Until recently,
phishing -- a scam in which Internet fraudsters send spam or pop-up messages to lure personal and financial information from unsuspecting victims --
seemed to be dying down.
Not anymore. Scammers and attackers are back with new ways to steal your personal data.
USA Today reported that "
phishing attacks suddenly spiked 200 percent from May through September, according to IBM's X-Force research team. Phishers are going after log-ons to Web mail, social networking and online gaming accounts, security experts say."
USA Today said that Web-based e-mails are the most valuable targets and that people are getting lazy about changing their passwords:
"In the evolving cyberunderground, valid Web mail accounts, in particular, are considered highly valuable 'virgin' assets, useful for sending out viral e-mail messages likely to go unblocked by spam filters, Sophos researcher Beth Jones says.
"Virgin mail accounts have become hot commodities; a valid log-on to a Windows Live, Gmail, YahooMail or AOL e-mail account can sell for as much as $2 -- more than double what a stolen credit card account number fetches, says Fred Rica, principal at PricewaterhouseCoopers' security practice.
"Cybercriminals are attuned to the fact that many people use their free Web mail account address to open financial, social network, travel and other online accounts. 'Your e-mail account is the key to your online persona,' says Henry Stern, Cisco security researcher.
"And yet a recent Sophos survey found 33 percent of the respondents used just one password online, while 48 percent used just a few different ones. 'The sad reality is most people use the same user names and passwords on many different Web sites,' says Sam Masiello, threat researcher at McAfee's MX Logic messaging security section."
PC World said
a single group might be responsible for a quarter of all attacks worldwide.
"Called Avalanche, the gang started work late last year and has been increasing its activity since, according to a report by the Anti-Phishing Working Group. 'This criminal operation is one of the most sophisticated and damaging on the Internet and targets vulnerable or non-responsive registrars and registries,' the report says.
"The group attacks financial institutions, online services and job-search providers using fast-flux techniques that hide its actual attack sites behind an ever-changing group of proxy machines, mainly hacked consumer computers, according to APWG's latest Global Phishing Survey."
Additional resources
