Headline Feeds
Phishers are using a new bait to steal sensitive information from Internet users -- keyloggers. A new phishing trends report from Websense Security Labs and the Anti-Phishing Working Group reveals a sharp rise in schemes involving this type of malicious program.
Keystroke logging, or keyloggers, are diagnostics used in software development that capture the user's keystrokes. The data can be useful to determine sources of error in computer systems, but in the wrong hands it can be a malicious tool to steal someone's identity.
New Tactic... Or Is It?
Analysts said keylogging is a new tactic for phishers, who in the past have depended more on user interaction with e-mails and instant messages that sought to lure their victims to fake sites of popular e-commerce brands.
But Basex CEO and Chief Analyst Jonathan Spira told TechNewsWorld that keylogging in and of itself is nothing new at all. He pointed to the Download.Ject worm last year, which linked to a Web site in Russia, as a prime example.
"Download.Ject exploited a flaw in Internet Explorer for which Microsoft (Nasdaq: MSFT) had no fix, known as a patch," Spira said.
"The program contains a keylogger that is designed to steal private information and hunts in particular for account data for services from eBay (Nasdaq: EBAY) and its PayPal unit, EarthLink (Nasdaq: ELNK), United Online, and Yahoo (Nasdaq: YHOO), among others. The program didn't become widespread, but attackers could still use the flaw to create more potent attacks."
Still, the combination of phishing and keylogging is newsworthy, according to Websense. The report revealed that during each week in February and March, as many as 10 new keyloggers and more than 100 malicious Web sites were hosting keylogger variants. That's compared to one or two new variants and 10 to 15 Web sites per week last November and December.
Bad News for E-Commerce?
"None of this news seems to have impacted online commerce, which has steadily increased its share of overall commerce year after year," Spira said. "Users simply need to keep their virus and malware software updated, and recognize risks such as e-mails with attachments from unknown senders and downloads from dodgy Web sites."
Indeed, especially in America. United States continues to be the top geographic location for hosting phishing sites with more than 34 percent.
China remains second with 12 percent, followed by Korea at 9 percent. Overall, phishing sites increased 28 percent since July.
Talkback: 
