The modern plague of phishing

Once upon a time, internet fraud was almost charming in its simplicity. An email arrived from a Nigerian prince, deposed general or mysteriously wealthy widow who had, through an extraordinary stroke of luck, selected you to help move several million dollars out of the country. All they needed was your bank account number. What could possibly go wrong?

These were merely old-fashioned advance-fee scams dressed up for the digital age. The con itself had been around forever. Email simply removed the cost of stamps and allowed the crooks to annoy several million people before breakfast.

But the scammers evolved. Phishing and other forms of social engineering have spread into email, instant messaging, blog comments and just about anywhere else humans can be persuaded to click something they shouldn’t. Anti-phishing filters struggle to keep pace because the people running these scams are not entirely stupid. Criminals, inconveniently, also receive software updates.

Fortunately, many phishing attempts still arrive waving enormous red flags. Atrocious spelling, mysterious IP addresses instead of proper host names, generic greetings and prose apparently translated through three languages and a kitchen appliance. These are the easy ones.

Proper fishing at Atatürk bridge in Istanbul.

Then there are nastier tricks such as IDN spoofing and cross-site scripting, where distinguishing the fake from the genuine becomes considerably harder. Even experienced computer users can get caught. Scott Hanselman did, and promptly admitted it. That should make the rest of us slightly less smug.

Modern browsers such as Firefox 2, Opera and Internet Explorer 7 now include anti-phishing protection, generally relying on blacklists of known fraudulent sites. Anti-phishing toolbars can also help by making the real domain name more obvious. All useful, but none foolproof. Because ultimately the weakest component in the security architecture remains the warm, fleshy object sitting between the keyboard and the chair.

Spam is all around.

Consider this: would you hand your car keys to some random man standing on the pavement because he confidently announced that he was the valet? Probably not.

Would you give your bank account number and PIN to a stranger on the Internet because an email containing a badly reproduced bank logo told you to? Apparently, enough people do. And that is why phishing survives.

Software developers can build better filters, browsers can flash increasingly alarming warnings and banks can cover their websites with enough security advice to wallpaper a small apartment. All of it helps. But technology cannot completely protect us from social engineering because social engineering doesn’t really attack the computer. It attacks us. And unlike Firefox, humans don’t automatically download the latest security patch.