Security glitch aids IRS phishers
Flaw in GovBenefits.gov domain exploited
IDG News Service - The U.S. Department of Labor said Wednesday it is working to fix a programming glitch in a U.S. government Web portal that makes it easier for phishers to trick people into disclosing sensitive information. The flaw was first exploited by phishers who earlier this week began sending out bogus e-mail messages asking for personal information, including social security and credit card numbers.
The bug lets these phishers redirect URLs that use the GovBenefits.gov domain to fraudulent Web sites that are unconnected with the U.S. government.
This redirecting flaw was first exploited just days ago by phishers masquerading as the Internal Revenue Service, said Graham Cluley, a senior technology consultant at Sophos PLC, a U.K. security firm that has been researching the matter.
"The people behind GovBenefits.gov have implemented their software in such a way that leaves the Web site vulnerable to a phishing attack," he said. The technique is particularly effective because the link that users click on is, in fact, a genuine GovBenefits.gov link, he added.
The fraudulent e-mail claims to require the sensitive information in order to process a tax refund, and claims to come from email@example.com, the IRS said.
The GovBenefits.gov Web site is used by 16 federal agencies, including the IRS, and is designed to help users determine their eligibility for government-funded benefit and assistance programs. It is maintained by the Department of Labor.
Though the site's redirect glitch is not common, Sophos has seen it before, usually made by programmers looking for a flexible way to move users around their Web sites, Cluley said. "It's a simple mistake to make, until you realize the consequences," he said. "They probably didn't see how it could be used."
The Department of Labor was working to fix the glitch yesterday, a spokeswoman said.
Meanwhile, the IRS published a statement yesterday, warning users of the scam. "What we want people to know is if you get an unsolicited e-mail that purports to be from the IRS and it's asking for personal information, that's bogus," said Eric Smith, an IRS spokesman. "We're not going to request that you provide this kind of information by e-mail."
- Deep Security +VMware vSphere with Operations Management Most midsize organizations are highly virtualized on VMware, and while this has produced significant savings, it also has created new challenges when it...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- DDoS Infographic: How Are Attacks Evolving? For the third consecutive year, Neustar surveyed businesses across major industries to track the evolution of DDoS attacks. Are they more frequent? Larger?...
- How to Use Crowd-Sourced Threat Intelligence to Stop Malware in its Tracks Threat sharing networks have been around for a long time, however they have typically been "invitation-only", available to only large companies, or those...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Malware and Vulnerabilities White Papers | Webcasts