lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu Jun 29 17:21:56 2006 From: rg.viza at gmail.com (neil davis) Subject: Are consumers being misled by "phishing"? > They brought in "phishing" in 2003. The actual act of phishing had >>Nope, we had 419's a.k.a. Nigerian Scams. Similar? yes. 419's are not phishing. They never represent themselves as a well known brand name to fool customers into giving their account info to "support" or "sales" or "billing" because it needed to be updated. Rather they represent themselves as a person working for some obscure foreign bank or estate that needed your account number to transfer money to, to hold for some time, in return they would pay you, basically giving you something for nothing. That was just a garden variety scam since they were unknown and it was so obvious that they were scamming. You'd have to be an idiot to fall for that. However, if ebay sends you a note that your account needs to be updated, this is a much more plausible and since it's a well known brand name being spoofed by a con artist, fits the phishing model much better. I remember seeing the first 419's back in 1996-7 and saying to myself, "you've got to be kidding me". 419's are distinguishable from phish's in that nearly every 419 offers you something for nothing beyond supplying a complete stranger with your bank account info. This is easily picked out as a scam by anyone with a modicum of common sense. A person with a double digit IQ or who is exceptionally challenged with a serious lack of common sense might go for it. Maybe people that are new to this would lump them with phishing, but a 419 is definitely different in the ways outlined above. However phishing scams are more sophisticated in that they use well known brand names/government/authority and artwork to fool the people into believing a legitimate communication has been made and instead of promising you anything, lead you to believe that you need to update some information, which is much more plausible (and possibly scary) than getting something for nothing. The first of these appeared in AOL in the early 1990's. It's a whole different psychological tactic. Phish's appeal to fear and the urge to do the right thing, 419's appeal to greed and the desire to get money for doing no work. If you don't believe me look them up in the wikipedia. Phish and 419 are mutually exclusive types of scams. The only thing they have in common is that they are both forms of social engineering. -Neil
Powered by blists - more mailing lists