full-disclosure - Re: simple phishing fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 27 Jul 2008 14:06:42 +0000
From: trejrco@...il.com
To: full-disclosure@...ts.grok.org.uk
Subject: Re: simple phishing fix

And yet some banks do, in fact, send real emails to their clients ...

Sent from my Verizon Wireless BlackBerry

-----Original Message-----
From: "lsi" <stuart@...erdelix.net>

Date: Sun, 27 Jul 2008 14:10:38 
To: <full-disclosure@...ts.grok.org.uk>
Subject: [Full-disclosure] simple phishing fix

Soo y'all know not to click on those emails from your bank, or from 
any other bank, in your inbox and now you just delete them ... why 
not automate this process?  It's easy, just filter a whole bunch of 
banking names straight to your deleted items.  

All you do is create a rule for each bank, which deletes any mail  
from that bank, automatically.

The rule should read something like "if the FROM field contains the  
string XXXXX then DELETE message".

Here's a list of strings to enter into your rules...

Royal Bank of Scotland
HSBC
NatWest
halifax.co.uk
abbeynational.co.uk
@abbey.co.uk
@abbey.com
barclays.co.uk
barclays.com
CitiBusiness
@citi.com
equifax.com
commercebank.com
bankofamerica.com
wachovia.com
capitalone.com
@nationalcity.com
.chase.com
@chase.com

The funny part is that because phish are trying to look as legitimate 
as possible, you can bet that they will use the correct domainname 
for the bank.  Which means they are extremely easy to filter... end 
of problem....  

Stu

---
Stuart Udall
stuart at@...erdelix.dot net - http://www.cyberdelix.net/

--- 
 * Origin: lsi: revolution through evolution (192:168/0.2)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/