Phishing Vulnerabilities In Microsoft's Internet Explorer, Plus A New Server-Access Ploy - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
News
Commentary
1/20/2004
05:47 PM
Commentary
Commentary
Commentary
50%
50%

Phishing Vulnerabilities In Microsoft's Internet Explorer, Plus A New Server-Access Ploy

Until recently, consumer advocates recommended that you check the browser's URL window and make sure it confirms that you've linked to the site you expected. If the two didn't match, you knew you were being spoofed from a phished link.

However, Internet Explorer allows the spoofed site to appear to be the one you trusted. People relying on consumer-safety tips to avoid becoming victims of spoofed and phished links would find themselves tricked into compliance.

When the vulnerability was discovered in mid-2003, Microsoft responded by saying it was looking into the problem. When I consulted one of their spokesmen in December 2003, the company still hadn't taken any action or made any firm decision about what, if anything it will do to close the vulnerability. The spokesman indicated that perhaps Micrososft would include a patch in its monthly patch updates, but wasn't certain. But since the real answer here isn't turning our customers into cybersleuths to spot the latest fraud, it really doesn't make much of a difference if or when it patches the vulnerability.

Roundabout Server Access
Although phishing incidents involving third-party E-mails are the most common, a new scheme has arisen involving cybercriminals seeking access to your company's servers.

An E-mail is sent to those within the corporation, appearing to be from internal legal, IT, or security administrators. The E-mail announces a security breach, or problem within the network. It advises the employee to log into the company's network, using the link provided in the E-mail. Once the employee types in their login and password, the phishing expedition was successful. They now have access to the company's communications and password protected network. By targeting employees with all levels of access, to all segments of the server, they are able to gain access to most, if not all, of the server data and infrastructure.

So, look within, as well as to outside communications when warning your employees about intrusions and fraud. It's well known that the fastest way to break security on a secure network is to fool someone with access into letting you in. Don't let your employees provide the key to the burglars. Set up a confirmation process and make sure your employees know how you will communicate any security breach. Make sure they have a contact E-mail or telephone number where they can confirm the validity of any communication, and a network posting of any emergency announcements. Forewarned is forearmed.

Return to: Which Kills E-Commerce Faster, The Cure Or The Disease?

Continue to the sidebars:
Phishing By Brand Name: Tips On How To Check For Fraud, and
Tips On Spotting A Spoofed Link

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
State of the Cloud
State of the Cloud
Cloud has drastically changed how IT organizations consume and deploy services in the digital age. This research report will delve into public, private and hybrid cloud adoption trends, with a special focus on infrastructure as a service and its role in the enterprise. Find out the challenges organizations are experiencing, and the technologies and strategies they are using to manage and mitigate those challenges today.
Slideshows
What Digital Transformation Is (And Isn't)
Cynthia Harvey, Freelance Journalist, InformationWeek,  12/4/2019
Commentary
Watch Out for New Barriers to Faster Software Development
Lisa Morgan, Freelance Writer,  12/3/2019
Commentary
If DevOps Is So Awesome, Why Is Your Initiative Failing?
Guest Commentary, Guest Commentary,  12/2/2019
Register for InformationWeek Newsletters
Video
Current Issue
The Cloud Gets Ready for the 20's
This IT Trend Report explores how cloud computing is being shaped for the next phase in its maturation. It will help enterprise IT decision makers and business leaders understand some of the key trends reflected emerging cloud concepts and technologies, and in enterprise cloud usage patterns. Get it today!
White Papers
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll