Security Glitch Aids IRS Phishers

The U.S. Department of Labor said Wednesday it is working to fix aprogramming glitch in a U.S. government Web portal that makes it easierfor phishers to trick people into disclosing sensitive information. Theflaw was first exploited by phishers who, earlier this week, begansending out bogus e-mail messages asking for personal information,including social security and credit card numbers.

The bug lets these phishers redirect URLs (Uniform Resource Locators)that use the GovBenefits.gov domain to fraudulent Web sites that areunconnected with the U.S. government.

This redirecting flaw was first exploited just days ago by phishersmasquerading as the U.S. Internal Revenue Service (IRS), said GrahamCluley, a senior technology consultant with Sophos PLC, a U.K. securityfirm that has been researching the matter.

“The people behind GovBenefits.gov have implemented their software insuch a way that leaves the Web site vulnerable to a phishing attack,”he said. The technique is particularly effective because the link thatusers click on is, in fact, a genuine GovBenefits.gov link, he added.

The fraudulent e-mail claims to require the sensitive information inorder to process a tax refund, and claims to come from taxrefunds@irs.gov, the IRS said.

The GovBenefits.gov Web site is used by 16 federal agencies, includingthe IRS, and is designed to help users determine their eligibility forgovernment-funded benefit and assistance programs. It is maintained bythe Department of Labor.

Though the site’s redirect glitch is not common, Sophos has seen itbefore, usually made by programmers looking for a flexible way to moveusers around their Web sites, Cluley said. “It’s a simple mistake tomake, until you realize the consequences,” he said. “They probablydidn’t see how it could be used.”

The Department of Labor is working to fix the glitch and hopes toresolve the problem as early as late Wednesday, a Labor spokeswomansaid.

Meanwhile, the IRS published a statement Wednesday,warning users of the scam. “What we want people to know is if you getan unsolicited e-mail that purports to be from the IRS and it’s askingfor personal information, that’s bogus,” said Eric Smith, an IRSspokesman. “We’re not going to request that you provide this kind ofinformation by e-mail.”

By Robert McMillan – IDG News Service (San Francisco Bureau)