Dear Sirs

Interesting article. However I take exception to your notation of those of us who have turned this into a 'full time hobby'.
While Cyveillance and other expert companies are working hard to protect corporations and banks against phising attacks, individuals are left to fend for themselves.
Individuals, that cannot afford the services of such companies, who have been victim's of such attacks seem to have no where to turn for help except to those 'hobby' sites.
While I agree 'playing games with cyber-thieves' may not be a good idea, I also never considered my volunteer work at these 'hobby' sites a game.
These sites, and the volunteers who donate their time to helping others, are fighting the same battle as our commercial counter-parts, the only differences are the customer base, and the fee's charged.
"People just don't seem to be getting it, and I'm not sure what else the industry can do to harden consumers against the problem."
One thing they could do is support our efforts. By helping these 'hobby' sites stay online.

OK, I've been getting some feedback re the link to CastleCops and feel the need to clarify a bit.

I really only included the link to their site because they're the best example of an organized group going about this sort of infiltration and takedown approach to fighting phishing.

To be fair, it is far from a "hobbyist" operation. More like it is made up of real IT sec pros who want to help take out some of the baddies in their free time, which is a really cool effort in general.

The post itself was aimed more at individual consumers who seem to feel that they can frustrate the phishers by filling out their forms with curses and the like, but who are getting infected by drive-bys (as highlighted in the advice/research of Cyveillance).

My intent was not at all to discourage CastleCops or take anything away from what they do, I personally think it is a really admirable and cool thing that they do.. so, I'm pulling the link and apologize to any of the fine people involved with CasteCops, again, my intent was not to detract from or discourage their efforts (or imply that Cyveillance had done so).

Thanks, and sorry for the confusion! (it's good to know people are actually clicking on those links though!)

Rock on CastleCops!

Matt Hines

I second Jim's statement about CastleCops being a "full-time hobby". The CastleCops database is the most widely accessible, publicly available, source of information about phishing on the net today, and the PIRT Handlers (people who volunteer their time on the Phishing Incident Reporting and Termination Squad) offer a unique perspective about phishing to both the security research community and the victim brands.

Each bank typically looks at phish only for their brand. Each professional shutdown company has terms of service which prevent them from sharing data between customers, or publishing their results.

A PIRT Handler, by contrast, looks at dozens or even hundreds of different brands each week, and can share a quite unique viewpoint with the banks and law enforcement agents who rely on that viewpoint to help catch criminals.

Other CastleCops volunteers do the same sort of work in anti-spam, anti-spyware, and anti-malware, hunting down the websites that are hosting viruses, and helping hundreds of thousands of home users to remove malware from their home computers.

It might be a "hobby", but its certainly the most important and useful hobby I can imagine. I hope your readers will evaluate whether their own "hobby time" would be more usefully spent on watching television, or helping their fellow citizens on the Internet clean up the neighborhood.

_-_
Gary Warner
Director of Research in Computer Forensics
The University of Alabama at Birmingham
Proud PIRT Handler

While there is some debate as to how many phishing sites are harboring drive by downloads (and how well the retaliators filling out the forms have protected themselves from the possibility), a more important issue is that law enforcement does sometimes gain access to back end databases -- and uses that information to try to mitigate the harm to the victims who have given their personal information on the sites. A lot of fake data just makes that job more difficult.

Thank you for removing the aforementioned link and references. I'd just like to say that in my opinion this article is more of a somewhat windy advertisement for Cyveillance, than news.

Granted, it's important to point out that Phisher Bashing is definitely a foolhardy pursuit, and a stupid way to get infected, but a proper news article would make reference to more than one commercial service.

It also reminds me of the old arguments about which is better, payware or freeware, when both are developed by experts. Security boards which provide free services to take down phishing and malware sites are not vigilantes, since they are working in close cooperation with law enforcement.

Part of the take downs requires the assistance of the police. Whether you pay for it or get it for free, you are using the best services provided by real security experts.


Larry Stevenson
Co-author: Rootkits For Dummies, 2007
Microsoft MVP - Windows Security - 2006 & 2007