Phishing Tool Builds New Sites in Two Seconds

Software developers like to make installation of their programs simple and quick. So do hackers.

Analysts at RSA Security early last month spotted a single piece of PHP code that installs a phishing site on a compromised server in about two seconds, the vendor noted in its monthly online fraud report for June, released on Tuesday.

The code contains all of the HTML and graphics needed for the fraudulent website, which spoofed a financial institution that RSA did not name in the report. The “.exe” file automatically installs the code and graphics in the right directories, RSA said.

It means the hacker did not have to repeatedly access the compromised server to upload graphics or other code for the site, potentially reducing the chance of the computer’s security software or network software detecting something awry, RSA said.

“By using such kits, fraudsters will be able to further automate the process of hijacking servers and creating new phishing sites,” the report said.

It doesn’t bode well for combating the problem of phishing, where hackers try to elicit passwords or financial information via look-alike websites.

Despite efforts to quickly shut sites down, phishing sites averaged a 3.8-day life span in May, according to the Anti-Phishing Working Group, which released its latest statistics on Sunday.

Data from market analyst Gartner released last month showed that phishing attacks have doubled over the past two years.

Gartner said 3.5 million adults remembered revealing sensitive personal or financial information to a phisher, while 2.3 million said they had lost money because of phishing. The average loss is US$1,250 per victim, Gartner said.

Jeremy Kirk, IDG News Service (London Bureau)