by Jack McCarthy

Microsoft, eBay and Visa join forces to fight phishing

news
Feb 14, 20054 mins

Heavyweights Microsoft, eBay and Visa International joined forces Monday to combat phishing attacks, saying they will participate in the Phish Report Network, sponsored by endpoint security company WholeSecurity.

The Phish Report Network allows any company being victimized by phishing attacks to immediately report fraudulent Web sites to a central database operated by WholeSecurity.

Other companies subscribing to the Phish Report Network can then access the database or receive real-time notifications of known phishing sites, enabling them to more effectively protect consumers by blocking these sites in their user-facing security applications, according to a statement on WholeSecurity’s Website.

“Phishing is the fastest-growing segment of spam being sent worldwide today, victimizing both legitimate online companies whose brands are being hijacked and consumers who are unwittingly providing their personal information to criminals,” Ryan Hamlin, general manager of the Safety Technology and Strategy Group at Microsoft, said in a statement. “The data that the Phish Report Network will provide can help Microsoft immediately better defend our millions of users worldwide against these nefarious phishing attacks.”

The announcement was made at the opening of the RSA Conference in San Francisco.

Phishing is a fraud in which scam artists try to steal the identities of Internet users by sending out emails or links to Web pages mimicking popular Web sites. These emails and Web sites commonly ask Internet users to provide sensitive personally identifiable information, such as passwords, credit card numbers, or bank account information Reports of online identity theft scams have grown steadily for more than a year.

In December, more than 1,700 active phishing Web sites were reported, a 10 percent jump from the previous month, according to data released by the Anti-Phishing Working Group (APWG), IDG News Service said.

More than 9,000 unique e-mail messages linked to phishing scams were identified by the APWG in December, an increase of 6 percent from the month before, and a 38 percent increase over the number reported in July, according to an APWG report.

The scams are notoriously hard to shut down because those behind them often use compromised computers scattered around the globe to host phishing Web sites and to distribute the spam messages advertising the sites. The average duration of a phishing Web site was almost six days in December, with some sites operating for as long as 30 days before being shut down, the APWG reported.

Visa, eBay and Paypal, eBay’s online payment division, will report new phishing scams to the Phish Report Network. Those reports will be stored in a central database of phishing attacks maintained by WholeSecurity, where the information will be sorted into aggregated “safe lists” and “block lists” of known phishing sites. ISPs and other companies will then use those lists to update filters, black lists and other systems used to block traffic to and from the phishing sites, WholeSecurity said.

The participant members said there are strong reasons to join to fight phishing.

“eBay and PayPal’s participation in the Phish Report Network is one of many steps we have taken to improve security of the e-commerce experience,” Howard Schmidt, eBay and PayPal’s chief security strategist and former White House cybersecurity advisor, said in a statement. “As we co-develop technologies, educate online users and work with law enforcement, we can help significantly reduce the effect of cyber criminals.”

“As a leader in the payments industry, Visa is focused not just on shutting down phishing sites, but preventing phishing emails from ever reaching consumers worldwide,” said Brad Nightengale, Department Head of Emerging Products at Visa. “Working with the participants in this solution, Visa can play a key role in stopping this crime before it happens and in maintaining global consumer confidence online.”

“As the industry consolidates to fight the phishing problem, WholeSecurity be-lieves the Phish Report Network will become the cornerstone of these efforts,” said J. Peter Selda, chief executive officer of WholeSecurity. “The partnership we have formed with the founding members of the Phish Report Network is an important, groundbreaking step in reestablishing consumers’ confidence in online channels.”