Attacks/Breaches
1/23/2009
04:52 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Phishing Doesn't Pay, Microsoft Finds

Lured by bad math and get-rich-quick pipe dreams into a life of cybercrime, those phishing for dollars confront a problem not unlike that faced by traditional anglers: too few fish in the sea.

Phishing doesn't pay very well and tends to attract low-skill hackers who themselves become victims.

So say two Microsoft researchers, Cormac Herley and Dinei Florencio, in their recently published paper, "A Profitless Endeavor: Phishing As Tragedy Of The Commons."

"Far from being an easy money proposition we claim that phishing is a low-skill, low-reward business, where the average phisher makes about as much as if he did something legal with his time," the paper says.

Part of the blame for this sorry state of affairs can be laid at the feet of exaggerated phishing loss estimates. "We estimate that recent public estimates overstate phishing losses by as much as a factor of 50," the paper explains.

Who might be to blame for such inflation? Try the media, which finds big dangers more compelling than little ones, and the security industry, which can't sell goods or services in the absence of a clear and present danger.

Lured by bad math and get-rich-quick pipe dreams into a life of cybercrime, those phishing for dollars confront a problem not unlike that faced by traditional anglers: too few fish in the sea. The result is what's known as the tragedy of the commons, wherein a limited resource becomes depleted when self-interest supersedes group interest.

"The easier phishing gets, the worse the economic picture for phishers," the paper says. "As phishers put more and more effort into the endeavor the total revenue falls rather than rises." Based on that finding, Herley and Florencio conclude that increased phishing volume indicates a decrease in total revenue, as phishers compete to capture the limited pool of phishing money.

Phishing appears to operate like every gold rush: The ones making money are the ones selling tools to starry-eyed prospectors, or servers to Web 2.0 startups.

As the paper's authors put it, "Indeed, one explanation of the thriving trade in phishing-related services ... is that phishers with more experience prey upon those with less. That is, those who have tried phishing and found it unprofitable or marginally profitable find it better to sell services to those who haven't reached that conclusion yet."

This supposition is supported by a paper presented last year at the Usenix Conference, "There Is No Free Phish: An Analysis Of 'Free' And Live Phishing Kits." It found that the big phishers -- the authors of phishing kits -- preyed on the little phishers who used their phishing kits.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4262
Published: 2014-07-28
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-...

CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2013-7393
Published: 2014-07-28
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions...

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.