文档介绍：Online Identity Theft:
Phishing Technology, Chokepoints and
Countermeasures
Aaron Emigh
Radix Labs
ate@
October 3, 2005
Acknowledgments
The author acknowledges sponsorship from the . Department of Homeland
Security, Science and Technology Directorate (DHS S&T). Points of view in this
document are those of the author and do not necessarily represent the official
position of the . Department of Homeland Security or the Science and
Technology Directorate. The content of this report was shaped by the members
of the Identity Theft Technology Council, a public-private partnership between
DHS S&T, SRI International, the Anti-Phishing Working Group (APWG), and
private industry. Particular thanks are due to Dan Boneh, Drew Dean, Louie
Gasparini, Ulf Lindqvist, John Mitchell, Peter Neumann, Robert Rodriguez, Jim
Roskind and Don Wilborn for their contributions.
Intended Audience
This report is intended for technically sophisticated readers such as security
practitioners, executives, researchers, and others who wish to understand
methods employed by online identity thieves and countermeasures that can
prevent such crimes.
Executive Summary
Phishing is online identity theft in which confidential information is obtained from
an individual. Phishing includes deceptive attacks, in which users are tricked by
fraudulent messages into giving out information; malware attacks, in which
malicious software causes promises; and DNS-based attacks, in which
the lookup of host names is altered to send users to a fraudulent server.
The Gartner group estimates that the direct phishing-related loss to US banks
and credit card issuers in 2003 was $ billion. Indirect losses are much higher,
including customer service expenses, account replacement costs, and higher
expenses due to decreased use of online services in the face of widespread fear
about the security of online financial transactions. Phi