Researchers Exposed Do-it-Yourself Phishing Service

Security researchers at FaceTime Security Labs have discovered a Website for hacking that offers text for "Do-it-Yourself (DIY) phishing service" with which phishing e-mails could be created and used to grab login data for popular social networking and Web mail sites.

The Website's menu column offers phishing e-mail alternatives for Yahoo!, Hotmail, Orkut, MySpace, hi5 and Facebook.

A hacker planning to use the "DIY phishing service" needs to first decide which social networking or e-mail service of the victim it intends to target. Choosing the type of electronic card message for the victim and the service planned to phish is as simple as using the menu.

Once a victim clicks a link in the phishing message, he would be led to a new site hosting the malicious page. As the victim keys in his login name and password, those details get transmitted to the central hothackerclub.com Website. This way, the hacker steals users' login account details.

Vice President of Marketing and Product Management, Frank Cabri, FaceTime, Communications said that people are increasingly using the Internet as a platform to launch new collaborations and applications. At the same time, with the entrepreneurial desktop becoming consumerized, it is fast inducing IT managers to take care of implications of compliance and productivity on Web 2.0, Instant Messaging (IM) and social networking programs, and of their security. Techwhack reported this on January 29, 2008.

According to malware Research Director, Chris Boyd, at Belmont, Calif.-located FaceTime, as business employees increasingly visit social networking sites and access personal e-mails during work hours, IT administrators in corporate feel concerned about threat from the new type of phishing. Searchsecurity published Boyd's statement on January 28, 2008.

Boyd went on to add that this requires corporate to design specific security policies and procedures to determine ways of using and those of not using these e-mail and social networking sites.

In its report, FaceTime has categorized security threats of an increasing number of greynets classified into Peer-to-Peer (P2P) file sharing, IM, multimedia, gaming software, remote administration, IPTV, anonymizers, Web 2.0-enabled programs and social networking sites that are of interest to corporate IT managers.

Related article: Researchers Urge Caution against Phishing Scams

» SPAMfighter News - 2/7/2008