CAUCE

Phishing Landscape 2020: A Study of the Scope and Distribution of Phishing

 

Greg Aaron, Lyman Chapin, Dr. Colin Strutt and CAUCE Board Member David Piscitello, all of the Interisle Consulting Group, today announced the publication of the seminal report Phishing Landscape 2020: A Study of the Scope and Distribution of Phishing.

The report can be found at http://www.interisle.net/PhishingLandscape2020.html

The goal of the research was to capture and analyze a large set of information about phishing attacks, to better understand how much phishing is taking place and where it is taking place, and to see if the data suggests better ways to fight phishing. The group studied where phishers are getting the resources they need to perpetrate their crimes — where they obtain domain names, and what web hosting is used. This analysis helps identify where additional phishing detection and mitigation efforts are best deployed at vulnerable providers the research helped identify.

To assemble a deep and reliable set of data, the researchers collected URLs, domain names, IP addresses, and other data about phishing attacks from four widely used and respected threat data providers: the Anti-Phishing Working Group (APWG), OpenPhish, PhishTank, and The Spamhaus Project. (The authors wish to express their appreciation of the cooperation extended to them by these providers).

Over a three-month collection period, they learned about more than 100,000 newly discovered phishing sites.

These are the major findings and conclusions are based on the data collected:

1. Most phishing is concentrated at small numbers of domain registrars, domain registries, and hosting providers.
2. Phishers themselves register more than half of the domain names on which phishing occurs.
3. Domain name registrars and registry operators can prevent and mitigate large amounts of phishing by finding and suspending maliciously registered domains.
4. Registries, registrars, and hosting providers should focus on both mitigation and prevention.
5. The problem of phishing is bigger than is reported, and the exact size of the problem is unknown.
6. Sixty-five percent of maliciously registered domain names are used for phishing within five days of registration.
7. New top-level domains introduced since 2014 account for 9% of all registered domain names, but 18% of the domain names used for phishing.
8. About 9% of phishing occurs at a small set of providers that offer subdomain services.

Dave Piscitello on Ransomware

CAUCE board member Dave Piscitello talked with host Gary Berman about ransomware on the Unsung Cyber Hero podcast. He shared stories about what has happened, and what you can do about it.

Watch him here: Podcast episode

The Criminals Behind WannaCry

359,000 computers infected, dozens of nations affected world-wide! A worm exploiting a Windows OS vulnerability that looks to the network for more computers to infect! This is the most pernicious, evil, dangerous attack, ever.

The Big One Wired pronounced.

"An unprecedented attack", said the head of Europol.

Queue the gnashing of teeth and hand-wringing!

Wait, what? WannaCry isn’t unprecedented! Why would any professional in the field think so? I’m talking about Code Red, and it happened in July, 2001.

Since then dozens, perhaps hundreds of Best Common Practice documents (several of which I’ve personally worked on) have been tireless written, published, and evangelized, apparently to no good effect. Hundreds of thousands, perhaps millions of viruses and worms have come and gone.

Our words ‘update your systems, software, and anti-virus software’ and ‘back up your computer’, ignored. The object lesson taught by Code Red, from almost sixteen years ago, forgotten.

Criminal charges should be considered: Anyone who administers a system that touches critical infrastructure, and whose computers under their care were made to Cry, if people suffered, or died, as is very much the possibility for the NHS patients in the UK, should be charged with negligence. Whatever ransom was paid should be taken from any termination funds they receive, and six weeks pay deducted, since they clearly were not doing their job for at least that long.

Harsh? Not really. The facts speak for themselves. A patch was available at least six weeks prior (and yesterday, was even made available by Microsoft for ‘unsupported’ platforms such as Windows XP), as was the case with Code Red.

One representative from a medical association said guilelessly, in one of the many articles I’ve read since Friday ‘we are very slow to update our computers’. This from someone with a medical degree. Yeah, thanks for the confirmation, pal.

The worm has been stopped from spreading. For now. iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com was registered by a security researcher, and sinkholed.

Sorry, forget it. I went for a coffee while writing this, and predictably WannaCry V2 has since been spotted in the wild, without the kill-switch domain left dangling.

What have we learned from all of this, all of this for a lousy $26,000?

If someone gets arrested and charged, and by someone, I mean systems administrators, ‘CSOs’ and anyone else in line to protect systems who abjectly failed this time, a lot. WannaCry infections to critical infrastructure are an inexcusable professional lapse. Or, we could just do all of this again, next time, and people may die.

Afterthought: My organization, CAUCE.org recently turned 20 years old. When it started, we didn’t believe things could get this bad, but it wasn’t too soon after that it became apparent. I issued dire warnings about botnets in 2001 to the DHS, I made public pronouncements to these ends in 2005 (greeted by rolled eyes from an RCMP staff sergeant). I may have been a little too prescient for my own good at the time, but can anyone really say, in this day and age, that lives are at stake, and we are counting on those responsible for data safety to at least do the bare minimum? I await your comments, below.

Protecting yourself from Vishing

Many people are very trusting when they receive phone calls claiming to be from their bank, credit card company, or ISP.  However, scam phone calls are becoming more and more common every day. From the IT Support phone calls about a computer virus, or a call from your local cable company that is providing a new customer deal that is too good to be true (but are secretly trying to steal your account credentials) we are all encountering these more and more often.

As a consumer, you need to protect yourself and challenge anyone calling you so they are forced to validate who they are before you give them any information.

This is the summarized transcript from a call I had just this morning with "a representative" claiming to be from American Express* but being unwilling to validate that they were actually calling from the credit card company.

Caller: Hello, This is [Female name I missed] from American Express, is this "My Name"?

Me: Yes

C: I'm calling about an offer we sent you in the mail, did you get it?

M: What was the offer concerning?

C: If you could just validate some information I could explain the offer...

M: Sure - Can you please validate you're Amex first, then I'll validate who I am...

C: Sir, I need to validate who you are before we continue...

M: Before we continue I need you to validate you're actually Amex.

C: I don't understand what you're asking? I'm just calling to talk about an offer we sent you.

M: Great, tell me about this offer.

C: Sir, I just need to validate you're who you say you are.

M: Great, please validate that you are Amex first.

C: Sir, Please validate your DOB.

M: You called me, and I said hello and yes that's who you've reached. Please validate you're Amex.

Repeat the last 7 lines a few times and then I got tired of the conversation, said goodbye and hang up the phone.

As a consumer frequently targeted by Phone scams, it's time to start taking a stand against these phone calls and force companies to validate who they are before giving away you personal information. Companies will need to adapt to a smarter, more suspicious consumer that is looking to protect their identity.

* Maybe it actually was Amex, but they failed to validate this to me and the call ended. 

 

CRTC Do Not Call List (Canada)

FTC Do Not Call List (United States)

 

LOUDMOUTHS WANTED FOR ICANN WHOIS Replacement Work

TL;DR? It’s worth reading, BUT, if not - ICANN has yet another group looking at WHOIS, and there is ahuge push to redact it to nothing. I spend easily half my day in WHOIS data fighting online crime, losing it would not make my job harder, it will make it impossible. 

PLEASE JOIN THE ICANN GROUP and help us fight back against people who are fighting in favour of crime. 

M3AAWG has submitted at least three comments in this regard, but that’s not how ICANN works, they consider numbers of submissions to be more important than who is making a statement. M3 with hundreds of member companies, counts for one vote.

Do it now; it is time for the security community to stand up strong to this nonsense. Thanks.

 

https://community.icann.org/display/gTLDRDS/Next-Generation+gTLD+Registration+Directory+Services+to+Replace+Whois

 

Thanks,

 

Neil Schwartzman

Executive Director

Coalition Against Unsolicited Commercial Email

 

Rant shared with permission:

Subject: 

ICANN WHOIS Replacement Work

Date: March 24, 2017 at 4:05:52 PM GMT-4

 

We have been trolling them with facts for a month now. I learned a lot about that group in that time. Here’s a blood pressure boosting wall-of-text rundown:

 

The group is a bunch of registrars and “right to be forgotten” privacy people. They want to kill DomainTools and all similar services. 

 

The "privacy" advocates want domain ownership to be anonymous without a court order. They have no concern about privacy violation caused by criminals. They don’t care that anonymous free speech is already available or that the domain system they are trying to create will be tremendously dangerous for dissidents and so forth to trust. They want to create privacy by forcing us to delete data we have collected from public sources. They are extremist fanatics with ideas unburdened by knowledge. People on this mailing list have done far more to protect privacy than these so called advocates.

 

And for the registrars, it appears they are intent on saving money as they don’t want to deal with the complaints or maintenance of whois. They seem uninterested in the fact that their small savings will cause huge losses for someone else. Some are dismissive of law enforcement, and some have spoken hostile words about Spamhaus, where the only other mouths I have heard such words from belonged to spammers. The arrogance from some of them is palpable.

 

I am not exaggerating. The list archives are public, and you should decide for yourself.

_______________________________________________________

 

I don’t want this to be an entirely negative reactionary issue. There are opportunities. If enough people *who actually use WHOIS and own domains* participate, we can make WHOIS better. 

• Have you ever been irritated with a bad domain that enjoys the benefits of WHOIS privacy? 
• Have you ever been irritated that a registrar makes you visit their website and answer a CAPTCHA to see the WHOIS record, only to find out their website is broken?
• Have you ever been irritated with a registrar that gives your search warrants the middle finger and discloses no whois?
• Have you ever been irritated with registrars that minimize their exposure on DomainTools(and other WHOIS archivers) so they can appeal to abusers?

 

If we don’t participate, the risk is that bad policy hurts the Internet while increasing the profit of a minority. It has happened before. Here are some past ICANN policy issues:

• the .ZIP TLD, apparently no one involved saw a potential problem, but they certainly saw profits
• An explosion in general of TLDs that increased profits for registrars, with few controls on price abuse to the benefit of registries and the expense of everyone else.
• Companies spending hundreds of thousands of dollars to get a TLD, and domains on new TLDs- to prevent anyone else from using their name.

 

Make no mistake, killing our visibility will reduce the money they spend on abuse complaints and subpoenas. It is insane that this minuscule industry dictates policy that increases risk for the global financial system.

 

_______________________________________________________

 

In case you didn’t see this, here is a list of quotes said in earnest by people who ICANN is taking policy input from. Feel free to cross reference them with the public archives, and you will see that they absolutely believe this, and that they dominate the conversation:

 

“Shit Registrars Say"

 

On defenders losing access to WHOIS:
"Buhu my work will get harder"

--

On law enforcement stating that access is crucial:
"Good thing that police are law "enforcement" not legislators. They can ask for anything they like, it is not like it has legal binding status. It is a wish list, nothing more..." 

--

Stepping on toes:
"Harvesting and storage of whois data to be re-wrapped and sold is illegal and many registrars state this on the terms and conditions.
[...]
storage of whois data is illegal unless it was for a lawful purpose and the only one I can think of is transfers. 
[...]
This will step on some registrars toes as well as [Brand Protection professional]'s toes who have a business model around the supply of whois data for commercial gain (namely charging for it)."

--

On the legality of Domaintools and WHOIS archives:
"Who says we need a Whois Archive? The GDRP have explicitly a section about the right to be forgotten, that will say all records deleted!

The way f.ex Domaintools operate today are not in the terms of a lot of whois providers conditions and in some cases illegal" 

--

On what you can do with WHOIS data you query:
"Depends on the terms you accept when you make the whois inquiry. You may be violating the terms of the registrar or registry providing the whois service. "

----------------------------

 

Feel free to share my observations with others(TLP:GREEN) because we should spread awareness. This is regulatory capture at significant expense to us but we can stop it. Participate, vote, and we can make ICANN great again.

 

You can join the ICANN working group via this page. There is no barrier to entry, no cost, and no minimum requirement beyond filling out a statement of interest. 

 

https://community.icann.org/display/gTLDRDS/Next-Generation+gTLD+Registration+Directory+Services+to+Replace+Whois

 

We’ve played bad cop/worse cop enough. Yall to show up and say something. Right now our community's concerns receive mockery and disrespect. You need more than one voice there. You need a multitude. These people need to become a minority.

CASL Draws Third Blood

Plentyoffish Media Inc. pays $48,000 for alleged violation of Canada's anti-spam law

March 25, 2015 – Ottawa–Gatineau – Canadian Radio-television and Telecommunications Commission (CRTC)

The Canadian Radio-television and Telecommunications Commission (CRTC) today announced that Plentyoffish Media Inc. has paid $48,000 as part of an undertaking for an alleged violation of Canada’s anti-spam legislation.

Acting on complaints submitted by Canadians, the CRTC’s Chief Compliance and Enforcement Officer launched an investigation. Plentyoffish Media had allegedly sent commercial emails to registered users of the Plenty of Fish online dating service with an unsubscribe mechanism that was not clearly and prominently set out, and which could not be readily performed, as required by the legislation. The emails sent by Plentyoffish Media notified users of services available through their registration to the dating site. The alleged violation occurred between July 1, 2014 and October 8, 2014.

Once made aware of the investigation by the CRTC, Plentyoffish Media updated its unsubscribe mechanism to comply with the legislation.

As part of the undertaking, Plentyoffish Media will develop and implement a compliance program to ensure that its activities are compliant with Canada’s anti-spam legislation. The compliance program will include training and education for staff and corporate policies and procedures.

The CRTC is assessing all complaints submitted to the Spam Reporting Centre that are under its mandate and a number of investigations are currently underway. The CRTC is working with its partners, both within Canada and internationally, to protect Canadians from online threats and contribute to a more secure online environment.

The CRTC can discuss corrective actions with individuals, firms or organizations, which may lead to an undertaking that includes an amount to be paid and other corrective measures. As part of its powers, the CRTC can also issue warning letters, preservation demands, notices to produce, restraining orders and notices of violation.

Canadians are encouraged to report spam to the Spam Reporting Centre. The information sent to the Centre is used by the CRTC, the Competition Bureau, and the Office of the Privacy Commissioner to enforce Canada’s anti-spam law.

Quick Facts

• Plentyoffish Media has entered into an undertaking with the CRTC’s Chief Compliance and Enforcement Officer, under which the company has paid $48,000 for alleged non-compliance with Canada’s anti-spam legislation.
• Plentyoffish Media allegedly sent commercial emails to registered users of its online dating site that did not contain an unsubscribe mechanism that was set out clearly and prominently, and that could be readily performed.
• Once made aware of the investigation by the CRTC, Plentyoffish Media updated its unsubscribe mechanism to comply with the legislation.
• To help Canadian businesses comply with the law, the CRTC has provided numerous information sessions across the country and made guidance materials available on its website.
• The CRTC is working with its partners, both within Canada and internationally, to protect Canadians from online threats and contribute to a more secure online environment.
• Canada’s anti-spam legislation protects Canadians while ensuring that businesses can continue to compete in the global marketplace.
• Canada’s anti-spam legislation was adopted by Parliament in December 2010 and came into force on July 1, 2014.

“Prior to the coming into force of Canada's anti-spam law, the CRTC conducted numerous outreach sessions and issued guidance material on interpretation of the new requirements. Plentyoffish Media erred by sending commercial electronic messages to its registered users with unsubscribe mechanisms that were not in compliance with the law.

This case is an important reminder to businesses that they need to review their unsubscribe mechanisms to ensure they are clearly and prominently set out and can be readily performed. We appreciate that Plentyoffish Media changed its practices once it became aware of the problem. The CRTC encourages Canadians to continue to report suspected violations to the Spam Reporting Centre.”
Manon Bombardier, Chief Compliance and Enforcement Officer

CASL Draws Second Blood

Competition Bureau takes $30,000,000 CASL action against Avis and Budget

March 11, 2015 — Ottawa, ON — Competition Bureau

The Competition Bureau has taken action against what it considers to be deceptive marketing practices by two of Canada’s largest rental car companies, Aviscar and Budgetcar, and their parent company, Avis Budget Group Inc.

TO: AVISCAR INC.
1 Convair Drive E. Etobicoke, Ontario M9W 6Z9
Canada

AND TO: BUDGETCAR INC. / BUDGETAUTO INC.
1 Convair Drive E. Etobicoke, Ontario M9W 6Z9
Canada

AND TO: AVIS BUDGET GROUP, INC.
6 Sylvan Way Parsippany, New Jersey 07054
United States of America

The Bureau has filed an application with the Competition Tribunal seeking an end to alleged false or misleading price representations by Avis and Budget, a total of $30 million in administrative monetary penalties from the three companies, and refunds for consumers.

The Bureau’s investigation found that Avis and Budget advertise prices for vehicle rentals and other associated products that are not attainable due to additional fees imposed during the rental process. Furthermore, these fees are characterized as taxes, surcharges and fees that governments and agencies require Avis and Budget to collect from consumers. In fact, Avis and Budget impose these charges to recoup part of their own cost of doing business. As a result, consumers end up paying higher prices or receiving lower discounts than advertised.

Today’s action also marks the Bureau’s first proceedings under the new provisions of the Competition Act that came into force as part of Canada’s Anti-Spam Legislation (CASL) in July 2014, because Avis and Budget also use electronic messages to disseminate the alleged false or misleading representations.

Quick Facts

• The additional fees imposed by Avis and Budget can increase the cost of a rental by up to approximately 35 per cent, depending on the rental location and type of vehicle.
• Avis and Budget have collected more than $35 million in fees and surcharges from consumers since March 12, 2009.

"Consumers are entitled to clear and precise information when making their purchasing decisions and need to be confident that the information they receive regarding additional fees is truthful and accurate."
John Pecman, Commissioner of Competition

CASL Draws First Blood

CRTC Chief Compliance and Enforcement Officer issues $1.1 million penalty to Compu-Finder for spamming Canadians

March 5, 2015 – Ottawa-Gatineau - The Canadian Radio-television and Telecommunications Commission’s (CRTC’s) Chief Compliance and Enforcement Officer today issued a Notice of Violation to Compu-Finder, which includes a penalty of $1.1 million, for breaking Canada’s anti-spam law. Compu-Finder has 30 days to submit written representations to the CRTC or pay the penalty. It also has the option of requesting an undertaking with the CRTC on this matter.

Further to an investigation, the Chief Compliance and Enforcement Officer finds that Compu-Finder sent commercial electronic messages without the recipient’s consent as well as emails in which the unsubscribe mechanisms did not function properly. The emails sent by Compu-Finder promoted various training courses to businesses, often related to topics such as management, social media and professional development. The four alleged violations occurred between July 2, 2014 and September 16, 2014. Furthermore, an analysis of the complaints made to the Spam Reporting Centre of this industry sector shows that Compu-Finder accounts for 26% of all complaints submitted.

The CRTC is assessing complaints submitted to the Spam Reporting Centre that are under its legislative mandate and a number of investigations are currently underway. The CRTC is working with its partners, both within Canada and internationally, to protect Canadians from online threats and contribute to a more secure online environment.

The CRTC can discuss corrective actions with individuals, firms or organizations, which may lead to an undertaking that includes an amount to be paid and other corrective measures. As part of its powers, the CRTC can also issue warning letters, preservation demands, notices to produce, restraining orders and notices of violation.

Canadians are encouraged to report spam to the Spam Reporting Centre. The information sent to the Centre is used by the CRTC, the Competition Bureau, and the Office of the Privacy Commissioner to enforce Canada’s anti-spam law.

Quick Facts

• The CRTC’s Chief Compliance Officer has issued Compu-Finder a Notice of Violation, which includes a penalty of $1.1 million, for four violations of Canada’s anti-spam law.
• Compu-Finder had sent commercial emails without consent, as well as messages in which the unsubscribe mechanisms did not function properly.
• To help Canadian businesses comply with the law, the CRTC has provided numerous information sessions across the country and made guidance materials available on its website.
• The CRTC is working with its partners, both within Canada and internationally, to protect Canadians from online threats and contribute to a more secure online environment.
• Canada’s anti-spam law protects Canadians while ensuring that businesses can continue to compete in the global marketplace.
• Canada’s anti-spam legislation was adopted by Parliament in December 2010 and came into force on July 1, 2014.
• Penalty amounts are calculated using the factors outlined in section 20 of Canada’s anti-spam legislation.

Quote
“Prior to the coming into force of the anti-spam law, the CRTC conducted numerous outreach initiatives to increase the awareness of businesses on the new requirements. Creating a secure online environment for Canadians is also the responsibility of industry. Despite the CRTC’s efforts, Compu-Finder flagrantly violated the basic principles of the law by continuing to send unsolicited commercial electronic messages after the law came into force to email addresses it found by scouring websites. Complaints submitted to the Spam Reporting Centre clearly indicate that consumers didn’t find Compu-Finder’s offerings relevant to them. By issuing this Notice of Violation, my goal is to encourage a change of behaviour on the part of Compu-Finder such that it adapts its business practices to the modern reality of electronic commerce and the requirements of the anti-spam law. We take violations to the law very seriously and expect businesses to be in compliance.” - Manon Bombardier, Chief Compliance and Enforcement Officer, Canadian Radio-television and Telecommunications Commission

Can big companies stop being hacked?

The recent huge security breach at Sony caps a bad year for big companies, with breaches at Target, Apple, Home Depot, P.F.Chang's, Neiman Marcus, and no doubt other companies who haven't admitted it yet. Is this the new normal? Is there any hope for our private data? I'm not sure, but here are three observations.

Systems are so complex that nobody understands them

This week Brian Krebs reported on several thousand Hypercom credit card terminals that all stopped working last Sunday. Had they all been hacked? No, they were doing exactly what they'd been programmed to do.

CASL Comes into Force

We (Chris Lewis, John Levine, and myself) founded CAUCE CANADA November 30, 1998, Our dream of a Canadian anti-spam law was realized today, July 01, 2014, some 15 years and seven months later.

The process was arduous, fraught with fits and starts, setbacks and goals achieved, but with consistent hard work and an unwavering belief in the fact that end-users have the fundamental right to choose what messaging imposes itself upon them, we got it done.

Happy CASL Day, everybody.