full-disclosure - Are consumers being misled by "phishing"?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Jun 29 17:21:56 2006
From: rg.viza at gmail.com (neil davis)
Subject: Are consumers being misled by "phishing"?

> They brought in "phishing" in 2003. The actual act of phishing had
>>Nope, we had 419's a.k.a. Nigerian Scams. Similar? yes.

419's are not phishing. They never represent themselves as a well known
brand name to fool customers into giving their account info to "support"
or "sales" or "billing" because it needed to be updated.

Rather they represent themselves as a person working for some obscure
foreign bank or estate that needed your account number to transfer money
to, to hold for some time, in return they would pay you, basically
giving you something for nothing. That was just a garden variety scam
since they were unknown and it was so obvious that they were scamming.

You'd have to be an idiot to fall for that. However, if ebay sends you a
note that your account needs to be updated, this is a much more
plausible and since it's a well known brand name being spoofed by a con
artist, fits the phishing model much better.

I remember seeing the first 419's back in 1996-7 and saying to myself,
"you've got to be kidding me".

419's are distinguishable from phish's in that nearly every 419 offers
you something for nothing beyond supplying a complete stranger with your
bank account info. This is easily picked out as a scam by anyone with a
modicum of common sense. A person with a double digit IQ or who is
exceptionally challenged with a serious lack of common sense might go
for it. Maybe people that are new to this would lump them with phishing,
but a 419 is definitely different in the ways outlined above.

However phishing scams are more sophisticated in that they use well
known brand names/government/authority and artwork to fool the people
into believing a legitimate communication has been made and instead of
promising you anything, lead you to believe that you need to update some
information, which is much more plausible (and possibly scary) than
getting something for nothing. The first of these appeared in AOL in the
early 1990's. 

It's a whole different psychological tactic. Phish's appeal to fear and
the urge to do the right thing, 419's appeal to greed and the desire to
get money for doing no work.

If you don't believe me look them up in the wikipedia. Phish and 419 are
mutually exclusive types of scams. The only thing they have in common is
that they are both forms of social engineering.

-Neil