activities. While “spam” refers to being targeted with unwanted emails in general (eg the common “Viagra ads”), phishing refers to attempts to obtain your webmail credentials and other identity with fraudulent intent. And unfortunately, it isn’t anything new.

But thanks to coordinated efforts across the tech industry, and partnerships between industry players who are a part of the Anti-Phishing working group, over the years most web services, users and other applications have become smarter at spotting tricks like link manipulation, phone phishing, and forged websites. Cybercriminals have adapted to improved vigilance by focusing on the consumers as easier targets than battling technology.

Unfortunately, even technologically unsophisticated attacks can be successful because people traditionally underestimate the value of their online identities, and the gates that this information can open.

In most cases, this type of phishing attack is carried out by sending a simple e-mail that appears to be from someone you know. It might appear to be from the customer support department of Hotmail or another webmail provider, or it may even appear to come from a friend of yours (most likely, the message went to their entire contact list) and asks you to provide the credentials for your webmail service or it instructs you to click a link. Probably every one of us has seen an attack like this by now!

—–

Some of the most common types of phishing attacks

1. Attacks that rely on forging identities. In one of the most common types of attacks, the attackers change the name that is associated with an email address to a trusted, familiar name, like for example, “Windows Live Customer Support” or "Bank of America," even though their e-mail address still is "yourfriendlyspammer@live.com". If you’re not paying attention, it can be easy to mistake a message like this for a genuine request from Windows Live or your bank.

2. Attacks that use stolen accounts. In a variant of phishing, the attacker uses a previously compromised user account to send a link to everyone in the contact list for that account. If you unknowingly click the link, you land on a spam, phishing, or malware download site. As you can imagine, an e-mail you get from a friend’s account significantly increases the credibility of that message, and increases the likelihood of a successful attack. So, watch out for odd or uncharacteristic e-mails that comes from a friend’s account.

3. Attacks that ask you to provide credentials via phone. In a typical phone phishing scam, the scammer may direct you to call a customer support phone number, claiming that your account will be closed or other problems will occur if you don’t call the number. A person or an audio response unit waits to take your account number, personal identification number, password, or other valuable personal data.

4. Attacks via forged websites. Many phishing attacks will convince you to trust them by including official-looking logos or other identifying information taken directly from legitimate websites. A common trick is to create a web address that resembles the name of a well-known company but is slightly altered by adding, omitting, or transposing letters. For example, the address "www.microsoft.com" could appear instead as: “www.micosoft.com” OR “www.mircosoft.com” OR “www.verify-microsoft.com”

5. Attacks using social engineering. Sometimes a scammer will include convincing details about your personal life that they found on your social networking pages. It is easy for a user to think that they are getting an email from a friend wanting to reconnect and may inadvertently provide personal information.

Once the attackers have your credentials they typically use the account for various things:

· They can use your account to send more phishing or spam messages. These could go out to people on your contact list. The response rates to campaigns using stolen e-mail accounts to send the messages are far superior to traditional campaigns because of the inherent trust your contacts have for e-mail with your name on it. Or, your email ID could be used for broader spamming, since this allows them to counter abuse detection technology for a while.

· They can sell or use information from other accounts that you’ve linked to the stolen e-mail account. If you’ve used the same password for other financial services, merchant sites, and more, the impact could be very far reaching.

· They can sell it. The resale value of a legitimate web mail account like yours is $2 a pop on the black market—twice the amount they can get for a credit card.

—–

How Microsoft helps protect you from these attacks

From a technology perspective, because so much phishing comes as spam (unsolicited e-mail, which may or may not contain phishing), our Hotmail spam filter, called SmartScreen, blocks over 4 billion unwanted e-mail messages per day by distinguishing between legitimate e-mail and spam. To put these numbers in perspective, let us assume on one day our filters were less effective on 0.01% of the blocked spam that is phishing. This would result in about 400,000 additional phishing messages getting through to peoples’ inboxes that day. And if the response rates for these phishing attempts were anywhere close to what happened in this recent Facebook incident, then about 32,000 people would be victimized by these phishing scams, during that one day. While not all of the spam that comes through Hotmail spam filters is phishing, and the actual number of users impacted per day is quite a bit lower than it would be without spam filters, these numbers illustrate the magnitude of the problem faced by our e-mail services every single day.

We also offer (as do many other online services) various layers of protection to detect attempts at stealing user credentials. For example, after x number of efforts to log in, we require additional authentication before providing a new password. This prevents guessing of passwords by anybody other than the owner of the account. This method works well, generally, because it is not suitable for any large scale attacks but is not infalliable. Guessing can work particularly effectively with systems that employ self-service password reset. For example, in September 2008, the Yahoo e-mail account of Governor of Alaska and Vice President of the United States nominee Sarah Palin was accessed without authorization by someone who was able to research answers to two of her security questions, her zip code and date of birth and was able to guess the third, where she met her husband.

Beyond SmartScreen, there are complementary technologies that are part of your browser like the Microsoft Smartscreen Filter which is free with Internet Explorer 8, which can help protect you from phishing attacks by identifying suspicious or confirmed phishing sites, and warning you before you open the page. We have implemented Extended Validation certificates and Windows Live sign-in assistant to ensure the safety of your login credentials. Plus, always remember that Microsoft will only ask for your Windows Live ID credential pair on login.live.com – nowhere else!

In general, it is a good idea to download the latest Windows updates and keep your third-party security applications up to date as well, to keep your PC safe.

Microsoft also works with law enforcement very closely. Microsoft has supported 191 enforcement actions against phishers worldwide.  Microsoft has filed civil lawsuits and has made referrals and provides support for civil and criminal actions filed by international government and law enforcement agencies.

—–

Protect yourself: Tips on recognizing phishing attacks

But no amount of technology can substitute for an alert user. Because we realize that the key is making you aware, we make significant investments every year in user education and other ways of helping to make you aware of how to combat these attacks.

One thing you’ll notice in Hotmail is that we provide several visual cues to help you detect and prevent problems. Going back to the first example we used, you can see that the safety bar at the top of the message indicates that the content might be unsafe.

We also make an effort to warn you when you may not know the sender:

Aside from the few cases when you communicate with a contact or another service for the first time, most mail you receive comes from known senders, that is, someone in your contact list or on your safe list. An unknown sender is a very important clue, telling you to use caution before interacting with the message or the sender.

You should also always look carefully at the "From" address:

The initial name shown in bold can be misleading; look for the e-mail address that is associated with it: yourfriendlyspammer@live.com (or more typically, you’ll see random strings of letters and numbers in an e-mail address, like abcxxxx123@live.com).

Pay close attention before giving valuable information away to an e-mail address like this. Note that sometimes the address itself has been disguised to look legitimate, but when you click Reply, look at the destination address. Is it the same address as the one that sent the e-mail? If different, is it another suspiciously spam-like address?

You can find more cues in the message itself. Look for claims that are outlandish (for example, that you just won money in a lottery in another country!) or things that just make no common sense.

Microsoft will never ask you to verify your password or to provide it to us via e-mail. I just can’t reinforce this enough! We would never, ever ask for this information, period. The only time you should enter your password is on an official Windows Live ID sign-in page. So no matter why they say they need such information, please never provide your credentials over e-mail, in IM, or on a forum. Sometimes the justification provided can look downright silly, for example:

Really! Would we be running the largest email service on the planet if we had "congestion problems" that prevented us from being able to host your account anymore? And if we needed you to confirm your account, we would ask you to sign in to the service, not have you send us an e-mail containing your password.

The cases that are harder to detect are the ones where one of your friends’ accounts has been compromised and the attacker is now hiding behind your friend’s identity. That scenario also makes it difficult for the e-mail service to give you many visual cues to alert you, because to our spam filters, the message looks like part of an established, trusted relationship between the receiver and the sender. In these cases, be on the lookout for outlandish claims. Does the message sound like something your friend wouldn’t usually say? If anything looks odd or uncharacteristic of your friend, the safe thing is to call up your friend and ask them (rather than replying to the sender, who may not really be your friend). You might indeed be helping your friend by letting them know that somebody has taken over their account.

—–

Here’s how YOU can help Microsoft fight phishing

Reporting spam and phishing messages helps Microsoft detect and prevent this and future attacks from making it to users inboxes. Even if this is from a friend of yours please do report because the intent is not to penalize the compromised sender but to protect the user base. The following graphic demonstrates how to report:

—-

What to do if you become the victim of a phishing attack

Let’s say you did your best, the technology did its best, and you still find that your credentials were compromised one way or the other. It happens to best of us – don’t panic.

Follow the steps outlined here to reclaim your account, and then take appropriate steps to ensure the safety of your other e-mail accounts, banking, credit card information, etc.

—

Hopefully, these tips will make your online experience safer. Protecting users is our number one goal and with educated users on our side, the ecosystem is better equipped to tackle challenges like spam and phishing.

Best,

Krish Vitaldevara
Windows Live Hotmail team

How to

November 13, 2009

95 Comments