Phishing Concepts & Techniques
Phishing Attack Common Techniques
Make Use of Cousin URL
Social engineering technique is often used in
phishing emails. These spoofed emails will have
similar tone of messages, logos or names of the
organisation from what appeared to be the legitimate
organisation. The objective is to entice the recipient
to enter his personal information. These fake
websites normally use Cousin URL links, which
are similar to the URL of the original website.
For example, the followings are some cousin URL
of bogus websites for banks in Hong Kong.
| List of
banks |
URL |
Examples
of Bogus Cousin URL |
Bank of China (Hong Kong)
Limited (BOCHK)
中國銀行(香港)有限公司 |
www.bochk.com |
www.bochkvip.com
www.bchk.cn |
Bank of East Asia, Limited
(BEA)
東 亞 銀 行 |
www.hkbea.com |
www.onlinebea.com
www.boeasiauk.com
www.boeauk.com
www.ebeauk.com |
Dah Sing Bank Limited
(DSB)
大 新 銀 行 |
www.dahsing.com |
www.daxinte.com
www.dlfh.com
www.dasxin.com |
DBS (Bank) Hong Kong
Limited
星 展 銀 行 （ 香 港 ） 有 限 公 司 |
www.dbs.com |
www.dbshk.net
www.dbsbankhk.com |
Fubon Bank
富邦銀行 |
www.fubonbank.com.hk |
www.fubonhk.com |
Hongkong and Shanghai
Banking Corporation Limited
匯 豐 銀 行 |
www.hsbc.com |
www.hkhsbc.com
www.hkebc.com
www.hsbccom.hk |
International Bank of
Asia Limited (IBA)
港 基 國 際 銀 行 有 限 公 司 |
www.iba.com.hk |
www.hkiba.com
www.ibabankhk.com |
Industrial and Commercial
Bank of China (Asia) Limited
中 國 工 商 銀 行 （ 亞 洲 ） |
www.icbcasia.com |
www.icbc-online.com
www.icbcasiachina.com
www.icbcasiachina.cn |
Standard Chartered Bank
(Hong Kong) Limited
渣打銀行(香港)有限公司 |
www.standardchartered.com.hk |
www.stbhk.com |
Wing Lung Bank Limited
永 隆 銀 行 有 限 公 司 |
www.winglungbank.com.hk |
www.winglungonline.net |
Make Use of Bogus URL and Browser Vulnerabilities
Some bogus websites make use of URI Syntax to
form a bogus URL to hide the bogus website address.
The URI syntax allows the format of using "@",
"%" encoding and Unicode encoding.
Microsoft has reported an IE vulnerability in
handling URL is found (MS04-004 issued on Feb
2004). A malicious user might use this syntax
to create a hyperlink that opens a bogus website
rather than the legitimate website as it appears.
This will also hide the actual visited bogus site
from displaying and showing in the Address and
Status Bar of web browser.
Top
Other Common Techniques
-
Use legitimate website's look but redirect
to another bogus website or pop-up window
to confuse visitors.
-
Use cross-site scripting technique to install
malicious codes or scripts on a legitimate
website, and then the malicious scripts will
be sent along with legitimate web contents
to the visitor's browser where they will be
executed on the visitor's computer to steal
his credentials, to exploit his browser's
vulnerabilities or to redirect the browser
to other fraudulent websites.]
-
Visual spoofing: Open a pop-up browser without
displaying the URL address, menu bar and status
bar. The phishers rebuild the menu bar, address
bar and status bar which display the fake
information. The status bar displays the "lock"
icon to confuse visitors that a secure SSL
session is loaded and enabled.
-
Use META tag to redirect the real site to
the fraudulent site at the back.
|
English
