Security threats Toolkit

Phishermen release DIY con kits

James Sherwood ZDNet.co.uk

Published: 19 Aug 2004 17:35 BST

Some Web sites are now offering surfers the chance to download free "phishing kits" containing all the graphics, Web code and text required to construct the kind of bogus Web sites used in Internet phishing scams.

According to security firm Sophos, the kits allows users to design sites that have the same look and feel as legitimate online banking sites that can then be used to defraud an unsuspecting user by getting them to reveal the details of their financial accounts.

"By putting the necessary tools in the hands of amateurs, it's likely that the number of attacks will continue to rise," said Graham Cluley, senior technology consultant at Sophos.

Sophos warned that many of the kits also contain spamming software that enables potential fraudsters to send out thousands of phishing emails with direct links to their DIY fraud sites.

"The emergence of these 'build your own phish' kits means that anyone can now mimic bona fide banking Web sites and convince customers to disclose sensitive information such as passwords," said Graham Cluley.

News of the kits will be a big setback for the National Hi-Tech Crime Unit (NHTCU) and UK banks which have gone to great lengths to educate users about attacks by 'phishers'.

Many online banking Web sites now carry messages urging users not to open any emails that they suspect may be fraudulent, and to telephone their bank for further information if they do receive suspicious email.

Phishing has become such as problem that there are now several online anti-phishing guides to educate users about the tricks used by phishing.