Most phishing depends on spam to make that initial connection to the victim. Beyond that, however, phishing and spam have two interesting things in common. First, "getting away with it" depends, in both cases, on using the Internet's jurisdictional and informational barriers to thwart swift retribution.
Thus phishing spam is usually sent from a network  or PC taken over without the owner's knowledge -- meaning that the real criminal is long gone before the police or anyone else gets past the initial hurdles posed by the need to identify and alert the system 's owners. That's fundamentally what's done with servers too, except that in this case the servers are usually easy to find and the jurisdictional barriers international.
Either way, however, the thieves are long gone before the authorities can jump through the hoops needed to get enforceable cooperation by those concerned.
Second, success depends mainly on the victim's credulity, not the victim's choice of technology. In stark contrast to their relative immunity to viruses and worms, almost all of which depend on weaknesses in Intel's x86 CPU architecture, people who use Mac OS X or other non-Intel based Unix are every bit as vulnerable to phishing exploitation as anyone in Microsoft 's x86 environment.
Making Spam Nonprofit
It's these two commonalities that make using normal market behavior to fix the problem pretty easy. All that's needed to facilitate an appropriate market response to drive these people out of business is a technology allowing the recipient to know, with certainty, where any Internet-transmitted material, including e-mail, text messaging and Internet telephony, came from.
Suppose, for example, that one million people received a piece of spam designed as a phishing lure -- and that half the network administrators responsible for the devices used by the e-mail recipients responded by mailing it back to the originator at a ten for one rate.
Today, we can't do that simply because the ease with which e-mail return addresses can be spoofed can turn this into an overpowering denial-of-service attack on the innocent. If, however, everyone knew for sure who really sent offending e-mail, then the resulting opportunity for effective denial-of-service retributions on the guilty would quickly make spam, and thus phishing, an unprofitable business. (continued...)
|
