Phishing may be performed using number of ways including website forgery, link manipulation, filter evasion and phone phishing. (Ponnurangam, K. 2006).
Website forgery
Websites are effectively forged by the criminals by altering the address bar using java script commands which can be easily accomplished by placing the picture of a legitimate URL over the address bar, or alternately closing the original address bar and opening a new one with the legitimate URL (Mutton, Paul). Once the victim visits the website, the invader may use the flaws of the website’s own scripts against the prey. He can attack the victim using the ‘cross-site scripting’ which is on the whole very tricky, for the reason that they direct the user to ‘sign in’ at the web page of their own bank or service, where the appearance of everything including the web address or the security certificate seems accurate. Actually, the craftiness of the invader lies in creating a link to the website in order to successfully carry out and accomplish in such an attack, which is very complex and cannot be easily recognized (Krebs, Brian Flaws ‘Financial Sites Aid Scammers’).
Manipulation of Links
This method involves the designing of various types of technological tricks in order to create a link or connection in an email which appears to the victim as belonging to the spoofed or sketched organization. This can be easily accomplished by the phishers by employing the use of wrongly spelled URLs or alternately using sub domains. An additional method of doing this is by making the link of an anchor text seem valid, when in reality the link would straightaway enter the site of the phisher. A more traditional method of cheating is by the use of links which include the character ‘@’, which was formerly put to use to for the inclusion of a username or even a password (Berners-Lee, Tim.IETF Network Working Group). For instance the link ‘http://www.yahoo.com@members.mail.net/’ could easily mislead a casual surfer to suppose that the link would open the page of the yahoo website which is actually ‘www.yahoo.com’, but in reality will direct the browser to the page, ‘members.mail.net’, which has the potential to open even if the username is not provided.
Filter evasion
Even though the filtering techniques devised to block phishing is now improved, the spammers send more messages without any extra costs being levied on them as the major cost of the emails is borne by the recipient and rather than the sender. By doing so, even if some fraction of their messages is being blocked, they recompense by sending that many more messages. Another way the spammers can evade filtrations is by using various techniques to avoid spam detection approaches such as having a massive set of emails that has been constantly refreshed or by misspelling to use confusing words or even by the creation of exclusive copies in each campaign.
Phone Phishing
This is a very simple method used for phishing because it does not necessitate the existence of a website and can be easily achieved over the phone. And it is very difficult to find the source of the attack. This method is generally used prior to hacking in order to establish the background of the attack by acquiring the required information over the phone. The hacker usually presents the self as the support of the company or the administrator. It is therefore essential to think before answering since the answers can reveal more than is required. The attack could also be in the form of a simple message from a bank instructing them to dial a phone number in order to clarify certain problems regarding their bank accounts (Gonsalves, Antone, ‘Phishers Snare Victims With VoIP’), and subsequently asking them to enter their account numbers followed by the pin codes, consequently achieving the desired results. The calls are even answered by fake persons claiming to be the staff or personnel of a reputed company (‘Identity thieves take advantage of VoIP’, Silicon.com).
(This is only a random excerpt and should strictly be used as a sample only. To view the complete paper, click here)
