bugshaw: (Default)
posted by [personal profile] bugshaw at 10:41am on 21/10/2008
I receive a lot of phishing scam emails through my cix account. I use a text-only reader, and hyperlinks are displayed in a different colour so they stand out. These emails typically include a lot of links to images and such on a bank's bona fide site, presumably to add an air of legitimacy to a spam filter and/or to keep the email small by not including the images as jpgs.

Somewhere in the email is a link to the phishing domain, usually hidden beneath something that looks initially plausible in a browser or so that you cannot see where the link leads. Like these examples:
<a href="http://phishers.com/www.realbank.co.uk/">https://plausible-looking-login-url.realbank.co.uk/</a>
<a href="http://phishers.com/realbankcustomers.php" target=_blank type=hidden>Restore Your Realbank Account Access</a>

Given the reliance on hotlinking to elements on real bank sites, would it be a useful measure for banks to adapt their images so that if displayed other than through one of their known sites it appears as a phishing warning message?

Yes, scammers would soon find a way around this but it might throw a light on the scope of the problem for a few days, especially to the less technically savvy/suspicious.

April

SunMonTueWedThuFriSat
    1
 
2
 
3
 
4
 
5
 
6
 
7
 
8
 
9
 
10
 
11
 
12
 
13
 
14
 
15
 
16
 
17
 
18
 
19
 
20
 
21
 
22
 
23
 
24
 
25 26
 
27
 
28
 
29
 
30