By Hook or By Crook

Internet identity theft takes new forms

By Ivy Sellers
Daily Universe Staff Reporter
March 21, 2005

Pharming: a misspelling of a basic term involving men in overalls, tractors and sweaty hours in the sun. Think again. We're not in Kansas anymore. It's time to enter the 21st Century.

Referred to by one expert as the next generation of phishing attacks, pharming is the latest development in a dangerous trend of Internet identity theft.

How pharming internet identity theft works

While phishing attacks consist of emails with enticing invitations to visit a different site requesting an update of personal information, something an Internet user can avoid by clicking the "X" in the top right-hand corner, pharming attacks come right to the source.

"Instead of sending you an e-mail directing you to a bogus Web page, a pharmer is able to hijack an entire domain," said Robert Vamosi, senior editor for networks and technology magazine CNET Networks.

A string of numbers makes up all Internet addresses. But instead of typing 252.123.0.0 into an Internet browser (try remembering one of those for every site you want to visit), a site name is used such as google.com, and then translated by a server to a set of numbers connecting the user to the site.

With pharming, criminal internet identity theft hackers change the numbers connected to the desired sight, sending the user to a similar sight of their own, often without the user knowing it. Personal information is requested, and the user doesn't think twice because the site is one he thinks he has used and trusted before.

Recognizing internet identity theft scams

Online financial resources are popular targets for hackers. But there are ways to distinguish between a credible and a bogus Web site.

Banks will never solicit personal information through e-mail or unsecured Web pages, said David Orton, product manager over software licensing for Information Technology at BYU. They may ask for information on their Web site, but not until you've signed into your established account.

If a customer has questions, they can always ask the bank or institution before filling out the solicited information, Orton said. A "fraud" link is often available on their Web sites to ask questions as well.

Corporations counter internet identity theft

Larger banks and e-commerce sites are starting to combat internet identity theft by sending certificates to Internet browsers, verifying the authenticity of the site searched for. Authorized by trusted third parties, these certificates are difficult to fake and therefore, reliable.

"More and more commerce sites are fighting back against internet identity theft by starting to verify their identities to you. It's in their best interest to do so," Vamosi said. "This means we'll have to put up with one more dialogue box popping up on our browsers, but most people are willing to accept that trade off for the added security."

Experts say Microsoft is creating a verification method to protect Internet users from internet identity theft hackers such as pharmers and phishers.

If not, e-commerce transactions risk coming to a halt.

"No one will feel comfortable shopping online," said Mari Frank. Attorney and author of "From Victim to Victor," due to "lots of distrust of the Internet."

Although internet identity theft in general is growing, currently, the pharming threat isn't too great. Only one major incident has been reported thus far. Panix, an Internet service provider in New York, had its Web address hijacked in January of this year.

According to reports, someone changed the number code, which connects users to the domain site, panic.com. Ownership of the company was changed from New York to Australia while requests to reach the panix.com server were redirected to the United Kingdom, and e-mail was redirected to Canada. State and federal authorities are still investigating the case.

Though this is the only pharming case reported thus far, experts still say precautionary measures need to be taken.

"We saw the phishing threat explode during 2004, and the same could happen with pharming during 2005," Vamosi said, concerning the latest trends in internet identity theft.