Man-in-the-middle phishing attack successful against Citibank's two-factor token authentication.(Citibank N.A. (New York, New York))

On July 10, 2006, the first reports of a man-in-the-middle phishing 2.0 attack against CitiBank's CitiBusiness[SM] service were reported by The Washington Post. The phishing scam, originating in Russia, shows that cyber criminals are integrating multiple attack methods to defeat the latest security measures such as one-time password (OTP) tokens implemented by banks.

"In my testimony to Congress in 2004, I warned that, as more people become aware of current 'phishing' scams, the cyber criminals often get even more clever, and create new, more sophisticated techniques," said Howard Schmidt, former White House cybersecurity advisor and former Chief Security Officer of eBay and Microsoft.

In 2004, the first wave of "phishing 1.0" attacks tricked unsuspecting consumers into clicking on links to fake bank websites and giving up their usernames, passwords and other personal information leading to financial fraud and identity theft. Phishing 2.0 has evolved to combine traditional phishing "hooks" with a man-in-the-middle attack (in the Citibank case involving a botnet), and URL spoofing. A phishing 2.0 attack tricks the user into clicking on a link to login to their bank through the man-in-the-middle phishing proxy site. It is actually easier to launch than traditional phishing 1.0 scams because the attacker does not need to create and maintain a copy of a fake site. The phisher merely passes through the actual pages from the real website, then steals data or makes changes to transactions automatically using easy-to-write scripts.

"This is a common and predictable attack. As an industry, we need to accept that solutions not incorporating strong client and server authentication cannot survive the Internet. Ten years ago, this was evident with the advent of key SSL mechanisms. It's time to put them to work," said Eric Greenberg, Chief Master Architect for security firm KSR and former leader of Netscape's security group, which originally created SSL.

Since 2004, most banks have responded by implementing one or more security technologies designed to fight traditional phishing 1.0. In many cases, these security measures have temporarily reduced fraud rates based on their ability to prevent basic phishing 1.0 techniques. However, these security measures are vulnerable to phishing 2.0 attacks (see table on previous page).

Why Are These Security Measures Vulnerable?

These measures are vulnerable to phishing 2.0 attacks for some combination of the following reasons: