APWG Report Shows Identity Theft Crimeware Growth Eclipsing Conventional Phishing; Phishers Are Designing Technology to Neutralize Counter-Phishing Systems.

CAMBRIDGE, Mass. -- The Anti-Phishing Working Group (APWG) today released their July 2005 phishing report. The report shows a slight decrease in conventional phishing attacks but discloses a marked increase in crimeware: malicious software designed to steal identity information for financial crime. In July, APWG researchers have found that phishers are designing systems specifically to neutralize counter-phishing technologies that are being deployed by financial institutions and e-commerce sites.

"The technological contest between phisher and counter-phisher is well and truly underway," said APWG Chairman David Jevans. "It is a contest of escalation."

APWG researchers reported a marked increase in screenscraper technology by phishers, used to counter the graphical keyboard systems that some financial services firms are using to avoid the hazards of keylogging Trojans that phishers use to mine the usernames and passwords directly from the keyboard entry of alphanumerics and symbols. When the user mouseclicks a character on the graphical keyboard, the screenscraper takes a snapshot of the screen and sends it to the phishers' server for inspection, in one example intercepted by the researchers.

Dan Hubbard, senior director of security for Websense, Inc. and APWG analyst said, "Crimeware continues to evolve as we have seen the deployment of advanced techniques to steal information." Hubbard added, "These Trojan horses are moving beyond keylogging to now capture screenshots to obtain end-user credentials."

The APWG reported that it received some 14,135 unique phishing reports in July, down from 15,050 in June. In July 2005, 71 brands were reported as being phished, down from a high of 107 different brands being phished in May 2005. However, phishers are spreading their nets, and are moving away from some traditional marquee name financial institutions that are perennial targets, and hitting a wider base of smaller financial institutions and ISPS. Financial institutions made up 86% of all phishing targets, down slightly from a recent high of 91%.

APWG Secretary General Peter Cassidy said, "Our hope was that as the large financial institutions gained expertise in thwarting and deflecting phishing attacks, phishers and their spam-based schemes would become ineffective as probabilities of landing phishing mails into inboxes of small institutions' customers decreased their intake of user credentials."

"Instead, phishers have employed Internet marketing practices of list creation and affinity marketing to target and leverage the trust of small institutions. That is a significant part of the new play in the American context. The community thrift enjoys a special place in the American psyche and pantheon. Few other institutions have movies dedicated to them played every Christmas, starring a pre-Hitchcock Jimmy Stewart. Phishers are trying to use that trust now against them," Cassidy said.

The APWG reported that in July, there have been increased numbers of variants and new banking keyloggers. There were some 174 phishing-based Trojans detected in July, up from 154 in June. The numbers of websites which were hosting these keyloggers rose even more dramatically (almost a 100% increase). The United States and Brazil compromise almost 70% of all the sites that were hosting Trojan keyloggers and used personal hosting websites that are mostly used for online journals, blogs, and personal storage.

The full text of the report is online at: http://www.antiphishing.org/APWG_Phishing_Activity_Report_Jul_05.pdf.

About The Anti-Phishing Working Group

The Anti-Phishing Working Group (APWG) was formed in 2003 to fight identity theft and email spoofing on the Internet. The group is one of the security industry's pre-eminent consortia, with over 1,800 members from more than 1200 financial services firms, ISPs, security vendors, law enforcement agencies, law courts, regulatory agencies and consumer groups from around the world. The APWG website is www.antiphishing.org. APWG's corporate sponsors include: Able NV, ActivCard (ACTI), Adobe (ADBE), Aladdin Knowledge Systems (ALDN), Anakam, Anonymizer, Brandimensions, Clear Search, Cloudmark, Comodo, Corillian (CORI), Cydelity, Cyota, Cyveillance, Datanautics, DigitalEnvoy, Earthlink (ELNK), Entrust (ENTU), Experian, eEye Digital Security, GeoTrust, GoDaddy, Iconix, InternetIndentity, Internet Security Systems, Kaspersky Labs, MailFrontier, MarkMonitor, McAfee (MFE), MasterCard, MessageLevel, Microsoft (MSFT), NameProtect, NetIQ (NTIQ), Panda Software, PassMark Security, Quova, RSA Security (RSAS), SAIC, SecureBrain, Sigaba, SOPHOS, SquareTrade, Symantec (SYMC), The 41st Parameter, Trend Micro (TMIC), TriCipher, Tumbleweed Communications (TMWD), Vasco (VDSI), VeriSign (VRSN), Visa, Websense, Inc. (WBSN) and WholeSecurity.