Tuesday, March 13, 2007

The Economics of Phishing Emails, and Corporate Logos





This got me thinking.

Paypal, Bank of America, and others know exactly where their graphics should be shown on the web. A general, and reasonable rule would be, anytime a website at Paypal.com loads our logo, let it happen. If someone at evilphisher.com tries to load our image, load up a big warning image instead. This could easily be done by checking the referrer passed by the browser.




Simply put, Paypal doesn't really gain much by disallowing the phishers from using Paypal.com to host their images, and in fact, loses quite a bit.




Sid Stamm said...

One could also argue that it is also possible that (4) Checking the referrer on each image load is more costly (server CPU demand) than serving images to third party sites (bandwidth demand). Or maybe (5) Bank X wants its affiliates y.com z.com, etc., to use the logo but nobody else; referrer-checking is now very very demanding.

It's good to note that the HTTP-REFERER header is not trustworthy, and might not appear at all (even if there is a referrer).

And I think you're right, the referrer logs can help institutions identify the most successful phishing or mirror sites.

(Link to relevant mailing list thread)

Rob Carlson said...

Referrer strings are sent by the browser, and denying those images to folks who's corporate proxy servers blank out or reset those strings to arbitrary values would cause a negative customer experience.

Also PayPal and other companies send mail to customers that would be read on webmail sites with many different URLs as the "referrer" when they are finally read.

Mike Kretzler said...

RE: "it seems that the enemy you know is far better than the enemy you've forced underground"

That's so often true.