Phish phighters

Symantec has released Norton Confidential for Mac, a software product that utilizes a few techniques—mainly heuristics, or checking Internet URL addresses against a set of guidelines, and a watch list of known phishing sites—to help secure you against the people who wish to steal your identity, passwords, and peace of mind.

Unfortunately, to take advantage of this protection you will need to spend all of your time using the Firefox browser. Safari isn’t supported, although a Symantec representative says that Safari support is in the works. Don’t ask about Opera, Camino, Flock, iCab, or the rest of the group of plucky alterna-browsers available for Mac users. One anti-phishing step at a time.

To their credit, the browser developers themselves are also poking sharp sticks at the phishing problem. On the Mac platform, the makers of Safari and Firefox are planning anti-phishing features in their next upgrades, and the rest are sure to follow—or at least will try to keep up.

A lot of the phish fighting seems to be centered around fixing browsers. It’s great to have your browser warn you that you’re about to hand the contents of your bank account over to some dude who found you on eBay. Or, at least, it seems that he found you on eBay because you’ve received an e-mail asking you to confirm that you want to add a stranger with an even stranger username to access your PayPal account—or something just as convoluted. Building this kind of protection into browsers seems like a good idea, but will it become just another step in the oneupsmanship game that seems to define security?

Maybe the answer to phishing isn’t fixing browsers. The phishers themselves don’t care what browser you’re using. They also don’t care whether you’re using a Mac or a PC or a Commodore 64 to browse the Internet. I don’t want to get all communist versus capitalist on you, but maybe the solution to phishing is all about community. You can certainly keep buying software to try to block phishers from targeting you, but maybe—just maybe—we can expose phishers by working together as a group. Let’s devote a Web site to it and see how it goes.

Enter the PhishTank. A company called OpenDNS, who provide free DNS service, has launched PhishTank.com, a Web site that allows anyone to submit suspected phishing sites and the e-mail messages that lead to them. They’ve set up what is essentially a community watch list, in the hope that we can collectively track the bad guys and share our information. Take that, phishers.

What distinguishes PhishTank’s approach? Mainly that it’s free and open. The data collected is shared with anyone who wants it. In the world of phishing, such sharing is not exactly common. For example, the Anti-Phishing Working Group, the organization that spearheads the fight against phishing—kudos to them for leading the way—shares its data in different ways with its members. But membership is not free.

OpenDNS not only freely shares its PhishTank data, it also offers an API (application program interface) for developers. If you’re a software developer who wants to build an anti-phishing feature into your own application, you can call on information from PhishTank.com to help your users avoid phishing sites. It’s an open-source idea that deserves a shot at solving the phishing problem.

Of course, some phishing sites may only be up for a few hours before winking out of existence, making it exceedingly difficult to track them—whether you’re using professional-strength software or relying on the advice of your very smart peers.

recommended for you

Protect your Mac

Read more »

Subscribe to the Help Desk Newsletter

Comments