Phishing Scams & Social Marketing

Phishing scams are becomming an increasing threat inside open social networks like Facebook, Twitter, and LinkedIn. This poses unique challenges for businesses using these networks for social marketing.

Unfortuanately for email users, phishing attacks are becoming more numerous, and more sophisticated in their execution. Spear Phishing may become more of a threat to consumers as more information about specific individuals is available online through social networks like Facebook, Twitter, and LinkedIn, phishers may in principle be able to determine which banks potential victims use, and target bogus e-mails specifically at them.

(Targeted versions of phishing have been termed spear phishing. Several recent phishing attacks have been directed specifically at senior executives and other high profile targets within businesses, and the term whaling has been coined for these kinds of attacks.)

Social networking sites are now a prime target of phishing, since the personal details in such sites can be used in identity theft; in late 2006 a computer worm took over pages on MySpace and altered links to direct surfers to websites designed to steal login details. Experiments show a success rate of over 70% for phishing attacks on social networks. Social marketing into these social networks is increasingly hampered by the needs for social sites to try to protect their users, and those users becomming aware of phishing scams and identity theves 'inside' the network.

The RapidShare file sharing site has been targeted by phishing to obtain a premium account, which removes speed caps on downloads, auto-removal of uploads, waits on downloads, and cooldown times between downloads.

Attackers who broke into TD Ameritrade's database (containing all 6.3 million customers' social security numbers, account numbers and email addresses as well as their names, addresses, dates of birth, phone numbers and trading activity) also wanted the account usernames and passwords, so they launched a follow-up spear phishing attack.

According to Wikipedia; Almost half of phishing thefts in 2006 were committed by groups operating through the Russian Business Network based in St. Petersburg.

Spam - the scourge of email - is now 30 years old.

WIth the 30th anniversary of the first spam message, it seems that there's a never-ending supply of stories that show the ineffectiveness and shortcomings of the public email system.

BBC: Spam - the scourge of every e-mail inbox - celebrates its 30th anniversary this weekend.

The first recognisable e-mail marketing message was sent on 3 May, 1978 to 400 people on behalf of DEC - a now-defunct computer-maker.

The message was sent via Arpanet - the internet's forerunner - and won its sender much criticism from recipients.

Thirty years on, spam has grown into an underground industry that sends out billions of messages every day.

 Of course these stories about email will never end since the shortcomings of SMTP can't be overcome inside of the current open and completely anonymous system. So spam and spam filtering of email messages will continue to be an ongoing arms race between security companies who try to isolate and filter email messages (after they're already in your inbox) and the spammers, who are increasingly sophisticated and who are now employing sophisticated techniques that can even target email recipients on an individual level.

The inadequacies of email won't, and indeed can't be solved inside the current system of SMTP. A new paradigm is needed to jump the curve and address the real needs of both businesses and individuals. A system where spam and malware is stopped on the sending side rather that trying to filter the spam after it's already in the inbox.

Fortunately, that system's now here, and it's free for individuals.