APWG Report: Even More Victims of Phishing Attacks Remain Clueless About Violations of Their Websites

Phishers continue to target legitimate websites to host phishing pages and victims of these attacks are frequently unaware that they are hosting phishing sites until external parties notify them

CAMBRIDGE, Mass.--(BUSINESS WIRE)--The Anti-Phishing Working Group (APWG) is reporting this week that attackers confidently exploit legitimate websites with the same methods and that they succeed because victims are not implementing recommended best practices, countermeasures and responses.

“Take the frequency of ‘I don’t know’ responses in the survey and factor in that the majority of attacks are reported by external parties”

“Phishers continue to target legitimate websites because they are much harder for interveners to take down. They remain confident that they’ll be able to identify and exploit sites, and for good reason. Victims are not taking measures to secure their sites from attack, and they remain lax in monitoring against and mitigating attacks,” said APWG Research Fellow Dave Piscitello of ICANN.

From August 2009 through July 2012, the APWG’s Internet Policy Committee (IPC) surveyed managers of websites of websites that had been compromised and subsequently used to host phishing pages. The report compares two sampling periods to study change in attacker methodology, victim hosting environments, and incident response by victims or their hosting providers.

The full report is here: apwg.org/reports/apwg_web_vulnerabilities_survey_revisited.pdf

The survey results indicate that LAMP - Linux, Apache, MySQL, PHP - remains the most frequently targeted hosting environment. However, closer examination of the responses reveals that attackers most frequently leave PHP shell code (i.e., a backdoor written in the PHP scripting language), phishing kits (web pages or scripts that are used to execute the phishing attack itself), or a mechanism to send email to animate a phishing attack.

“The high frequency of PHP exploits underscores our previous recommendations: you must keep all components of your website - OS, web server, applications, and especially active content - patch current and configured securely,” concluded Mr. Piscitello.

The majority of victims continue to report that they were unaware that their website had been compromised until an external party notified them. “More than 80 percent of incidents are being detected by third parties, and that percentage increased over the past year,” reports APWG IPC Co-Chair Rod Rasmussen of Internet Identity. “We are concerned that hosting providers and site owners are becoming more complacent and vulnerable, and we urge administrators to be more proactive.”

Take down time for phishing pages remains unchanged. Victims report that forty percent of phishing pages are taken down within a day and nearly sixty percent within 2-3 days, but nearly one in four victims could not say with accuracy when pages were removed. The report examines this and other disturbingly high incidences where victims reported they had insufficient data to answer survey questions.

“Take the frequency of ‘I don’t know’ responses in the survey and factor in that the majority of attacks are reported by external parties,” said IPC Co-Chair Greg Aaron of Illumintel, Inc. “Too little time or talent is invested to monitor and analyze web traffic and visitor behavior.”

If your website was abused to abet a phishing attack, and you would be willing to complete the survey, please contact the APWG or have your investigator contact the corresponding author, Dave Piscitello, at [e-mail] or IPC Co-Chair, Rod Rasmussen, at [e-mail]. The online survey instrument remains open at this URL: http://www.zoomerang.com/Survey/WEB229GLB7E43E.

APWG IPC researchers continue to collect responses and will take periodic snapshots to observe whether phishing attacks change over time, and if so, how. A complete analysis of the survey results—with specific recommendations, remedies, and practices—is in preparation by APWG IPC, which expects to publish this report later this year.

About the APWG

The APWG, founded in 2003 as the Anti-Phishing Working Group, is the global industry, law enforcement, and government coalition focused on unifying the global response to electronic crime. Membership is open to qualified financial institutions, online retailers, ISPs and Telcos, the law enforcement community, solutions providers, multi-lateral treaty organizations, research centers, trade associations and government agencies. There are more than 2,000 companies, government agencies and NGOs participating in the APWG worldwide. The APWG's www.apwg.org and education.apwg.org websites offer the public, industry and government agencies practical information about phishing and electronically mediated fraud as well as pointers to pragmatic technical solutions that provide immediate protection. The APWG is co-founder and co-manager of the STOP. THINK. CONNECT. Messaging Convention, the global online safety public awareness collaborative www.stopthinkconnect.org and founder/curator of the eCrime Researchers Summit, the world’s only peer-reviewed conference dedicated exclusively to electronic crime studies www.ecrimeresearch.org.

Among APWG's corporate sponsors are as follows: Abaca, Afilias Ltd., AhnLab, AT&T(T), Avast!, AVG Technologies, BBN Technologies, Barracuda Networks, BillMeLater, Bkav, Booz Allen Hamilton, Blue Coat, BrandMail, BrandProtect, Bsecure Technologies, Check Point Software Technologies, Comcast, CSIRTBANELCO, Cyber Defender, Cyveillance, DBAPP Security, Domain Tools, Digiware, Easy Solutions, eBay/PayPal (EBAY), eCert, EC Cert, ESET, EST Soft, Facebook, Fortinet, FraudWatch International, F-Secure, GlobalSign, GoDaddy, Google, GroupIB, Hauri, Hitachi Systems, Ltd., Huawei Symantec, ICANN, Iconix, IID, IronPort, ING Bank, Intuit, IT Matrix, Kindsight, LaCaixa, Lenos Software, MailShell, MarkMonitor, M86Security, McAfee (MFE), Melbourne IT, MessageLevel, Microsoft (MSFT), MicroWorld, Mirapoint, MyPW, nProtect Online Security, Netcraft, Network Solutions, NeuStar, Nominet, Nominum, Public Interest Registry, Panda Software, Phishlabs, Phishme.com, Phorm, Planty.net, Prevx, Proofpoint, QinetiQ, Return Path, RSA Security (EMC), RuleSpace, SAIC (From Science to Solutions), SalesForce, SecureBrain, S21sec, SIDN, SoftForum, SoftLayer, SoftSecurity, SOPHOS, SunTrust, SurfControl, Symantec (SYMC), Tagged, TDS Telecom, Telefonica (TEF), TransCreditBank, Trend Micro (TMIC), Vasco (VDSI), VeriSign (VRSN), Websense Inc. (WBSN), Wombat Security Technologies, Yahoo! (YHOO), zvelo and ZYNGA.