Comments on: IE7: 22 hours to catch a phish http://www.itwriting.com/blog/30-ie7-22-hours-to-catch-a-phish.html Tech writing blog Sun, 12 Feb 2012 05:28:38 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Mark Zaugg http://www.itwriting.com/blog/30-ie7-22-hours-to-catch-a-phish.html/comment-page-1#comment-52 Mark Zaugg Mon, 30 Oct 2006 22:17:23 +0000 http://www.itwriting.com/blog/?p=30#comment-52 If nothing else, it's been enlightening and something that I need to guard against - both from a user standpoint as well as guarding my servers. This started from me reading criticism of Firefox's "weak phishing filter" and the results I came across certainly weren't what I anticipated. Nice to run across you, Tim. Welcome to my RSS feeds. If nothing else, it’s been enlightening and something that I need to guard against – both from a user standpoint as well as guarding my servers.

This started from me reading criticism of Firefox’s “weak phishing filter” and the results I came across certainly weren’t what I anticipated.

Nice to run across you, Tim. Welcome to my RSS feeds.

]]> By: Tim http://www.itwriting.com/blog/30-ie7-22-hours-to-catch-a-phish.html/comment-page-1#comment-51 Tim Mon, 30 Oct 2006 21:58:17 +0000 http://www.itwriting.com/blog/?p=30#comment-51 The site is now access denied - maybe because I just reported it to the site admin. I guess the web server there was hacked. Sorry to spoil the fun! Tim The site is now access denied – maybe because I just reported it to the site admin. I guess the web server there was hacked.

Sorry to spoil the fun!

Tim

]]> By: Tim http://www.itwriting.com/blog/30-ie7-22-hours-to-catch-a-phish.html/comment-page-1#comment-50 Tim Mon, 30 Oct 2006 21:39:16 +0000 http://www.itwriting.com/blog/?p=30#comment-50 Thanks Mark. It looks like you are getting a different result than me, very strange (and suggests the IE7 phishing filter is even less useful than I thought). I've made the url non-clickable as I don't want an actual link on this site. Tim Thanks Mark. It looks like you are getting a different result than me, very strange (and suggests the IE7 phishing filter is even less useful than I thought).

I’ve made the url non-clickable as I don’t want an actual link on this site.

Tim

]]> By: Mark Zaugg http://www.itwriting.com/blog/30-ie7-22-hours-to-catch-a-phish.html/comment-page-1#comment-49 Mark Zaugg Mon, 30 Oct 2006 21:29:37 +0000 http://www.itwriting.com/blog/?p=30#comment-49 The exact link I'm following is http : //bankofamerica.com.wowtnc.com/cgi.bin/sso.login.controllernoscript=true/ sessiondid=2335454893_Secured152388884&Update/ Going directly from Firefox it's reported as phishing. IE does not. You're correct, I got to it via the directory listing. IE is not reporting the directory listing either. Now I'm thinking it's just a matter of the time between you're report and my finding it and hopefully it'll get reported as a phishing site promptly. To me, at least, this is indicating that the idea of a heuristic scan based on "bank pin" and "account number" etc. etc. might be a very useful tool. At least until the next escalation.. - Mark The exact link I’m following is

http : //bankofamerica.com.wowtnc.com/cgi.bin/sso.login.controllernoscript=true/
sessiondid=2335454893_Secured152388884&Update/

Going directly from Firefox it’s reported as phishing. IE does not.

You’re correct, I got to it via the directory listing. IE is not reporting the directory listing either.

Now I’m thinking it’s just a matter of the time between you’re report and my finding it and hopefully it’ll get reported as a phishing site promptly. To me, at least, this is indicating that the idea of a heuristic scan based on “bank pin” and “account number” etc. etc. might be a very useful tool.

At least until the next escalation..

- Mark

]]> By: Tim http://www.itwriting.com/blog/30-ie7-22-hours-to-catch-a-phish.html/comment-page-1#comment-48 Tim Mon, 30 Oct 2006 21:16:22 +0000 http://www.itwriting.com/blog/?p=30#comment-48 Mark, I'm surprised too. I've just been back to the site and IE7 still reports it to me as a phishing site. Maybe a temporary glitch in Microsoft's phishing check server? No... I think I may have it. When you put in the partial url, you don't get the phishing page. You get (at the time of writing) an apache directory listing. The phishing page is listed; it has the curious name "sessiondid=233545489..". If I go to the actual page, both IE7 and FireFox report it. But if I go to the directory listing, FireFox reports it, IE7 does not. Is that the difference here? Tim Mark,

I’m surprised too. I’ve just been back to the site and IE7 still reports it to me as a phishing site. Maybe a temporary glitch in Microsoft’s phishing check server?

No… I think I may have it. When you put in the partial url, you don’t get the phishing page. You get (at the time of writing) an apache directory listing. The phishing page is listed; it has the curious name “sessiondid=233545489..”.

If I go to the actual page, both IE7 and FireFox report it. But if I go to the directory listing, FireFox reports it, IE7 does not. Is that the difference here?

Tim

]]> By: Mark Zaugg http://www.itwriting.com/blog/30-ie7-22-hours-to-catch-a-phish.html/comment-page-1#comment-46 Mark Zaugg Mon, 30 Oct 2006 20:59:49 +0000 http://www.itwriting.com/blog/?p=30#comment-46 I'm... confused. I'm a sysadmin and I'm experimenting today trying to beat my users to the punch by exploring phishing sites. I'm happy to see you've done the heavy lifting Tim. But when re-enacting your experiment here, I took what URL was visible and entered it into the address bar for IE7 and Firefox. Now, I had to do some drilling down to get to the root webpage - please understand this is a "rough and ready test" while I'm experimenting. Since you'd reported it, I thought it would be a sure bet to be reported as a phishing site. But IE7 let me through as your original test. Firefox / Google did report it as a phishing site. I've reported the page I encountered and I'm also waiting for it to get reported. I read the <a href="http://blogs.msdn.com/ie/archive/2005/09/09/463204.aspx" rel="nofollow" rel="nofollow">on phishing</a> which gave me an overview but it's left me wanting more.. I'm curious: Is this going to be a battle of escalation where small changes are invalidating the phishing filter? Or has the page been reported in Google and I'm only half way through the life-cycle? This isn't what I was expecting. I thought it would be universally reported as a phishing site. I'll stay in touch and keep you up to date with my findings. I’m… confused.

I’m a sysadmin and I’m experimenting today trying to beat my users to the punch by exploring phishing sites.

I’m happy to see you’ve done the heavy lifting Tim. But when re-enacting your experiment here, I took what URL was visible and entered it into the address bar for IE7 and Firefox. Now, I had to do some drilling down to get to the root webpage – please understand this is a “rough and ready test” while I’m experimenting.

Since you’d reported it, I thought it would be a sure bet to be reported as a phishing site. But IE7 let me through as your original test. Firefox / Google did report it as a phishing site.

I’ve reported the page I encountered and I’m also waiting for it to get reported.

I read the on phishing which gave me an overview but it’s left me wanting more..

I’m curious: Is this going to be a battle of escalation where small changes are invalidating the phishing filter? Or has the page been reported in Google and I’m only half way through the life-cycle?

This isn’t what I was expecting. I thought it would be universally reported as a phishing site. I’ll stay in touch and keep you up to date with my findings.

]]>