HTTP://COEIA.EDU.

SA




 

W






 

W







"#
$%
&'
K
 (
"#
K
&01
-.-/

*+,



2.&3

K.
"1
$%


435







 




 

W



1429 2008 -

 





















"#$
)('&
W% 
0)
/.
- ,

L+



34
2

 6/


781429

000
2


<24
C
17

=


978-603-00-1453-8
W


?

J1
?

J2


-@

0




? 

K
34
B6B

KH




EE= 
FF
CI

005,8
J6

1429L5884

=
<L)6


1429L5884
W

=


978-603-00-1453-8
W

>;
=83


*789:
;0

*/0?



2009
-
@A1429




W

 

 

     .*

M
N6=7O
7P8
,4 


Q
- 

B
B /
/6
 S
6

U774
77V
77
776
M
E= 77W
77L

77 X 
- 77

077 @
774
77

E= 7W
K
7#
(
S
- Y

+
= Z
8

+= 

X\
(

Z

K
7]^
- 7YX
7
74
M
7Y4
_/7W)
7Y`O

7I
- 7
=4a
M

773O/
d77
77
77
77

77
- 7 <
77c&
M
N6= 7 (3
77
=
U774
77bS

- 76$
M
7Z
_




=/
3O/
d
f

 =gZ
<
h
_/

+77i
- 776$
77
- 77
77?
M
'77
+./77
U774
77bS
77(6/
+77i

+=
a
- 77
77?
77k
M
77 4
77bbl
- Y77W
U774
77bS
77
77(6/

M
077O
- 77
77?
M
77bb^
77
- 77]
77
776
m77
Kd6= 77

77?
77k
M
7736=
-=77

-/77n o
77
776<
77`6

677Z
Fi77b


K- 

     .*



7&('$
-p 7
q 7&/
U7r
7(@
7 (
+ 7IL
/
/6
 S
6

-$ 77bO$ 
?/77
- 7
77I`O
7"L
M
77 (
77c&?
g37

` 77
7(@

7
7
- <
c&
M
gZ

6= (3
t
=
U4
# S
K?6Z

+ Y7W
U74

7,6?
7# S
K
76/ 

7
 
Q
- 
0 @
4

vS 
8
EProject Management ProfessionalF
d6= 
+=a
M
 4
bbl
K 

Q
- 

B
B /
M





 

W



 
9.....................................................................................................
: 14...........................................................
1.1 15.................................................................

1.1.1 )15 ................................... (E-Mail Client

2.1.1 )16 ..................................... (E-Mail Server
2.1 17.....................................................
3.1 18..........................................................

1.3.1 18 ...............................................
2.3.1 18 ......................................................
4.1 19.....................................
5.1 21...........................................................................
6.1 22..................................................................
: )24................................ (Spam
1.2 26..............................................
2.2 31.............................................

1.2.2 : )31 ................... (E-Mail Spoofing

2.2.2 : )31 ............ (Open Mail Rely
3.2.2 :

)(Image-based Spam

32

4.2.2 : )34 ........................ (Dictionary Attack

3.2 34...................................

1.3.2 : )34 ................................... (Filtration

2.3.2 : )35(Black lists / White lists




 

W



3.3.2 : )37 ...... (Commercial Whitelists

4.3.2 : )37 ................ (Integrity Check
5.3.2 : 38 ........................................
6.3.2 : 38 ..................
7.3.2 : )39 . (Spam Reportin
8.3.2 :
)41 ...................................................................(SMTP RFC
9.3.2 : )41 .... (Fake MX Records
10.3.2 : )43 ..................... (Greeting delay
: )45............................................... (Phishing
: )65...................... (Phishing Techniques

1.4 : )67 ................. (DNS Poisoning

2.4 : )70 ............ (Hosts File Poisoning
3.4

: )71(Content Injection

4.4

73 .

5.4

: )76 ..................... (Address Obfuscation

)(Man-in-the-Middle Attack MITM

6.4 : )80(Malware Attack

7.4 :
)80 ....................................................................... Phishing
8.4 : )81(The Popup Attack
(Search Engine

9.4 : )83 ................... (Fake Address Bar

(Phishing

)91................................................................................... Countermeasures

1.5 : 92 ...........




 

W



1.1.5 92 ........................................
2.1.5 )92 ...................... (Bounced E-Mails
3.1.5 93 ..................................................
4.1.5 94 ......................................................
5.1.5 94 ............................
2.5 : )98 ..................................... (Filteration
3.5 : ) (Security Patches
)99 ...................................................................... (Firewalls
4.5 : )100 ..(Cross-Site Script - XSS
5.5 : )101 ............... (Visual Keyboard
6.5 : )102 ......... (Two-Factor Authentication
7.5 : )104 .............. (Mutual Authentication
8.5 :
)105 ..................................................................... Toolbars
9.5 : )110(Anti-Phishing Software
(Anti-Phishing

111.....................................................................................
117................................................................................................




 

W








 

W



10

?
xI
?

/b4)&'&/L
73L
w
7`4
7&
7
F7b 7B
^7
YO

BO/7"
(7
6?
za



?
y37#^7
)&'&/7?
w7


- 7Z
m7I
7
$
(
7
g/7r


K?

736/L
y37#7
7(6
Jx7

m7r^7
)&'&

7B
w7

- Z/r

7
g7
x]I 74

K  7
7

d7O
M
+= 7V`/7

 B
33
n
6`/
I# "L
"/{r

BO
6^
)&'&
33
y3#?
w
B/L
68?
_p 
YI#
<Yr? 
<Y3
33Z6



K= " ?

m
x8
( I6
H
?
S " =
@
6
%78 "7#$
)('&
%7
Jx7

F
M
03Z6
L
-^

b= L

-  Zi
6/Z
(I3

7`r

Y4
0O'6
7

7O
7@
K
-  7Z/7Z6
x78
(
7O
H 7
(
(
7&?
/Y7W?
I3
/Z


0 7
7Y36
t7 7o
 "7#p



in)
/.
-
O

6 L
Z
K- VC}
L ~
r]

M 
= 7
n
(

Km8
H
a
?&/h
a
U774
3O 77(
/(77 
f77
\77i
77Yx778
M
%77/
77

@ 77Z?
U77I?
&{77r

x778
<Y77Z6
(
%^77Z
774O
M
H 77)&'&
77
w77
 " =


K 8= h
`O
.    







 

11


 

W




?
Ui77n
776)('&
77
(E-Mail)
%77
 77 77bO$
@
776
+x77




 

W



12


= &$"/
/
d=
 6

\Z
U4
./r
?

<7c
%]r
K- cI

-$ k 4

S
6)('&

%
EFaxF
 I
+ bO
? 

K

6)('&
m]b
%
/O
J?
7
m7
7/O
7

\/7 ?
7
'(a
w&
.&
?


L
m&{r
$
6/
4
.%
(
Cp^7
Y
8_

g8_
 
 c&
Y4
}
t

6)('&

K%
x8
L I6
(
F
H 
0
M
^Zp

6)('&
%
(


.%)
/.
- , C
+

<7Z`O

L(7br
7Z
za
H 7

K
]
b
c&
/6

76)('&
%7]
7b
 7=
L 7I6
%& 7
76
)('&
g77
%77
ESpamF
77/}77n
77`
776
(
H 77
N/77
778
"#$
)('&
EPhishingF
%7(7
Jx7
7n
]7b

7 
za
v7



KN
3O
?x8
8
( 
m&
M
H
 
64O
+
%^7Z

7Y

/
@ 
0
(3 

EInternetF

7
6x'
74
7
76)('&

7S?
%7
?&
<Y"77
77
M
77
`I77@ 77

\77i 77k
M
%77/

<77Y 77ZS

 V
?


K-

13


 

W





14


 

W



  
"#    

15




W

 

7`6/

m7O &(
v7S
7
%&
)('6
c&
8 
b]
x8
/6

(37
74
%7&
)('76
7/O
7]

7,6?
/76
K
d
Y,
Y4

M
- 7L "I
. ?
c&
=

'M
 ^Z
-$ O
vS

 

76 
7=
7(C
/7W
7b]
x78
/7
M

K
%7&
)('76
/O
4


K%&)('

1.1

EData NetworkF
- 7& 3(
37W
U74
I3
EApplicationsF
- `3"(
O

U74
37
73"O
%7&
)('76
?
7

KEserverF
7 EclientF
74


77
EE-Mail

ClientF
%77&
)('776
774
77
77(6
77Yr

- 77& 3(
377W

KEE-Mail ServerF
%&
)('6

(E-Mail Client) 1.1.1

m7Y

78
EMail User Agent-MUA)

^7Z
76/
7

7,6?
UZ6


KEE-Mail ServerF %&
)('6

^Z

I3


W%8
%&
)('6
4
F

^7 
EE-Mail ServerF
7
M
76

H 7ZS
7
76'

7




KEPOP3F
6
0(
 O/


K
= +
-  `
za
I 
/
3n



76 
&`
O/

 ^EE-Mail ServerF

za
 /<
ZO



KESMTPF
Z3
K%&
)('6
c&
M
%&
)('6
4
dL
E1-1F
(
yn6






W

 
Microsoft

16

?
q 777&/
%777&
)('7776
7774
q/777
U7774
777
777

.?wr/(6 ?
 /W

E1F?Outlook

(E-Mail Server) 2.1.1

Jx7
78 KEMail

Transfer AgentMTAF

76
7`&
7

7,6?
U7Z6

%7&
)('76

7
za

7
%&
)('6

=
3``

6

KEInternetF
 (
3
U4
\/ 
Microsoft Exchange ?
q &/
%&
)('6

q/
U4


K?wr/(6 ?
 /W

E2F?Server

776
77c&
M
%77&
)('776
77
d77L
E1
J1F
(77
7 ,6?
y77n6



K%&)('

( 1-1 )


Ewww.microsoft.com/outlook/F
 (
3
U4
q &
dL

E1F



Ewww.microsoft.com/exchange/default.mspxF
 (
3
U4
q &
dL

E2F

17


 

W



2.1

)(Web-based E-Mail webmail

'(a
6/

%8& 7bOp
+7
%7
p7
7

y]7b
(37 
7

y]b
Yr
6}
EInternetF
(3 
=

4
6)('&

K%



U4
6)('&
%

U4
(3 
?Gmail?
7
7
Egoogle.comF
?77

?
 /77W
77
Egmail.comF

M
y777777n
778
77
(777777


KE2-1F

2-1






W

 

18

3.1

77 L
-p 77O/
77

B776
%77&
)('776
77c&
M
776
77'

7
7r

?7
7

.
/O
4
M
_/
(
UIZ6
+ }


%7 &
)('776

3`77
77
7 (~ O
}
+77
-77"
773O
77Cp

7 
77
Km =a

1.3.1
(Simple Mail Transfer Protocol - SMTP)

(377
U774
%77&
)('776
77
'7  

%77 `
77 O
778

7`i
7`h

1 821
<7L=
ERFCF
- 7`
07
`h
m]6/O

 


K2 1123
<L=

U74
Z3
6 
&`
O/
-$ bO
%&
)('6

3`ZO

<L=
gO
(

KE3-1F
(
M
yn
8

EPort 25F
25
<L=
x]I
K
/6
3L

x]I

2.3.1


(POP3 Post Office Protocol)

776'

77$
%77&
)('776
774
m^77Z6
Jx77
77 O
778

<77L=
- 77`
077
77`h
77 O
x778
F776/O

K
77
77
%77&)('

K
Ehttp://tools.ietf.org/html/rfc821F
`h^
)('&

ZI

E1F

K
Ehttp://tools.ietf.org/html/rfc1123F
`h^
)('&

ZI

E2F

19


 

W



K1 1939

4


3
<L/<
 O

za
g6
^7ZI@ 
7
7
^7Z
x8
 O

%8
^ZI 

K
77
3`77ZO

776)('&
%77/
-$ 77bO77 O
(
077
U774
776
110F110
<7L=
x7]I

M
y7n
78
7

EPort
KE3-1F
(7(?
7


g776


/6
=
<L

Kx]I

) (3-1 SMTP

POP3

4.1

<
 "I

8
.BXI4
M
?@?
p4

%O6
Jx

76)('&
K
%7


E3F
^ZI)('&

. Ehttp://tools.ietf.org/html/rfc1939F
`h






W

 

20

K?abc.com?
8
?xyz@abc.com?
J6
I
" I
<
pr

- 7&(
7S?
78
EDomain

Name System - DNSF
- 7L "I
. 7?
7c&

K
7YI
7r
7 (
(7
7O

+4

(6
 (
3
 

v7S
6/7
7YI6 I4
- 7L "I
. 7?
7
/7
78
cI
x8
- 
<8?

f= 734
7(
m7&a

J?
m7
07 ^
/7
7^
J/
I
r/

$

7
7
7

7I4
7
37
U7r
K
7 (
37
37ZI 
FO C


- & 
E213.230.10.197F
C
VZ
J/
I
Ewww.ksu.edu.saF

7
- 7L "I
. 7?
7
7S?
M
pp
S 
+(

O
fx8
/


KE4-1F
(
M
yn
8

( 4-1)

p7$
%78
- 7L "I
. 7?
7c&
Y7`6
t7\
/ 
- \
Sa

/7 ?
E 7I8
7(6

7`r
K
"
 <
&" 3O/
%&
)('6

. ?
4

21




W

 

gr7
7a
7
.
=037Z
76
7S
7"&
<7)
%7&('a
76/
7



7
7
7"I<
7
U74

+g7(
- 3"

d6O
/
+4 Z



KE Failover

?
Backup F
 S

gr

?ELoad BalancingF

. 77?
77
{77r
%77&
)('776
77
377ZI 
p77$
77 S
M
Mail exchange Records F
? /
3O
-pV?
77
_/O
-pVZ
/6
- L "I

.E MX records

5.1
(Mail exchange records MX records)

< 
7Z

76B
7
 7/
7b6
a
7]
 /
3O
-pV

preference

F
7
(
%,]O
<L=
d
3`Z}
%&
)('6

. 

KEnumber




 

W



22

) (5-1

/


<L/7]
07O/O
78
%7,7
7
7(r

K
=
<7L]
7,


7
?
w77&
/77#
77 S
77#O
M
77 ?
77VI
 77/x77C
{77r
77
 /

bO$
?
d
$

J
<L/&{r
U

yVI6
bO$

037Z
m7


m&{r

d

M
yn
8

m6
Jx(


KE5-1F
6.1


(6

6)('&B
?
+4

%

W%8
.

)(Header

U4
J
- & 3 




77(6

U74
W
7b



WEFromFI
 /
} 
J76

J  /
Kxsender]@[source domain namez

23




W

 


/} 
%&
)('6
H ZS
<
Wsender


. /
mI
-=#
Jx"
^
I
<
Wsource domain name


7&
I4
J7

?7(

K3
`7Z
} 
J76
7I

:EToF
3`Z
J

777b
U7774
3`777Z

777I4
777(6
K3`777Z}
7774k

?777S
p3`777Z}
K
[receiver]@ [destination domain name]


3`Z} 
%&
)('6
H ZS
<
Wreceiver


.ma
 /
} =
Jx"
^
I
<
Wdestination domain name

%7&
)('76
7
7
 7/ =
Z
%b]O

 WERouteF
= Z
J

\/77 "
77 
77
=/77
3`77Z
%77&
)('776
77
za
7
/

74
q/7
/7O$
+ 74
.
U74
za
]7

B
ZZ
0ZS
3O/

Y7n/4
^
7Z

7({
7(

76
d7
+/W 3
= Z
- & 
%&
)('6

= 77Ya?
= 77^

%7 &
)('776
774
q/77
M
+/r77
- =77
776/
774


$ 77
/776
E7-1F
(77

K?77

?
%77&
)('776
774
M
?77#


K= Z


K /
n

:(Subject)


K /

&
:(Body)


%&('a
6/
 =
E6-1F
(W




 

W



24

) (7-1

) .(7-1 .

"!  
)  ('&   $#$
)(Spam

25


 

W








W

 

26

7Y]6/O
v7S
7
7/
g7
%&
)('6
= 
b]
x8
L I6

K- cI
/r\
Z
U4
=/n?

m33ZO

Yr8?

7776
777=a
M
^777Z
0 777
777b]
x7778
L 777I6
777
777


K C
+ ,
-./
)
H/
g
%&)('

1.2
(Spam)

77c&
^77
+. 77
a
77Y&
77/
g77
%77&

)('7 6 
77=
_/77O

7
EBulkF
7 8
<7
7={
EElectronic Messaging SystemF
7& 
)('/

fx77C
3`77Z

773L
77
77/
?
77L
?
77"
g77
77 
77/
Electronic

F
%77&
)('776
77cI
ESpamF
77
773O=
77W
77`
K 77/

 777/
777
J?
U7774
7 7,6?
7773"IO
777Y&a
$a
EE-MailF
=777b
?
EMail

W
&)('
K
EBlogsF
- &
K
ESMSF
+gb`
bI 
/
K
EForumsF
- 6I
K
EWeb Search EnginesF
vi3
- /


K
EInstant MessagingF
/W 3
'
L
%&'



7Cp
7
J= 7V
p74)
8
 /
fx8

/(
6

3

F 7(
7&$

/7c&
+78

7](O
/7Z
}
76/6
74
p74
7I
V6

7&p4)
+ 7
B7Y
\7
 
U4
r
K- &p4)
fxY
+ 4
"3O/

27




W

 

K\/ 
p4)
` =&
 
Pn
](
 =
c&
J?
4
8/&

 7O
fx8
 S$
 /
fx8
Yr
 ZO}
\/ ?
/?
,6?
E I8

7`6/"
fx78
7,O$
v7S ESocial EngineeringF
74 
$
7IC
H 
w

3
`7Z
}
7I4
J/73
%4 7
$
07& X
7ZO 
=7`
7I`
-/7
$p

7
t7
?
76gV&
M
7'3
- =7$ 
?7=
7I
x8
U4
$ 

K /

M
%78
- =7
7
?
7
7 
 73
76i
 7/
3`Z}
ILa
YI
_C

d7
7r/
F7
y7]
 7/
3
`7Z
}
7ILa
7
78
/
$ 

K8@``


M
77I
67
r
d7"`

?+=77#

?
%7b&
F7
F77
x778
7
m77 Y6{
 7/


>KKgr
8
``@

 777/
777ir (
J777Z
777
q 777&
8=777#?
1  777bSa
M

377Z&

?377O
ENational

Saudi Anti-Spam ProgramF
E77/
g77F
77 iL$


JB

Y

t
- 
U4
. I
H/
g
%&
)('6

K
`67ZO
 7=
7Yc
7
2007
7
54
w7
EISPF
 (
3
SMS

F
77/
g77
+g77b`
77bI 
77/
377Z&

?7,6?
 77bS)
-/77Y?

w7
J
6Z
M
` I
FO C
%

+
=- 
U4
. I
ESpam

5
I6
3
 
2
P6x
20
6=
YI
65
2007

 1.7


.\/ ?
/?
-
5
<Y

O

I`O
-$ bO$
P8
?6Z
/
(
M
 iL$ 
/
8/
dn`<
O? E1F

(http://www.spam.gov.sa/Statistics-Arabic.doc)

2008
J781429
- 






W

 

28

774
2 ESymantecF
?& 77?
W /77W
mO=77#?
1 J/Y77W
/776/`O
/77Y?

76
37Z&

?2007
74
7
/76r
/Y7
7/
g
%&
)('6= 


M
K
%7 &
)('776 
77=
% 77a
77
69
77
H77/
g77
%77&)('

377ZI
fx778

?/77Y?
4 ECommtouchF
?77O
77 ?
 /77W
mO=77#?
/77
3 /776/`O

7
 7=
= 7
140
J?
87
w7
2006
74
M
67
w7
2005



K2005
4
4
30
8=L
+ 6B
 =
= 
160
% a

3777ZI 3r
K- 777cI
/777r
7774a
=777b
777 
3777ZI
fx7778
(777O

07& X
U7r

K
 7/
fx78
Yh
7iO}


?7(
7I?
7 
= " ?
E I8
- cI



W% 
K]
3L

Y]bO 
/
x8
+./`
 ,

- 4 



773L
77
77YO./L
77@
 77/
x778
77]@
 77,
77I6B^
S 77Z


KEFF
3`Z
E-Mail

F
%7&
)('76
7
U74
J=/7,
g
ETrafficF
r



KcI
EServer

Data Network

(1)

F

777bO$
+ 777IL
777Z
J=/777,
g777
EpY777$

The State of Spam, A Monthly Report February 2007, Generated by Symantec

Messaging and Web Security
(http://www.symantec.com/avcenter/reference/Symantec_Spam_
Report_-_February_2007.pdf)

ESymantec.comF
- 
?
- `3"O
k
M
bb^
 /W
%8



E2F

(3)

2006 Spam Trends Report: Year of the Zombies, December 27, 2006,
Commtouch Software Ltd.,
(http://www.commtouch.com/documents/Commtouch_2006_Spam_
Trends_Year_of_the_Zombies.pdf)

%&
)('6
- 
?
- k/
M
bb^
 /W
%8



E4F

Ehttp://www.commtouch.comF

29




W

 

77L

KEInternetF
77 (
377
774
77bO$
77Z
7,6?

7cI
EBandwidth

?
7O
7 ?
 /7W

74
= 7b
2006
7
1 /
g
 /
/6/`O
/Y?
F
4 w77776 
3 g7777O
1700
w(Y7777 
7777/
fx77778

?2 ECommtouchF

M
EImagesF
=77b^
77
?
2006
774
M
Ew776 
5 77(
1,700,000,000

- 76 3
7
g37
74
7
=7b
m73"O
7
EpY7$
37Z&
dr=
L
 /
fx8

KETextF
bI 
&= `
Y
Yc]@
EBytesF

+77i
- 776$ 
77&=]
776$
6/77
77PC
77YO/
?
6 77
=M

87S
7(6/
- 7cI
w7]
 7/
7
74I
fx78

?-/Y?
(6/

F (O 
,
(]
)&

fx8
O
2007
4
M

 =13

/ ?


K /
fxC
Jb
p
`\
 
- k
-


W
0& X
U4

76
t7(
37

7,6?
3`Z
Y

/O
 
?/
fxC
(



 7/
d7
7`r/
- 7]
76/
4
- g]
- V8
 
YX
x8
Y4
(1)

2006 Spam Trends Report: Year of the Zombies, December 27, 2006, Commtouch
Software Ltd.,
(http://www.commtouch.com/documents/Commtouch_2006_Spam_Trends_Year_of_
the_Zombies.pdf)

%&
)('6
- 
?
- k/
M
bb^
 /W
%8


E2F

K
Ehttp://www.commtouch.comF








.

1000
O
  E3F

m
?w?7
KEbitF
w
8

(O
H @
M
- 
6Bl
 L
+S
%8
EbyteF w6 
E4F

K?0?
?
?1?
a
 L









.

1
O
  E5F

. Ehttp://www.spamlaws.com/state/ca.shtmlF
- bb^
4
&=]
=

E6F






W

 

30

J7O
7L
t7

 7/ 
I,(
 
3
=
6/
4

?&)('

+
777`6/"
fx7778
U7774
$ 777

Km777


?g777r
F777
x777]IO
za
8=777

y77r
776/
74
+77
fx778
-/7&
K2004
/6 77I6
M
w]77

t7
?MyDoom?

F7
7
 7/
3`7Z
7Y6{
7

%7&('a
76/
 7=
d7
7r/
F7

x7C
3`7Z
y7r
7I4
?MyDoom?
+
8
``@
M
/]
%b&
F
r/

7={
 7#)
/7h?

7
7`r

+7
fx7Y
 b
y3b6
f Y

{r
r/
F

K1 i,
Y

M
]
\/ ?
&('a
6/
6 I4
za
 /^

Z&

77I 
/76/
77
?
7
7Yr
77/
g7
 7/^
77<
76
</7

?
76gV&
M
7'3
- =7$ 
?7/
7S$ 
7=
%8
]
_8

K
7`6/r?
H7I

76=Y
M
%& 7&
J/7
7`

7,6?


K 8/ 
Z


7 O

766
6 7I

7
7 8
<7(
 7=
7/
7=?
I4
b`
fx8
?3O

78
76
x7C
7
3
`7Z

7
7
2
7&/
7
_$
- P
Q

78

76 
m7I
H7"
x7]&
x(
m4
w"&
Jx
6 &
. 6/h
S?

7L
m7#
7I4
7`6/r?
H7I

6=Y
_ 6=?
S

I4
za
08x6
?

76]
7Z6

7
mS/7
p7)
m78?
7
6]
3
mr " 
/


K3 H/
g
6
xC
min
( r
fL


?F-Secure?
-  
?
/W

- g]
F#

E1F


K
Ehttp://www.f-secure.com/v-descs/novarg.shtmlF










K
`6/r?
HI

6=YX
6`I

%8
ERandF
&/
E2F
SA cops, Interpol ?
I
2004\Z6\31
6= 
`6/r?
HIX"
24
= 3 ??
+6/

E3F
http://www.news24.com/News24/South_Africa/News/0,,2-7-F
probe murder
. E1442_1641875,00.html

31


 

W



2.2
x778
L 77I6

F77
.B77X
0 77 77=a
M
^77Z
=
 77
776
)('&
g
%K/

1.2.2 : )(E-Mail Spoofing

7777 O/
7777`]6
&`
7777
77776
7777#
za
ESMTPF

7777Z3

67777b
 77() 
m77&a
\?
7
77=a
=77I4
J77
 77

776/

U774
EAuthenticationF  /
'(a&
6/
4
%'
04p?=
Z6

EHeaderF
 /6
 @`
??


 77/ r

K77` 77I4
77
77
'(a
776/&
%77

EFromF77I4
77
Jx77

 /

K77x778


077& X 77=a
M
mp77

/77, 
N77(O$=
77b^W
77``S
+  /

g
6
6/
4 H/ S$

EspoofingF
fx8
/}
6
z
a
 7/
 =
I4/
6
L?
_/7b
<7

 7W
/
 /7W

7r 7Y6a
7

7


6Q
3`Z
 /?& L
Y

h
=bK
 77Sp
x778
77
77I

7777
y77bI6
 77/

y77r
]
- 77
77`r/
?
EAttachmentsF
/

ELinksF

M
+a
 /

(O


K
7L
 /

- ] r7(O
L
`r/
gr

- 7/7
7O
7Lgr
7
za
J?

- 7


za
`IO

K b
dL

2.2.2 : )(Open Mail Rely





6)('&
 =
3`O
%
6)('&
=7b
J?

%


za
8/6/
?
\/
fx8"
M
7Y
w&
`6/ 76

(37
z






W

 

32

O
 (
3
6 4
`
/c&
%&
)('6
= 
b6a
 ,
 

7
7bO$
U74
= 7L
g7
 7/
m7I
-=7#
Jx7

7
7
{r
6

77
77
0776/L
77]
/77
77
za
C 77b6a
m77& ({
77L
U774
m77&{r
3`77Z

K
/7
w7L
M
 /
b6a
M
]
^
,r?
#/r
E I8
(r
3`Z

g7
 7/
%
7
/
}
73
L
7
Cp7

I?
+/h
w(W

'M

fx8

7S]
7
7(O
76@
7
7

p7L

74
{7r
x7
/c&
/

E 7I8

7S]

7
7
7 
` 7/
3`6$
6@


6
./
g
 /
fx8
(O

6L
$ S

3.2.2

(Image-based Spam)

J 
] /
&
M
=b
^
za
/
g
 /

/}
V6

7P8
U74
I7
7,O
<76

7Yr
%7bI\
7o
U74
+7]
7b
4


K /
&
M
+=#

77 ?
W /77W
mO=77#?
2006
77
1
7 /
g77
 77/
/776/`O
/77Y?

w7
=7b
U74
+
/
g
 /
3Z&

?2 ECommtouchF
?O

7
% a

70
w(Y
Y&?
/
g
 /
4
% a

35

7/
g7
 7/
7
Y7Z
EData Traffic BandwidthF
- 7& 3

r7O
+ 7IL
(1)

2006 Spam Trends Report: Year of the Zombies, December 27, 2006,
Commtouch Software Ltd.,
(http://www.commtouch.com/documents/Commtouch_2006_Spam_Trends_
Year_of_the_Zombies.pdf)

%&
)('6
- 
?
- k/
M
bb^
 /W
%8

E2F

Ehttp://www.commtouch.comF

33




W

 

KEw6  V
1,700,000,000F
w6 
gO
1700

W7
+=`

7"&
7
EpY7
37Z&
d7r=
 /
fx8
M
=b
?
^
3O
L


Y7
7Yc]@
EBytesF
- 76 3
7
g3
4

=b
m3"O

- & 3
rO



KETextF
bI 
&= `
Optical Character Recognition F
7n
_/7@
U74
_/7
4 7Z6
7L

EpatternsF
/8 77c
U774
_/77
Eheuristic

methodsF
7736/V
/77"

EOCR

 7/
7
7I

x78
7
J7b
M
 
(
/]
bO
M
^Z

K
=7#
7P8
U74
7bI

M
+`
$ (W?
x ?
Yc

/
g


W
 3
Ur
K =
(
<V@
I(
W

gO


K_/@
br


K/
 =
(
F

+=b
U4
&
d`
dn




K /i=
b

^


7 ?
^7 r
/
g
 /
Jb
r
wZ
8S]
b

M
77 r
77V&
%"7
77/

g7
 77/
+ 7,
-./77
)
7
77(
=7L


K(
=L
L?
za
/
g
 /`



7

7`r
=7b 
I7

B7

7I4
7/
g7
 7/
%/}
FL6$

 7h
- 7]
M
I7
7,

\/7 ?
- ]
- P8
#

^za
\6
Microsoft

F
?
wr7/(6 ?
7
0(
q/
- ]
#
za

?EPDFF
o

KEXLSF

EDOCF

EOffice




 

W



34

4.2.2 :
)(Dictionary Attack


7

g77
776
H77/` 77
77I4
77l
M
776/
6
^77Z6
77L
} /
'(a&

. 7?
r 7na
76/
74
7
+=Y7
- 7L "&
. 7
U7I
-


fxY"(6
`6/
I4'(a
6/
6&

K

. 4
VI(O

+

 L

. 7
?`

K
+=Y7
H 7
U7S
a
&
<c
w
.

g
VI
M
+?
$a
dL
Y

iZ6x3

M

l
4


L I
6
 7Z
za
/cI 7
iib" 7a
M
7`6/

fx78
 I

K6
 )(

U74
_/7 7I
6
74k
7

"7I 7I
6
7
7VI
` 

/7

U74?

 7/

d73O/7


7&
M
7,
%7"6
 7/
 7=a
7I4
m^7Z6

7


?
U4

6/ 
7

7&
3`Z
 /
/} 
$


6B

K/
g
 /

3.2

x8
L I6

F

.BX)
/7.
- 7,
 7/
+
76)('&
g7
%7
K/



1.3.2 :
)

(Filtration
77(O

]77bO
 77/
776)('& 77?
U774
%77
?B77
?
77S
.
 77/
 

W


?/O
- 77&(
77S?=
77Z6

EHeaderF
 77/77I4
77YI

77/


K
EFromF

35




W

 

K
ESubjectF
 /
n




K
EBodyF
 /

&


7

7r / 
<
7`
\
7Sa
d7
7`
76
7b
\7Sa
w` "O
{r



=?77Z6
'377ZI 
+77
<77L

?
7 &('a
776/
6 77I
77Y&?
U774
]77b

{77r
I7
?
77n
377ZI 
Eregular

expressionsF
77r
-g377O

?77/

K
=6
x8
=

/L
x^6


7YI(
7/

g7
 7/
J7b
7`3"
-./
)
/ ?
%8
]b

7
7#

]7b
74
7Y4
+7&
7`
- 7V

6
n/4

&77L
M
6g377 `
77L(&
6 77
+ 774
6x77
77/
g77
 77/
%77/
K1 ]b



Black lists

) : 2.3.2
(/ White lists

- 77L "&
. 77?

?
7 &('a
776/
6 77I4
U774
.77Z
77 `
J77

7776/
77EIP

addressesF
w777&'&$
777 O/
6 777I4

?EDomain NamesF

p7
7
=/ 
6 I
O

 
)('&
` /
y Z6}$
&('a

77S?
d77
77`
%77&
)('776
77b
\77Sa
w77` "O
{77r
K3`77Z
77

za
=/ 7
m7
y
7Z6}$

.7Z
7 `
7
(6
m&{r
L
U4
 `
/# I4


K3`Z 
6/
(1) M. Gupta, C. Shue, "Spoofing and Countermeasures", Book chapter in "Phishing and
Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft",
edited by Jakobsson and Myers, 2006, Wiley.






W

 

36

 7/]
7b

3`7Z}

37ZI 
%7&
)('76
7
4a
 )(

]I7b 
7/
r/
f4a
(
,6?
.Z
`<
U4
 4$ 
`
Junk F
77

+ 74
_/6
3`Z
H ZS
M

k
z
Y`&

?.Z
` 

 /
. `{
a
3`Z}
 @
fx8
M
=/`
E/O
ESpamF

?EBulkF

?EE-Mail

K YrxS
?

776 r

K.77Z<
77`
77
7 
N77(
U774
%77Yr
. 77,3<
77`
77?

\77Sa
w77` "O
a
=/ 77
m77
y 7 Z6}

.77Z
77 ` 
77
a
U77S
77`

7
7 
7,
7

7L
U74

. 7,3
7 `
/7# I4
7S?
d
mb b

m]IbO

a
US
3`Z 
6/
H ZS
za
Y
_/?


` 6
#

%
78
. 7,3<
7`^
77
$
\/7 ?
7`6/

E 7I8

K
.77Z
7 `
7n
7

M
+7o
7
?
- 7L "I
?
6 7I
7
7
` 76 
7/
`r
Z

. 7,3
7 `
7n
7
FI7bO

t7 
7/


g
. ,3` 


7`6/
M
7
^
7Z

H 7ZS
M
7
7
za
C 7b6a

?Y7,r=
<76
m&{r


K.Z]
 ^
`<
b

]Ib 
/_
xS

J
`
^ -4{
J

/6
{(

U774

. 7I
3`77Z

H 7ZS
M
7
77k
za
Y7`&

?.7Z
77 `

7

7 a

. 7I

.7Z
7 `
/7
3ZI 
+ 
=/<
` O}
vS
EscoringF
<`

7
=
w&
a
+ 4

K Y`&
 
?/_
x
=/`

x^6
<`
=

U4


?Y7,r=
<76
m7&{r
 7/
U74
w7`3"&
L
/<
c
a
J?
 4
<`

7

p7L

74

?J?
7&
}
<7`
7
=
w&
{r
KN( 
N(

K YrxS


K3`Z
H ZS
M


za
Y`&
<6
m&{r
 /
U4
3"&
L
/

37




W

 

g7
 7/
J7b
7r
g7
87S
. 7,3<
7`
.Z`<

7`O
7Y&{r
. ,3
`<
3ZI3 r

K  bSa
YI
`
M
4 ZO
a

/

 77/<
7c
'
?r 7
Efalse

positivesF
77
( 7
)
q 7I
7S
7

<7`^

7

7,6?

7/ 

r/ }
+g#
4k

'
/

K /]
bO
M
.Z &

` 
h
S/
. ,3
Commercial

) : 3.3.2
(Whitelists

776
77
7 `
}
77
`
?77Z
- 77Y

"77
773}O
<77L
77c&?
%778



K3`Z
za
f6/
#
,

/
mr6
% 
3
 `
%&)('

EscoringF
<777`
%7778
777c&

fx7778
777
M
^777Z
0 777
777

=77b
77
77Y&
 77/
/77O
77
U774
. 77I

EcertificatesF
- Y77


K3`Z 
6/
za
=/ 
yVIO
h

(Integrity Check) : 4.3.2

M
^
7Z6
}
Jx7
ESMTPF
7Z3
76
7`&
7 O/
&
 `
?/ 


67777b
7777#
7777`]6
7777 (
37777
U77774
%7777&
)('77776
7777/O


?ii77#
77(6

?+=/77, 
N77

K7
/ 
77I4
% 77 

EAuthenticationF

76/
7I4
J?

7/

7`S
M
d7,6
^W
J
(r
/ 
b^W
N(6

774
77/
g77
 77/
77=a
M
Cp77

77I
+/77
fx778
%77&('a


.EspoofingF
 S$
6/






W

 

38


=?7Z6/O
7
6/
4
 (`

i
 /
ir
 )(

d77
EFromF
?77?
777
77`S
M
= x77
77
/ 
77I4
77&= `
EHeaderF
 77/

M
4 77ZO
77`6/"
fx778

KEReceivedF
?
?=77`@
M

7 Z6/O
M
+77

77`


K1 /
g
 /  _

: 5.3.2

(377
- i]77#
M
w77&
.77

7  
d77L
M
J776
77I
77 

q77
77n/4
Y77
778g

? 77`I
- 774k

?77h o_
/77

?77 

g77
776
77=a
M
^77ZO
t77
%77&
)('776
6 77I
77
d77V

7
7
7Y
J 7]
%7&
)('6
I4
/6
./
a
/Y
xC

KH/


K 
dL
M
J6
m&I4
 (
^
/"n
a
q
fx8

77(
?@?
B/
7 ?at?
W
7(

377
./7
)
fx78
U74
7
7

?xyz at abc dot com?
/67i
7
y37bO
?xyz@abc.com?
7
?K?
"`I 
?dot?

_/7
7
%7
%7&
)('76
6 7I4
d
q/
d"ZO$
`6/"
fxY


KI
b6
M
/
-
?L
(O
Y&{r
 ` 
m4

M

7b&

B7=
%&
)('6
I4
 
./
)
fxC
\/ 




KI
U4
_/

dV
q/
U4
=x6
%  
+=#
F

: 6.3.2
EBulkF
g3

C =a
<6
/
g
 /{
r
F6/
M
&/ 



7
za

/67`O
7L?
U74
7
C#
?
U4

66
6 I

(1)

Technologies to Combat Spam, Thomas A. Knox, GIAC Security Essentials

Certification (GSEC) Practical Assignment, Version 1.4b, Option 1, June 16, 2003,
SANS Institute 2003.

39


 

W




?
U74
7$

/7
7L


fx8 I
K6/

U4
g
 /
%"6
/  /

I4
&


K/
g
\/ ?
3`Z
 =
M
mZr
%``S

N]I"{r
`6/


g
 /=
U4
J
/
)
7I4


) =a
_ `6

 /
3`Z
7L

\/7


3`Z` 
 /} 
66
(6

_C@``

%=x8
.
/
a

6
8

I4

"&
3`Z
?


K$
?
 =
d
 
`6/
,r
g
674
8
/

7Yir)p7


M
\/I

YI4)
/
. ,


Kd Z

7.3.2 :
)(Spam Reporting

4 Z6
L)p

 7=
4
g7
76

M
7/`
7YI
7
J7b

<6
K C)p

fx78
74 7bO$ 
 7/
`7

7
76)('&

7/

%7

g
 /
7(
K
7/7`
U74
_/7

7
7
<7 7"I

M7I



K/}
J6 

{7r

` 7
f/7


<7 7"I

78
.B7X
7
%O76
Jx7
77I4
M
?@?
W77p4

776)('&
p77r

K
%7
<77 77"I
77I

J776
? 7() 

?abc.com?
8
?xyz@abc.com

@7b

- 7& 
U74 7bO$

J

<7
&"


?
 
m/O

1 ?WHOIS(6
?
/?
x78

J
7


VZO
- & 
+4 L
J

K- L "I
bOp E1F
xY

B6




Y^
pp
b
3"O
6/
4
a?


4

S?
6/
U4
dL
(3 
`O
t


p$

. Ewhois.netF

WdL






W

 

40

7 6
Jx7
%7&
)('76
}`

pa
8

p
/
\Z
E I8

U7 r
=
=77S?
77bl
^77Z
p77)
/77
77
K3`77Z 
776
0S 77#
m77

- 7p
7
7I4

d7VO
I4
Kp
%&
)('6
4
M
^Z 
Y

?
 7/
=
7b
}
7
pa
YI
#
-./

a
x^6
m&{r
mZ]&
6
U4
+g



K\/ ?
 =
= a

p3`Z
(6
pr
.Z
` 
M
/ 
I4
dn


7/}

76
7

7S
za
7 r
7/
g
 /
+ ,`
6/"
fx8


K/

^
<
&" %  
/


`za
&` $
Cp


776
77
773L
77
77
E1
J2F
(77
M
1 %& 773<
77/
y77n6

7773L
777
za
777`
H777/
g777
7776
3777Z&

2 EGmailF
%777&)('



]7777777b

( 1-2)

(gmail.com )

(1) mail uses Google's innovative technology to keep spam out of your inbox,
gmail.com, (http://www.google.com/mail/help/fightspam/spamexplained.html),
December, 2007.
. Egmail.comF
 (
3
U4
3
%&('a
6/



`E2)

41


 

W



&
3Z
g
6
H/
3L

mI4
3 

K3`Z


}
/Y c6
</{r
%& 3
&
3Z
g
6
H/
7L?
(7O
m7I4
73

4
% a

1

g
 /

K/

8.3.2 :

)(SMTP RFC
^77Z6}
77L

77
77`i"
- 773]
77I77 O
&`
77
776
77Z3

M
ESMTPF
6=
`


g
 /
7/` 
7
77

t7

fxY
`O$"
K
- 73
%
7/}
7
76
g7
76^7Z6
H7/
/7
q
=?
P6

<Y4 " 
N`
- 73" 
7
]
7I7 O
&`
7
76

7Z3

`
ESMTPF
M
<Y6
<(i
/6
Jx

mI 4
Jx(6 7
+

7Y



in 'KEHackersF
/
3L

mL

9.3.2 :
)

Fake MX

(Records
?

7S)
/7.
- 77,
+]
M
7 

 77/
J7b
76)('&
g77
%7

8
/ 3O
-pV
dn
= 
=
7I4
]6B
7
?
. 7
U74
- 7L "I

0p

4

6)('& "&
<$
%

K

c&?
Wbr
M
&/

76)('&{7r
?
%7


d7

7,]O

7L=
E 7I8


M
V/
?
/

x8

07O/O
8
<L/7
7
7(r

K
=
<7L
]
w7&
/#?
,
7 S
7#O
M
7 ?
7VI

K
 7/x7C
{7r
7




 

W



42


/
bO$
?
d
$

J
<L/&{r
U

yVI6
bO$

m7


m&{r

03Z

d
Km6
Jx
4&
E I8


-pVZ 4$ 
]6B

U4
<L/]

WVZ
%,

)(Fake Lowest MX Record

774

7

&/7c

"
 7=
73
76)('&
g7
%7 /O
}
7Y&
M
7/
 774{
877
+
77 77bO$
77

776

+g377
077?
M 77S
/}
<77Y6
$
)('& S
M
%

r bO$`I6



zaI

J6 

K%
3O
V
,O
\b6



/#?
%,]O
<L/
F6B
M
-pV7Z
/77
 77
773L
77
?
. 77
077
U774
- 77L "I
p77$
77
774

776
)('& "&
<$
%

(
 r

g
 /

K/
?
0
73O
V7
/W6


 7/&
U77I4
za

F76B
7
&

7
77(6
v77
25F
25
<77L=
x77]I

x77CEPort
77
` 77,
7
p77

 77/


4
`r
/


K\/

)(Fake Highest MX Record

/}
.J36
L
g
 /
/
bO$

d7 7


J
<L/7
]
%,

$
U4

J
<L/]
%,& S$
U
7
78
g37



J
<L/]
%7,
U74

7/7
d7

7 S
7ir (
74 r
7L?
q

43


 

W




g
 /
d
&= `
/


K\/

3O
V
,O



U4?
%,]O
<L/
F6B
M
-pVZ/7

7

3L
?
.
0
U4
- L "Ip$

4

6)('&
<7$
%
&"
]
 xC
Jb
 =a
M
H

g
 /

K/
 3O
V

 /
U4(6
L
F6B
?
_/
g
7I4
za
g6

/ O
&'&?
Edead IP addressF

w
I4
za
/W6


v7
%``S
(6

xEPort 25F
25
<L=
x]I
` K
(6

p
3"O

4I
-pVZ/7
a
7]6B 7,
.

?
M
7
7,r
(

KE2
J2F

) (2-2

10.3.2 :
)

(Greeting delay

7
73L
7
+g7bL
+']

/ O
8

76)('&
%7

73L

3`7Z
/

0
U4 bO$


'(a
6/&

K/
%

7 `3
- ]77#]77 O
77I
&`
77
776
77
m77&{r
ESMTPF

77Z3




 

W



44


0 bO$
{r
U4
7



7/
7@
= 7c&$ 3`7
=
 7'
7
07S

 =a
3L
3`Z

6)('&

Kma
%
(
]$
+'7r

+
g7
 7/
J7b
fx78
/ 77
7/

} 4
Y//cI6$
+
= 
'/6

0S

0

+/W 3 bO$


K
 )(
4a
7

fx78
_ 7 $"

7`6/
d7"L
<7h
7 7bO$

d7



K/

45


 

W



"! -
 ./0 ('& 
)(Phishing






W

 

46

m77r8?

m77]6/O
v77S
77
%77&"
)('77#$
77b]
x778
L 77I6

K- cI
/r\
Z
U4
m4
3O'=
/n

77b^
- 77& 3
L/77
WEPhishingF
%77&"
)('77#$ 
77=
77O

7b^
7i&
/7
%7&
)('76 
7=
76/
74
 Z@
6/Z

i7,
7Y6a
7I
7cI

?_=
7b
7S?
7b^W
7i&
6/
4



Km8?
0"
6Q

Y77
/}

%77&('$"
77#$ 
77=
 77/
77
77I
x778
%77

77
78g
6/77Z
7L="
7#$
7"

%7&
)('776 
7=
^7Z6


K (
3
%^Z
/

\/  
Z@
b^
- & 3

 77=
{77r
ESpamF
77/
g77
77& 
)('77/
M
77@
%778
77

- `3"O
za
8O

7"`r
%&
)('6
U4
/b`O$
%&"
)('#$


?7& 
7/
ESMSF
+g7b`
7bI 
7/
\/7 '
)('&


M
7(6
_p7 $
7(

m7Z]&
U7`36
Y]

EInstant MessagingF
+/W 3

/7 

%78

%7&
)('6
(
= 
Kmp

/X
x]IO
<6
Jx



K1 %&('$"
#$
- V8
x]IO
M
4W

?ph?

r/7@
37Z6 
+ 74
EHackersF
7 (
37

%7L'

?

7 (
37
I7#/L
d7k
J?
<Y7k
M
+76

- 
. &)
?f?
_/@ 


- I7ZO
M
EPhishingF
7
-7&
K
F7l
7 (
7(

m7Z]&

78

7"I 

KZ"
#
O
t
EfishingF
(

6/
/`
ESpamF
/
g
66 
/

Y
%&"
)('#$= 

(1) A. Emigh, "Online Identity Theft: Phishing Technology, Chokepoints and
Countermeasures", Radix Labs, October 3, 2005.

47




W

 

M
77]
077& X
za
r 77n) 
%4 77

$
077& X
77Z6
7,6?
Y77
/}
77

77IC
H 77
w77
=77I6
` 77
/77
77
x778
i77,
U774
77S$
774


KESocial EngineeringF
4 
$


7``S
- 7cI
8=7b

?7&"
)('7#$ 
7=

7/}
%46


77b^
m77O & 
. 77r)
776
x778
3`77Z}
77
77
M
77  =_
77b


B7=
^
7Z
<
7

7
_/7b
M
%7b^
H 7Z@
U74

 - & 3

77& $
EVISAF
B77r
77L "3
77& $
- 77L "3
- 77& 
?%77b^
F776/


K `S$
i,
b^W
i&
YL/
/


?%4
7O
%7&('a
76/
 7=
%&('$"
#$ 
/
J`O


ESMTPF
7Z3
76
7`&
7 O/
{r
` 
/ }


K?_
?/b
8=b


?+=/77, 
N77

7/ 
77I4
77
EAuthenticationF
67b
77#
7`]6

x78
M

K
7/

7I4
7`
074p
7(
m&
/ 
b^W
``S
N(6

7Y6)
_/7b
x7
7"I<
7 

743
`] 
66/
&I4
/
d,6


g7
76 
7=
^7
76/
74

K?_
?/7b
78
8=7b

3`Z



K&
)('6
6 I4

 8
 
/
fx8
/O
ESpamF
/

- 77& 
. 77r)
3`77Z

77
77`6/"
 77/
fx778
\77
077(6
_77


7 (
7
_/7b
x7
%7&
)('dL
4
%b^
m ZS
za
 

7
.p7
7Y


766_
/7b 
7=
EStyleF
I7
Y 
`6/"
 /

f= 7W
ELogoF
_/7b
B7=
d7n
ELook and FeelF
ZS)
/cI
vS


KEslogansF

7
. 74
$
78
 /
 
\
M
w^}
t

0 ?
S?






W

 

48

P3O

$
m&?
-]I
L
3`Z}
%b^
H Z@
za

 -$

=B77
d77L
/77
x778
77(6
 77/ 
77

/77
M
77

77I

/77cI
77,6?
v77S
77
%77#_
/77b
d77L
<77bO
 77"
<77b
ESpoofedF

7P8

7
f= 7W
fB7=_
/7b<
7

d7n
ELook

and FeelF
7ZS)

077
%77bI
B77'
77
%778
$?
77&
)('d77L
. 77&)
77 
77

d7L
7
=b
Z&
- Y3

EHypertext Markup Language HTMLF

_7C

pY7
/7?
m7 (
%7&
)('dL
Z&
US

?\/ )('&


7

_/7b
x7
74
m7&?
_ 7#
Jx7
3`Z 


8




^7Z<
7(
O 7
+ 74
t7
%7&
)('H 7Z@
za

 - & 
L/Z



K%b^
F6/
B=

7
07"6
EformF
I
+B
YZ]&
&
)('6(
= 
O
L

77I<
77Z

?77/

za
\/77 ?
+/77
C 77=<
77h
77
m77P3O
3`77Z

%7&
)('76
7 S
M
7 (
37
U74
d7L
I4
za
mr
P3
- & 3 


KEWeb-based E-Mail webmailF
 (
3
U4
3


i7,
Hx7

Jx7<
7"
w
7 

766 
/ 

?
Z

M

d7L

7
7I
_/7b
7\
7
p4
(6
_
?#
m&?
&/

Jx


Km"
i,"
#

Jx
+= Ib
Hp
=B

" 77777#$ 
77777=
M
^77777Z
+=Y77777\
/77777  
77777
77777



W1 %&('$

7
07"O
7
_/b
M
3`Z
H ZS
M
(
E I8

?%4O
 =
J
(1) A. Emigh, "Online Identity Theft: Phishing Technology, Chokepoints and
Countermeasures", Radix Labs, October 3, 2005.

49




W

 

K /
M
=

B
dL

(
 ^
=yib
dL
+= 6
3`Z

m74
/7O
/7"
M
7
_/7b
M

3`7Z
H ZS

?%4O
 =
J


K- p $
ir (
q &/
M
VZ

7Y3"
3`Z `<
6

]6B
#
M
%8
- 3
+=O r
 =
J


KF6B
0"
x8
. )
 /
M


/
3`Z
B6

M/77b
H 77Z@
U774
d77L
g77
g77O
77b
F776B
= 77Wa
 77=
J


Kg
x8
M
/cI
/
3`Z
B6
3`Z}

U74
/7O

7
_/7b
M
+76

7 
- 7
B7&
%4O
 =
J


KL
+']
& k

fx8
U4
b@
#/r

 S
p4
m&

3`Z

=B7
d7L
za
m7
6
 7/

3`7Z}
{7r
` 7Z
-$ @ 

S

M

77b^W
77i&
M
7 `S$
? 77b
?Y^77Z6
t77

6/77Z
- 77& 3
d77X


K\/ ?

 
?a
- 4
M
i,


W 
-
"M
%&('$"
#$
- V8
= b (

K%&('$"
#$
VC
"^
J1
KF6B
dL
BY
J2

77S?
^77 
77(O
77L
77]6B 
77/
77
77 8
77
77=a
J3
.ESpamF
/
g
 /
0 ?

/
d3O
 /
y]
`6
+=B 
/
3`Z 

4
J4

KF6B
dL
M
"
- & 3<
 
h

 /
M



- 77b^W
77iI6
<77h
77

6/77Z
- 77& 3
L/77Z6
 77b
J5
K 6 i,




 

W



50


777
1
7 7
- 777VC
777L "777#$
'($&
 777=

%7 7
7776

)('&
M

%(

E1-3F
t7
<7ZL?
7
7Y&?
Y
7/}
<74 7
?

M

? 3 ?
_/b?
 
$
4
3`Z
 
74?Wf'
?
77n

="
 `&p

i]#
za' 

7O
Jx7?
y7,O

fx78
d7L
%78
i]7b

? 3 ?
dL
<b
 "
F6B
S &

%#
/7cI) 7ZS
look and F

Efeel
EstyleF
I
B=
dn
M

_/b(


KE2-3F

) (1-3 ""

?

E1F @

]L
 =
h "#$
'($&
%

.p
Y
S
EI3Z

?6
+6/

 6/

Z
6

14
w3Z
J@2006
/6 I6
14

J
781426
V


J


K13718

51




W

 

736/L
m7n
za
74
6 7b
?
7
_/7b
" I
<
M
I`L
a

78
7
mr 7 
i7,
7
U74
0
} 7b6

%7

yi7b"
I
<


7"I<
7

I
Esamba.comF
8
3 
_/b
yib"
I
<
Kz

/7 =
B7
d7L
7"I
<
M

Esambaonlineaccess.comF
8
=B
dL

%77"6
%S6 7

/7W 3
7bO$
77O

EonlineaccessF
/7
_/77b<
7



KdL
4/
4 3"&

"( "2-3)






W

 

52

=B7
dL

m 

\
%#
3 
dL
8
E3-3F
(

K%#
dL

"( "3-3)

d7L

?
7,6?
7Sp&

K?
76/_
?/7b
d7L
8
=B
dL
/


(7
M
7
_/7b
%#
dL<
" 
#
E4-3F
(
M

=B


K ZS)
/cI
I
= 
vS

E5-3F

d7L
7"I<
7
Eriyadbank.comF
W
78
%#
dL
" I<



KEriyadonlin.net.msF
F6B

53


 

W




0 7??
W
7br
M
L II "7#$
)('&
0 7?
7b]
(7
?
%7

77S$
BO
M
/776
d77L

.B77

M
L II77)
/77.
- 77,
+
- 77 S$

$^]

_  $
dLB=

K+

) (4-3 ""




 

W



54

) (5-3 ""

/Yc6(

/7
$ 
E6-3F
d7L "7#$
'($&

%7x78
 7



K?H ?
_/b
dLB=
<
 7"I

Esabb.net.msF
<7
$
m 7 7"I


dL
M

Esabb.comF
%#
KE7-3F
(7&?

7,6?
\/7

d7LB7=


 "
<#
dL
vS

%#
I =

/cI) ZS

K

55


 

W



6-3 ""

) (7-3 ""






W

 

56

(3
U4
8#=
Echat roomsF
h o_
/
3L/
w 1 
=M

" 77#$
- 77V8

?-/77Y?
EphishersF
 77b
77Yr
77
77
t77
77 

- 7VC
fx78
.

=a
7

7S^
7W

73L

7
x] IO}
$
4
(
%&('$

EphishersF
6 77b
77
77
+4 77Z
77
77k
M
77b^
77
/77
^ 77W?

77O
B776BO
M
EhackersF
/ 7 ^
EspammersF
77/
g77
 77/
%77
/}

77
77
- 774k
+774
E 77I8
w
77&
m77&?
77
=fx778
-77

K- 77VC

7
EcashersF

7bo
EcollectorsF

7
EmailersF

7/
bb^


W% 
M
_/ 
8

EspammersF
7/
g7
 7/
/}
a
<8
WEMailersF
/
J

g7
 / 

8
4
= a
U4
+=`<
Y6
6x
EhackersF
/ ^ ?

KEfraudulent emailsF
 S$_
Y
/

d77L
B77Y

6x77
EhackersF

77/ ^<
778WECollectorsF
77
J

7776
<7776
t777
777S$
/777
Efraudulent

websitesF
777]6B
77&)('

d7L
fx78
<YI7
07"O

7
7/
g
66 
/
3L

Ya
6 i,

K& $
L "3<
L=

?=/<
L=
^Z
{<
6/
- & 
6BO

EmailersF

7/ 
I4
=/(
.p4
<8

=
?
wcS$


K/
g
 /
)=
6
 3
r6
<8

L/7Z
6/7Z
-
7& 3
x 
`6
6x<
8
WECashersF
b
o
J
(1) Christopher Abad, The economy of phishing: A survey of the operations of the
phishing market, First Monday, volume 10, number 9, September 2005,
(http://firstmonday.org/issues/issue10_9/abad/index.html). M. Jakobsson, S. Myers,
Phishing and Countermeasures: Understanding the Increasing Problem of Electronic
Identity Theft, Wiley, 2007.

57




W

 

- 7L "
. 7&{
/7
+7
p7$
x]I6

K Cp<
h

 
3L


J`I
0iZ
^ZO
]6B
r/b
-  ZS
- L "

?]6B

 -  ZS

./7
?
EAutomated Teller Machine ATMF
%7_
/
7b
+B7Y
?

/W 3



K Y"
d3

. 77`
77
za
/77W 3
J 77
dr77

77a
77r/
77bi
.$778


Kbo
6`I
- L/Z

3Z&
<Y "4{

?L/Z
6/Z
- & 3

- 7& 3
+7

U74

7O

37ZI
76/
74

?+/W 3
.
4r
6
  3

- 7VC
U4
bo
+=L
U4
,6?
O

 V 
3L

Y
+B

^77Z
-  77ZS
- 77& 3
77`
- 77cI
F77
U774
+x77]I
-$ 77S$


K


%7&('$"
7#$
- 77V8

?wi7n
?t7
77
=w7b
7I8
za

7Y&?
$a

7
M
7/
)
-  b<
cI
` "
cI
-  b4
8.
=F`O

7 (
37
74
J?
%7&
)(' 7
M
<76
8x]IO

?M
`r
YI4
Fl


KEInternet worldF


6

p 4

`O
Y&?
%&('$"
#$
= 
M
% I$
.%

- 77 S$
M

773
m778


77
778

77&
)('77I
- 77VC
774

7776 @=
777Vr
K
J/7773
777 
7778
$?

- 777cI
M
777I
- 4 r777

ESecure

Socket Layer SSL CertificatesF
77I
- Y77
EFirewallsF

78g
(Intrusion Prevention Systems IPS rules)
'7 $
d7I
7c&?
&7L

%7&
7h
p7
F7LO

?7($
7](
c8 3
I
6 @
 


7I4
8=/7n
F7L6$
t
cI(
 


3
4
Eonline trustF






W

 

58

M
g37
=/7n
7Sa
za
86

`r
6/Z
b^

- & 
H/ZO

%7
/7
7c&

?7 (
37
74
.
]^
bO$`

 
h
K- cI


bO$<

 
8g

?FO C
4
The Anti-Phishing

F
%7&"
)('7#$ 
7/
J7b
74
74k

- 4 I7b
F7
\7Z
U74
7 4

%8

K1 EWorking Group APWG

 7=
74
7 I
b^
i&

- 
Jb
&&]
`a
Yr8


K%&"
)('#$

J7b
74
4k
mO4?
Jx
2007
4

r&
/YW
2 /6/`O
M


W/Y

M
w3`
4
?
/Y?
EAPWGF
%&"
)('#$ 
/
K" #
= 
4
p
28074

- 7cI
7&('a
d7L
4
]6B
&('a
dL
4
p
23630
K``S

 7=
-p7
76
/
74
Ebrand hijackF
Y]6BO

6=
p4
178

w7L

U7S
7S
/Y7W
M
V7Z
<7L=
U74?
<L/7
x78
K
%7&('$"
#$
K/Y
x
/6/`=
#a

U74
-7S
7YI4
73

%7&('$"
7#$
= 
k

34.3

777

KEdomain

namesF
- 777L "&
.
7 7?
777P8
U7774
777&('a
d777L
777=

KExyzbank.comF

(1)
(2)

The Anti-Phishing Working Group, www.apwg.com.

Phishing Activity Trends, Report for the Month of November, 2007, Anti-Phishing
Working Group (APWG), apwg.org

59




W

 

U774
-77S
77YI4
773
%77&('$"
77#$ 
77=
77k
77
6

KE10.212.21.33F


 K6/4
6 I4
P8
U4
&('a
dL=

KmLpa
3L
F6B
dL
. `

8
6?
hph
KF6B
dL
. `
+

?%8
6
30

- 774
M
77
/77
M
rY77Z
77 
- 77cI
774
776
K6= V
p
F6BO

% 77a
7793.8
m377Z&
77

rY77
/77 
77 
- 77cI
77cO
KrYZ\
/ 
- 4 Ib

7
74
M
7(6/
+7i
- 76$
b
w"l
/Y

M
24.21
m3Z&

&"
)('#$
dL]
,Z


%77&('$"
77#$
- 77p
774
E8-3F
%i77n(
77
3776

77
77
m77Z]&
/Y77
za
2006
r77&
/Y77W
77
+'77]
p77
6/Y77W
77Z
K2007

%777&('$"
777#$
d777L
7774

E9-3F
%i777n(
777
37776

7
7
m7Z]&
/Y7
za
2006
r7&
7
+'7]
p7
6/YW
](
+6X
K2007

v77S
77
- 77cI
77&?
77
77&
77(
377ZI
E1-3F
77X
3776
K C
%&('$"
#$
- 4
_Y


K&"
)('#$
dL
r ,
3Z&
M
z
/

E2-3F
X
36



60


 

W



) (8-3
2006 2007

) (9-3
2006 2007

61


 

W



) (1-3

)

(


- 



EFinancial ServicesF

93.8



ERetailF
BV 
d3

2.8

B


(3 


EISPF

2.2

@(
`

- 4 Ib

EGovernment & MiscellaneousF
\/

1.2

) (2-3

1


2


3


4


5


6


7


8


9


10

)

(


24.21


- 6$
+i

(6/

23.85



b


IC
=




I6 O
= &


? &


=
6

IX
(


+i


Z&/r

9.39


8.06


4.64


3.53


3.41


2.42


1.47


1.47






W

 

62

77(6/
+77i
- 776$
M
/ 77Z
?
/77Y?
EGartnerF
77
1 77
M

3.2
za
2007
74
M
b
w]O=
L
%&('$"
#$
- V8

 I


%7&('$"
7#$
- 7V8
M
4 ]O=
,6?
/6/`
/Y?
K%(6/?
=$
6p

- 77L "3
-  77Z
77&= `
r/77b
-  77Z@
776= X
- 77L "3
-  77ZS
U774

_= 7b
7I4
7S$
- 4
_  
c&?
Fn
za
03Z
d
/6) &



K& $
- L "3
- /W
za
3ZI 
YI4

74
7
N"7Z?
/Y7W
M

J/7
?

p"7
U74

. 7I
m7&?

7,6?
7
/

- 7V8


?37O
7(6/
+7i
- 76$
M
^7W
4500

/ 
2007

 777 
777&= `

2007
777
M
777 ?
7 7S
w777``S
%777&('$"
777#$

774
" 7# 
7=
3`7
6x7^
77W
7
K3,3
37Z&
w7 L

` 7Z

" 77#$ 
77=
0377Z
77 
/ 77Z
77n/O

<77Y&a
%77&
)('776
776/

J?

m`377
Jx77
77

M
m77Z]&
.%77
77n/O
2.3
777
77&= `

%77&('$

Y 77
- 4p"77
U774
. 77I
2005
77
77
2.9
777
77,6?
77&= `
2006
.EGartnerF
3L

w6/
?

77 
- 77
77"L
77
FI77bO
t77

2?PayPal?


?7,6?
77
/7

7n/O
/7 
7&(
O/7
7BV 
d73"
L

FIbO
t

3 ?eBay?
KEbrand spoofingF
6= V
p
i&
- 

U4
  
I
8

%&('$"
#$
- V8

4&
E I8
(1) Media Relations, 2008 Press Releases, Gartner, Gartner Survey Shows Phishing
Attacks Escalated in 2007; More than $3 Billion Lost to These Attacks, 05-March2008, (http://www.gartner.com/it/page.jsp?id=565125).

K&
 
)('-p6i
- 4r
M
bb^
 /W
E2F

K (
3
6/
4
BV 
d3
M
bb^
 /W


E3F

63




W

 

7
J
 7b
7Z6
7I
x8
M

KESocial EngineeringF
4 

$
IC

7i&
76/
^7 

%7&('$"
7#$
- 74
M
J/73
-0& X&


/

 7"
7b
+=B7
d7L
za

3`7Z

m7

Espoofed

emailF
b^
7777777

- 77& 3
. 77r)
3`77Z

77
 77/
d77
77r/
77
77P3O

?77#?
d77L

K6/Z
b^

U774
77
77I
778

%7 &('$"
77#$
- 77V8
77
/77 
77I

q/7
=B7
7I
x8
M
 b`
6
Etechnical subterfugeF
I]
0 

77b^
- 77& 3
L/77

7 Cp
77
<77O
6 i77,
+B77Y
?
M
ESpywareF
N77Z

77i&
- 774
M
7 `S$
Y&^77Z6
v77S
6 77b
za
C 77=a
6/77Z


K1 b^

Anti-Phishing Working Group, apwg.org. E1F



64


 

W



65


 

W



"! 1
 2 ./0 ('& 
)(Phishing Techniques

)(DNS Poisoning

)(Hosts File Poisoning

)(Content Injection

)(Man-in-the-Middle Attack MITM

)(Address Obfuscation

)(Malware Attack

Search Engine

(Phishing

(Attack

)(Fake Address Bar

The Popup




 

W



66

67




W

 

K%&"
)('#$
M
^Z
0 
b]
x8
L I6

(DNS poisoning) : 1.4

7`6

?H7
x78
7`6/
K
73
74=B
J?
EPharmingF
,6?
UZ6
Domain Name Server

F
- 7L "I
. 7?
7
U74
VC 7
EhackerF
H/7^

K-pVZ 
04p

EDNS

- 77&(
77S?
778
EDNSF

- 77L "I
. 77?
77c&
{77r
` 77
77&/
77

(7
7O
- 7L "I
. 7
7
+74
7
(6
 (
3
 

6/7
7YI6 I4
- L "I
. ?

/
8
cI
x8
- 
<8?
K (

77() 
J?
m77
077 ^
/77
77^
J/77
77I
77r/
77
77$
m77&
-4F
(7
M
7

7
3
Ur
K (
3
3ZI 
FO C

f= 34

7C
V7Z
J/7
7I
Ewww.ksu.edu.saF
7


<
&"


E1


777S 
+777


777(O
fx7778
/777
- 777& 
E213.230.10.197F
7778


K- L "I
. ?

S?
M
pp

za
+= 7W)
za
J76
7
6/7
6 I
g
-pVZ 
04p(
6


7Z
p7$
7
7
{7r
7
7



M
(r
K]6B
dL


?7
$3r


X
J/
I

Jx
VZ 
04p


7
7

7"&
<7$
yi7b
J/7
7I
- 7L "I
. 7?
7
d

/6}


K=B
dL
za
g6
]
6/4
&I4
d
g
m&{r


- L "I
. ?
U4
3"I6
m&{r





M


@ x

07"O
t7
d7L
7
78g =_
7b
- L "I
. ?
YIn

\/ 


K6/ 
ZS
b^W
- & 
6BO






W

 

68

( 1-4)

77778
?_
?/7777b
7777"I<
7777

?
E2-4F
(7777
M
7777
/7777]I

" I_
??
` 
)<
/b
yib
J/
I
?
Exyzbank.comF

x7
7"I<
7^

W
 
Ir
E88.33.22.11F
8
Exyzbank.comF


^77
77Y

`77
EInternet

BrowserF
77 (
377
y]77b
M
_/77b

?_
?/
7b
J/77
77I
774
p77) 
y]77b
q 77&
p77
77

7
7
7 _
7#
{7r

K- L "I
. ?

za
p$
0
{=

(7777
=B7777
J/77774
7777I
g7777
m7777&{r
E3-4F
(7777
M
7777
7777Z

_/7b
%7#
d7L
7
7ZIZ
F76B
d7L
za
g76
Jx
E92.45.67.89F

m73
Jx7
78
_/7b
7"&
<


?

?i,
m
/6

Jx

??

7
7I
M
074p
7
` 7Z
7
M
7I6?=
7
N
mI
 
mZ]I


Kyib
I 

g3
S
za
Y 
m

vS

69


 

W



) (2-4

) (3-4






W

 

70

(Hosts File Poisoning) : 2.4

H7?
-
7
7S
za-
%&('$"
#$
0 ?

H
x8
m36

<7Z
EhackersF
7/^
7`6
H7
x78
M
K
- 7L "I
. 7?
<
ZO


Ki,
Y

M


Ehosts fileF
],

F

m]7b
6/7
7YI6 I4
- 7L "I
. 7?
7

]7,
7
F7
/6

ElocallyF

7
m7
<(i]
(
,

F

?$a
- L "I
. ?



K^Z
Y

3L


77I
774
v77i3 
$
?77`6
77
77Y

{77r
77
d77L
077
77I4

7
J/7
7I
74

p7$
73L
7
- 7]
M
7<
7$
J/


K- L "I
. ?


7c&
M

]7,

7
F7
M
%7$
V7Z

E4-4F
(7
/6


.EMicrosoft WindowsF
I6
wr/(6 


7
/7
-pV7
{
7r
- 7L "I
. 7?
<
ZO
H?
M
&/ 


za
6 i7,
m7

/ ^
3L

8gO
<6
6/
YI6 I4
- L "I
. ?

7`6
vS
],

F
<ZO
H?
M
,6?
mZ]&
]
@ 6B
dL

77
i77,
77Y

M
]77,

77
F77
<77Z
m77Z]&
.%77 
77/^


KF6B
dL
J/4
I


<
&" /
6

V
dn

i7,
m7
O
<
H/ ^
3L

_ ,
VZ

E5-4F
(
/6

m7&I4

?I7n'r
Jx7
%7#
d7L
7

$7
E92.45.67.89F
F6B
dL
za


KE88.33.22.11F

71




W

 

localhost

127.0.0.1

( 4-4)

xyzbank.com

92.45.67.89

( 5-4)
Content

) : 3.4
(Injection

Emalicious contentF
v73
\7
r 7n{
 7b
7`6
H
x8
M

v773\
77o
x778
77`6

?77(

KElegitimate

siteF
yi77#
d77L
M77I`S
?

W%  


K\/ ?
dL
za
yib
dL
/
m
O
+ 4a
J


KdL
/
Y

M
EmalwareF
3
q/
0 /O
J


K%&('$"
#$

za
dL
M
 
- & 3
m
O
+ 4a
J


W\o`
S
""
#p
 ?

?&hph
E I8

EhackersF
7/
^
7`r
7 (
37
7
M
I?
+/h
p

J


KEmalicious contentF
v3
\i
Elegitimate contentF
%#\
o
3 

EhackersF
/
7^
y7ZO

7 (
37

M
I?
+/h
p

J
Cross-Site Script F
77
+/7
fx78
_/7O
K
7
fx78
M
73

73L

7
_ 7,
\7
7
q}7I6
EProgramming

k/
`
? S

FlawF
%7k/
7

%78
EXSS






W

 

72

<7`O

?EblogsF
- &7
M
=B7
- 7`O
7
3
U4

K%

=
=b


?Ediscussion boardsF

7`I
- `S
M
 =

?Euser reviewF

qI
=B

U74
7
%7&
)('76
M
+
?
= 
=vi3
- /
M
v
- 



KEweb-based emailF
 (
3

7L
` 7Z
7
M
7
7
=
= 7b
3L

_ ,\
o
x8


73L

/]
8

Y]bO
<6

3
k/
(
? W
U4
\
(6


m7I4
q7I6
7

=B7
73L

- r na
3`O
t
dL
fx8

],Z




KdL
i]#
/4
I4
6 i,
y]b
U4
3
 
fx8
4

1 ECNET

News.comF
= 73

?
M
=7
7I
x78
U74
L



<YL77
M
77I?
+/77h
yi77bO
774
p4) 77
gY77
2?PayPal?
d77L
77L
77I4

+ 74a
za
J76
<YL7
M
v73
dL
`S

 (
3
U4
%&)('


KF6B
dL
za
& $
L "3
- & 
a
i]#
0
I4
i,
m
O


78
\7o
7`S
"7
%
7&('$"
7#$
7&?
7
v7 
I
J

773 /
p77$
7
776/
74
77`@
+/77h
U7ZO
d77L
M
7I?
+/77h
p7

- 77& 3
+774 L
M
/77?
x77]IO
<776
77`6/"
fx778
M
KESQL

injection vulnerabilityF

+74 L
M
06/7ZO
mI4
qI6
L
dL
F,Z

M
Edatabase commandF

K- & 3

73
7k`
 
S

Y
3 /
p$

6/
4
`@

73L
7
/7]
78
7
Y]7bO
78)
7V&
78
Ecross-site

script XSSF

(1) PayPal fixes phishing hole, by Joris Evers, Staff Writer, CNET News.com, Published:
June 16, 2006 4:12 PM PDT, (http://www.news.com/PayPal-fixes-phishing-hole/21007349_3-6084974.html).

K (
3
U4
BV 
d
dL (2)

73




W

 

K- r na
3`O
t
dL
fx8

],Z

74
7`@"
7

%7&('$"
7#$
H7
L
1 
S?

 /7W
d7L
7S 
78
ESQL injection vulnerabilityF
3 /
p$

6/

B
77S
%77"l
d77L
=
77S?
" 77
77I4
Eknorr.comF
?=77I ?
77 
776x

d77L
M
77I?
+/77h
p77
776/
774
Elogin

authenticationF


77
677bO

7I
+/7
p7
7
 7Z3
K
73 /
p7$
 @`
"

wi

<7
'O
73 /
p7$
7
M
7`I
7# ]
?;?
`I
# r
r n{
fx8

y7n
/7
`r
b`
Yr
x]I
M
m
8?
$
O
8
%O6 

?za
true logical

F
ii77#
77`"I
+= 7734
EHackerF
'77^
d77,6

?%77](6
K/77 ?
$

p77777777777
$
777V&
777(
p777$
M
777`I
777# ]
7773L


Eexpression

7
7
7`S
M
Eor x=xF
7`"I
+= 3
dn

3777777777
U4
ii#


K6b
B
S
%"^
 @
O
M
]
=/^

Z<




Man-in-the-Middle

) : 4.4
(Attack MITM

r/7"
7
7
7b^W
7i& 
7 

 7b
7`6
H
x8
M

M
77

d7L^

7Z

7
7 (
37
U74

/7W 3
7bO$
74
p7

+/7W 3
7
7
7
7<
'76


?%78
ii7b
7 @
KE6-4F
(


K
E7
J4F
(
M

r/"
p(
Yk

J?

(1) Knorr.de SQL Injection and XSS Vulnerabilities, Sebastian Bauer, 01/12/07,
(http://blog.gjl-network.net/blog/index.php?/archives/78-Knorr.de-SQL-Injection-andXSS-Vulnerabilities.html)




 

W



74

<776
773L
77
 77 77b

. 77&a
776/
774 77bO

77
77(
77b]I

^77Z

d77L/77
77bO$

m77
77(6
 77b

M
77
F77bI^77Z

 b
y6

dL
` 3

- & 3 b=

+^Z

za
74
M
d7L
bO$

EInstant MessagingF
/W 3

<7h

7Y
074p
74a
+/7
C 7=a
+
?
za
\/
dL

Jx
?
c6

- & 3= L
ma
+

^Z

K 


 S
M)=

 S
M
x/
{r
 b
?`6
,6
 `
C 3
74a
<7h
+

za
C =a^Z


M(


KE8-4F
x8
M
?
/Yc6
H
bO$

$?
r/7
7
<6 7Y

78
^7Z

?F

E
Y
?F
dL

M
<8
(

KE@``
'67

74
- 7& 3

Y

/
?
7
_/6
M

/?


KEMan-in-the-MiddleF

) (6-4 " "

) (7-4

75




W

 

( 8-4)

^
7Z

7
7
'4
p


M

/
V8
 r
(O
L



K
'4


?dL

?
7I
7V8?

77
7
U7ZO
7
'74
p7
7VC
74 r
(O

^77Z

77
- 77& 3
r77O
p77 EcontentF
\77o
g77

EActive

AttackF

76i
/7
m74_
/7b
7
7
'7 S
M
7
37
Ur
dL

H 7Z@<
7L=
EHackerF

'7^
7b
/
76
}
7L
E9-4F
(W
-  Z@

% 

Jx7
H 7Z@
7

$7
E4444
<7L=
H 7Z@
za
pF
ma

6
/


73`


7
M
7
/
d7
7'6
\x7_

/7b
7`r

7
d
fS


K b
fS
Jx
H Z@
za
% 
6i
x]I6
0"

7VC
?
?
?7Sp
V8?
7 7
UZO

'4

4 ](
O

<7{

6/7Z
- 7& 3
7`
7
 7b
7(
7

EPassive AttackF
?
7Z

d7L
za
^
7Z

73L

C =a
S
M

%b^
F6/
B=
^Z


K^Z 
b^W
i&
M
`S$
Y^




 

W



76

) (9-4 .

\77Sa"/77
"
77V8?
773
M
77
/ 77
<77ZO
%778
?77
?
. 77

6/
4
EDNS PoisoningF
- L "I
g7
-pVZ 
04p 7I
6
6/7

za
gO
%
U74
$ 7
K
7]6B
d7L
07

7p7$

747I

J/7
?
_/b?
{r


p$

Z

VZ 
04p
7
Jx

7
d
?
. 7

- 7L "I7I

I

x
J/?

$3r
_/b
} /6

I4
d&
g76

7]

6/74

7


J/ "&
<$
yib

?
_/b?
/}
m&{r
B
dL
za=

4
dL?
_/b
%#?


K
x8
d`6

dL
+/"7
w
F6B 7b

B76
7Ir

K
7

74
_/7b
F
dL
Ei,
< 
F6B^Z
=

B7
F76/^

%7b 7
7


(776
m 77ZS
za 77b

fx778
77r/
77
- 77& 3
6/77Z77`6
<77h
77
 77b

 ^
d
0
dL?
_/b
%#?

b^W
x
piI


Ki,

5.4 : )(Address Obfuscation

`6
 b
x8
M


dL
F6B
H
w7
m7n 7"&
<7


m36<
&"

dL

KU#

6 b
x8
M
?
za
H
(6
<
&"

d7L

736/L
F76B

77




W

 

Kz
8

mr  
i,
U4
0b6
%
yib"
I
<

%S776
U77Z
77(6

?778
F776B
d77L
77"&
<77$
/77
= 77
E 77I8


KdL
4/
4 3"&
%"6

7
78
%7#
d7L
7"&
< 
m3W
F6B
dL

<
&" U4
$ 

77"I<
77$
"77Z
77
77b _
77n?
77L
f/77 
77Z?
H 77?
_/77b

Esabb.comF
%7#
d7L
7"&
<$
m 
Esabb.net.msF
y3b
yib

 7"
<7#
=B7
d7L

?
7,6?
\/7&

KE11-4F

E10-4F
(
M



K ZS)
/cI
= 
I
vS

%#
dL

(77
M
y77n
f/77 
77Z
? 3 77?
_/77b
77
M
77
77,6?

%S776
F776B
d77L
7 
77h
@ 77O
M
 77b =
77
E13-4F
E12-4F

M
/7 
7L
m&?

KEsambaonlineaccess.comF
8
$?
dL
4/
4 3"&
%"6

%S6 77
/77W 3
77bO$
77O

EonlineaccessF
77
_/77b
77"I<
77

778
? 3 77?
_/77b
yi77b
77"I<
77
77I
d77L
4/77
7 4 3"&
%77"6


7
%7#
d7L 
7"
<7#
=B7
d7L
?
,6?
\/&
KEsambaonline.comF

K ZS)
/cI
= 
I
vS



78


 

W



) (10-4 ""

) (11-4 ""

79


 

W



) (12-4 ""

) (13-4 ""






W

 

80

: 6.4
(Malware Attack)

p77
77
H77
x778
M
Ei77,F
^77Z
- 774
d77
y377bO

q77
za
776
F77(
x778
0377
K
6 77b
r77(
77 (
377
y]77b


K^Z
Y

M
4=B
EmalwareF
3

p7
7
+x]I
- 
d
3L/
 b
3
q
fx8
yZO

7bO
7I4
7
37
U7r
K(
i7,^
)7Z
73L

 (
3
y]b


^7Z<
7
$
^7Z
76BO
7I4
7
_/7b
%&
)('dL 
^Z

fx78
7
7

7 S
%7]r
M/b
m ZS
U4

 %b^
F6/
B=

 7b
za
C 7=a

6/7Z
- 7& 3
fx78
7`a
<7Zr
i,
Y

M
q

_/7b
%&
)('dL
d
 
M
^Z
b^W
f=
iI


Jx


K%``@

m&?
U4
 b
d

 
Jx

77S
-/77`&
V77Z
077 /O
%778
H77
x77C
+=Y77
/77"\
77Sa

V77Z
77`6
m77
77
Jx77
i77,
77Y

M
EKeystroke

LoggerF
yO 77]

f=7

7`6
Jx
 b
za
C ={
`6
<h

yO `
S
U4
-/`I

Ki,
b^W
i&$
- & 3
p^
Yi

: 7.4
(Search Engine Phishing)

7BV 
d73
7&('a
d7L
. 7&a
%78

" 7#p
\/ ?
`6/

O


77
778
d77L
fx778
77
/77
K778
- 77VI
77 (
377
U774
ERetailF

81




W

 

K./
 (
3
U4
I
- VI
4
S 3

<6
 (
3
U4
vi3
- /
M
/Y]
dL
fx8
a
<6

S 3
HxX
Z
Zr I
= 
]
- VI
,6?
dL
fx8


P3O


K- VI
fx8

4

t7
v7i3
- 7 /
S?
6/
4

qI
4

^W
vi36
I4

d7L
7{
7r

%7&('$"
7#$
Y7n/
7BV 
d
dL
/Yr
Yr



KH"
qI
fI4

6

a

-vi3
V& -

Z
/

74
7
a
/7
m7&{r
7
qI
./
dL
fx8
^Z
+= 6
I4

M
H 7ZS
. 7&)
7a
7
6/
- & 3
%&('a

P3O
mI
0"6
./

m7O & 
m 7r{
d7L

x7
i7n
J'7
d7`r
% 7
6i

?dL



Kmb^W
i&
M
`S$
^ZO
L
t
6/Z



The

) : 8.4
(Popup Attack

x7rI
d7&


/c&

@+= I
0 

H
x8
6

x7
7 (
37
- i]7b
<7c
M
% ?
(
EPopup BlockerF
`3I

7
H7
x78

?$a
K
+g7 
7&
M
H
x8

-$
wL
`r


K- i]b
M
d&
fx8



3L

S
za
$ r

+x77r &
%778
E14-4F
(77
M
77

H77
x77C
776`
77`6/"

+x7r I
fx78
M

K
_/7b

d7L
yi7#
d7L
+7(
+x7r &
7?
73IO
+/b

^
7Z
<
7

6/7
- 7& 3
m7P3O
^
7Z

7
07"6
7
7
6
`3I




 

W



82


/=



`iI
?
J6

g

7

7

H 37

}^Z
`"I
33
%"6

P3I


K

_C@``

%
+xr I(
F
+
+xr I
. 7"4
a
78
7`3I

^7Z

?

774
_/77b=77W
i77,

4/77"
077 77S
M
77
77#_
&
m77

x
p4

K_/b

) (14-4

83




W

 

(Fake Address Bar) :

9.4

m7p
7
<6
%&('$"
#$
0 ?
/" ?

H
x8
 6}

(377
y]77b
+x7r &
77
U774
.B7X
M
77I
6/77

F76B
6/77W
37

7&('a
i]7#
/74
7
 7b
H7

x78
7(
K
Eweb

browserF
7 

Kii#
Y&?
U4
i]b
/B
3O
I
 ( 
]6B

Java F
?w/(
r
?

]
- I`O

{^H7777
x8
x]IO
<6

KEJava AppletF
?w?
r

?

EScript

7
+7
-74{

7 (
37
y]7b
M
I
6/W
. ] a
(

x77C
?
w/(77
77r
?
77=
r 77n{
77<
776
%77&
)('d77L
i]77#
773L

/7bI
76
?window.open?
EfunctionF
7]^
7

76
/7


K?no?
` 
?location?

76/
74
-
7
37
U74-


^7Z
76
I4
H
x8
3"6

y]7b
&
U4
dL_
/6
F6B
dL
za
-
%&('a
6/
 =
M
=

y]7b
M
%7``@
7I

6/7W
. 7] a
<h

+/W 3
/B
3L

^Z

7r
?
7
7]
- 7I`O
-
7&/
7 -
^7 

m
F6B
/
3

+=7#
d7n
(
US

?EJava AppletF
?w?
r
?

?EJava ScriptF
?w/(


KI
6/W


/B

EimageF

M
0
7 ~ =
}
+=7#
7P8
U74
F76B
7I4

6/7W
E15
J4F
(7
yn6

EInternet ExplorerF
1 ?==3Z a
w&'&a?
 (
3
y]b

i]b
U4?

F77
d77L
za
Ewww.nike.com/main.htmlF
77I
g776
77``S
77Y&
773
1 http://www.microsoft.com/ie






W

 

84

www.contentverification.com/graphic-F
77777777777777n/
i]77777777777777b
777777777777774

KEattacks/demo/adbarframeset.html

/7
y]7b
^7

7(
mZ]&
 Z

E16-4F
(
/6

774
F77(IO
v77S
9.23
<77L=
^77ZI
EOperaF
1 ?/77
??77 (
377

77I
/774
%778

/77
?y]77b
M
+77

77#
0377Z
77I
F776BO

M

7,6?
K
7n/
i]7b
73L
7
I
6/W
. ] a
S
M
dL
%``@

77I
6/77W
\
?/77&
F776B
77I
6/77W
77b
/774
m77Z]&
(77



KEgifF
$ 
EimageF
+=#
8
F6B

(1) opera.com.

( 15-4)

85




W

 

"( "16-4)

t7?
_/7b
1
7S 
8
F6B
I
6/W
H?
U4
/


777iI
777&('a
7776/
 777=
w777=?
777I4
%777(6/
ECitibankF
2 ?777I

777778
77777/ 
77777I4
77777
E17-4F
(77777
M
77777
_/77777b
77777b^W


?
7I
t7
d7
%&
)('E6/

`?
WI

support@citibank.com
(1) http://www.antiphishing.org/phishing_archive/Citibank_3-31-04.htm
(2) www.citibank.com






W

 

86

6
x8
0"6
K?I
t?
W_/b
.p4
<8
6
x8
3L

rYZ
P]

7I4

777`i
4
 
)  / 


/
U4
,
m3`Z}


_/7b
7L "
<7L=
mI
0"6

/B
/Yc6
/
d3O
I4
K%&
)('f6/
PIN Personal

F
%77b^
F776/
B77=
EATM/Debit

card numberF
%77

fx78
7`i
74
7
/7 
?
7/
O
w4
EIdentification Number

7
7$
7
7
?
7
m7&?

766<
YI6 7I
7b6

.p7
7

?8
K?I
t?
_/b
F6B
dL
+=#
/6
E18-4F
(
>>`i

N77(6$
%77&
)('776 
77=
M
77
/ 
77I4
a

` 77
77&/
77

7`

074p
7(
v7S
 Z 

S
M

/ 
b^W
+=/, 


Kmr
L
J?
dn
EFromF
/


K?I
t?
_/b
yib
dL
+=#
E19-4F
(
/6

07"
4/7W
U74
76

f/8 7
7
=U74
 Z

M
 /
-S

777YS$ Ehttps://web.da-us.citibank.com/signin/citifi/scripts/E-Mail_verify.jspF

d7L
za
g7O
7``@
M
7YI(
_/7b
<
%8?
citibank?
(
U4
/

7777

?7777
Ehttp://69.56.202.82/~citisecu/scripts/E-Mail_verify.htmF
F77776B

7Cp
7
76
EHypertext Markup Language HTMLF
07
%7bI
B7'

773L
77
+/77
fx778
p77

77L
77I
774
F77
I77
/77
/774


K 6 i,

M
6 b

87


 

W



) (17-4 " "






W

 

88

"( " 18-4)

?
< 77@
%77bI
6/77
?U77Z6
F776B
77I
6/77

1
/7
H77?

77(
M
. 77,
77]
EText

FieldF
%77b&
77`S
d77n
778
Ehovering text boxF

7
Yr 7
0b6
E19-4F
(
M

y]b
M
%``@
I
6/W

Kz
8



(1) http://www.fraudwatchinternational.com/phishing-fraud/phishing-web-site-methods/

89


 

W



%"6(

/ `}
+/c&
E20-4F/74
7I4
7

7b
i]7b

/776
v7S
7I4

i]77b@``
%7
+x77r &
76/
77I4
6/77W
za
7b
I

/Yc6@`


Kn
%bI

) (19-4



90


 

W



) (20-4

91


 

W



"! 456
(9 <  ./: ('& 
)(Phishing Countermeasures

)(Filteration

) (Security Patches )(Firewall

)(Cross-Site Script - XSS

)(Visual Keyboard

)(Two-Factor Authentication

)(Mutual Authentication

Anti-Phishing

(Toolbars

)(Anti-Phishing Softwares

x8
L I6
]
F
b)
/.
- ,
- VC
+ "#$
)('&

K%

87






W

 
1

92

: 1,5

%7&('$"
7#$
- 7V8
73L
7
YrY7
o
- cI{(

" 777#$
- 777VC
- 777cI
fx7778

7 7
` 777Z
Y&777W
777
-./777
a
7 7l

" 77#$
- 77V8
77
q77IO
77L
t77
/ 77Z
77`O
77Y4L
773L
%77&('$


K%&('$


W% 
-./
)
fx8
O

1.1.5

 7/
74
p7)<
C
UIZ
%&('a
6/
I
cI
.p4
6BO


 77/
fx778
w77&
a
77
/776/`
H 77Z@
x778
y77Z6
K77cI
77b^
77iI


K6=

" #
- V8
4
=x&a
,6?
%"6
$

?ii#

(Bounced E-Mails) 2.1.5

U774
77
77cI
77b^
77iI
%77&('$"
77#$ 
77=
J77
77L


3`7Z

7
7`i6

I4

KdL
M
+

g
 ]
&('a
6/
6 I4

= 7Wa
d7

7/

7
za
7Y
gr
m76
V7Z
g
Y&?

6 I
fx8





Km6
VZ
g
m&
3`Z
za
bO

 /
fx8


7b
+7O/ 
/{
r

cI
b^W
iI
w =?
 /
?


- 74
za
g7O
+7O/
766 
/
+/
K Yb^W
iI
cI

za


K6=

" #

1
<77L=
+77"
M
Ebouncing

emailF
77O/
776
E1-5F
(77
y77n6

77iI
77b
7 3L
77
7 

/

%77&
)('776
p77 
3`77Z
77
77`6
(1) A. Emigh, "Online Identity Theft: Phishing Technology, Chokepoints and
Countermeasures", Radix Labs, October 3, 2005.

93


 

W



^
7b

v7S
?xyz.com?
7cI
d7n 7b

<7 7"I

M
7cI
K
 77/


`6



`i 
3`Z<
^Z
?
V7Z
g7
m&?

?ahmed

za
J?
77

M
m776 77cI77`r


M
77" 77
={
2
<77L=
+77

za
 77/  /
I




M@`


EFromF

K /

) (1-5 )(Bouncing Email

3.1.5
/
77
773L
-$ 77bO$
773= 77Z]$
-77=/
za
+
77
B77






W

 

94

d7L
74
 7
7r=
7
- =7Z]$
7
+7o
7&
37r

K.p

K" #
- V8


%SO
L
%&)('

4.1.5

-$ 77
77
d77L
g77
77
-  77Z@
U774
- 77
F77
773L/


?-p6777i
?
%777b^
F7776/

B7 7=
g777O


?-  777Z@
za
 777


K  =_
b 
S
M
- iZ

5.1.5


r ,Z
/
-=
 =#
- ]
 &
^S?
 b
6

M
7
=7#
- 7]
^7
7

$7

7]6B<
YL
M
rYZ
cI
3L



K]6B<
YO i]b
],Z

M

?<Y

F77,Z
7 (
377
7
773L
7
-$ 77@
fx78
77
_ 7 

7(

8= 7W
cI
B=
=#
- ]
%  
F,Z
cI
%&
)('dL

7`I
7 O/
07
d7
7`
EreferrerF
?
/7W
?7`S
7
7`i
76/
4


+=7b
F7
7i
EHTTP Hypertext Transfer ProtocolF
07
%7bI

77`S
77
a

K
+=77b
/77
t77
77&
)('i]77b
77I4
(77
Jx77

07
r/76
7{
7r
7Yk
I4
za

?cI
I4
g
za
g6
?/W?

+=77#
-/77
p7S
7  6}
77

77
/776
77L

?+=77b
F77
77i
HTTP


K"
+=b

$
m3I
6/6x

7 O
1
- 7`
07
7`h
0Zir

K 
S
za
 r
./
)
x8


7
+7 ]
d7n
EreferrerF
?/W`
?S
{r
EHTTPF
0
%bI`
I


KEhttp://tools.ietf.org/html/rfc2616F
`h^
)('&

ZI
E1F

95




W

 

7`@
7
7L
g7O
7
7({

?p7(

UI

KJ=  `
S
m&?

J?
7Yr
d7n
O
7L
``@
i]b
za
gO


?$3r

K6 i( &
a
%  


KEblankF
= r
E'O

?L

7
7L
7
7`i

+] $
dI$
?/W`
?S
M
6 i( &
a

377r

K
%7 &('$"
77#$
- 77VC
J77b
77,
./77
a
77
77
77`@

077&X
M
p8 77


%7 &('$"
77#$
774
M
773
77(6
77L
6 77b

7
M
6k
?/W`
?S

`i(
r
 S$
x8

w]6
pr
I]
K-$ @
fx8

?
/7W`
?S
L

`i\

b`
+] p
\/ ?
- S'L
E I8

7

7,6?
`i 7

%7&
('$"
7#$
- VC
Jb
,
./
a
m]#

 7,

+=7b
F
za
r n) 


3L


F
0

L
m&?

7(6
7
F7
7
7Lh
i]7#
7
7L
+=7b
F7
7
07
?

K
78B=

7cI =
7W
=7#
- 7]
7i
7Lh
- i]7b`
\
r


7({
{7r
6 7b
73L
7
?/W`
?S
M
6 i

a
US
`6/"
fxY


7L
a

M n)`
i
6/
4
+=b
F
0
=b

 


VI
w&
a
$

?mZ]&
+=b
F
0
=b


F

0

07 "
7
/76
7&/

7

?+=b
F

0
r/6
{
r
?$?


K b

r
M
L

/6xi
Y3IO
+=b
+=b
F

76o=
7b^
7
73L/?
J?
7,

./7
)
x78
y7n
1 

77S?
77L
77I4
2 ?N77O?
_/77b
77S 
778
? 778B=

?77cI =

77W
(1) F-Secure (http://www.f-secure.com/weblog/archives/archive-042006.html)
(2) http://www.chase.com/






W

 

96

77#_
/77b =
77W
+=77#
^77
774?
F776B
d77L
. 77&{
6 77b

KE2-5F(
M

_/b

3L

r ,Z

?N77O?
_/77b
%77``@
d77L
+=77#
/776
E5-5F
(77
/76


K?NO?
_/b
= 
+=#
/6
E3-5F
(

?
78B=

?cI =
W
6o=
b
^
3L/?
,
./
)
3"O

77
`i 77r

K77O
%77&('$"
77#$
77V8
77
_/77b
77
%77i
77

" 77#$
774
F77(
77
_/77b =
77W
+=77#
F77
77
077
= 77b

(7
M
7
/6x7i
7Y3IO
+=7b
/ 
C ra

_/b
(
%&('$

M
d7`6

?73L
i7,
/7B

m73I

cI =
W
F
/

$
E4-5F


K%&('$"
#$
r



7
x78
M
E4-5F
(7
M
-
=t7
76/6xi
m73I 
7=
\

<7L=
d7n

?KKK
77
7bO
J/7Z
7L=
07(O
pr 7/
fx8
w6?=
a?

8


K bOp

97


 

W



) (2-5 ""

) (3-5 ""

) (4-5




 

W



98

) (5-5 ""

2.5 : )(Filteration
}
 77=
]77bO
7  O
776)('&
%77
M
YS/77W
377
t77]
77b
%& 77
/7
a
Y]7b 77,
.


g77
 7/ 77,

7Y&
M
77 r

7,6?


ESpamF
7/



- 7VC "77#$
'($&
%77
 77=
U774
+7
76)('&
M
%7777




KEdeception-based phishing emilsF

99

(Security




W

 

) : 3.5

Patches

(Firewalls)

- 77I`
U774
77
77I
778
%77&('$"
77#$
- 77V8
77&?
77S?

7Y

M
7I
-/7
p7

m7p
7

<76
Etechnical

subterfugeF
7I]

KEmalwareF
3
q
0 /O
ESpywareF
NZV
q/
=B
i,

Eoperating systemsF
7
7c&
7I
- 67i
/7

07 /O
 6}

=7

F7
+B7Y

76
EInternet BrowsersF
7 (
37
- i]b

p7
U74
+7

%7&('$"
7#$
- 7VC
$
7 r
7,
./
a
6 X


KI
-/

 (
37777
- 777i]b
M
I
-/
p
U4
1 


EMozilla

FirefoxF
?N7777 r/6 r
p677?
y77]b
M
77I
+/77"
77#
774

Unified Resource Locator - F
7I
F76BO
074p
wS O?
t
1.0
^ZI

^7Z
7
7S
M
73IO
t7
Edownload windowF
7i
+x7r &
M
EURL

K 
dL

F

77i
+x77r &
77
y]77b<
77bO
M
77"
0377Z
wh77S
+/77
fx778


K
/7"^

^7Z
/
7O
}
7L
+/7
fx8
K.%
(
6"
6 I
/O

76/
74
%78
+/7
fx78
p7
7V&
i7n
^7Z
7L
`6/
H/L?

<7h
7

F76B
d7L
za
g76
Jx7
7&('a
6/
 =
M

=U4
,

Y&?
U4
i,^
Z
/YcO
xY
F6B
dL


3
q/

(1) Firefox flaw raises phishing fears, by Ingrid Marson, Published: January 7, 2005
11:06 AM PST , (http://www.news.com/Firefox-flaw-raises-phishing-fears/21001002_3-5517149.html)






W

 

100


Kyi#
dL



Z
p
- 6i?
N r/6 r
p6
?-=#?
+/
fx8
_  

7L
/7"
J 7]
m76
y]7b
%^7Z
d7
U74
07

+/
fx8


K+/
fx8
p$
in



Cross-Site Script

) : 4.5
(- XSS

7
Emalicious content injectionF
v73\
o`
S
H?
M
&/ 

v73
\7
7`S

?r n{
`6
6 b
?
%&('$"
#$
0 ?

\7o
x78
7`6

?7(

KElegitimate siteF
yi#
dL
za Emalicious contentF


W%  






v3


K\/ ?
dL
za
yib
dL
/
m
O
+ 4a
J


KdL
/
Y

M
EmalwareF
3
q/
0 /O
J


K%&('$"
#$

za
dL
M
 
- & 3
m
O
+ 4a
J

M
7I?
+/7h
p7
76/
74
\7o
7`
H7(
`



fx78
M
73
7k/
7 ?

7`S
EhackersF
/
7^
y6

 (
3


%77k/
77
%778
Ecross-site

script - XSSF
777
+/77
fx778
_/77O
K77

37
U74

K%
=
7
=7b
73L
7
_ ,
\

qI6
Eprogramming flawF

Euser reviewF
7
q7I
=B7`<
O

?EblogsF
- &
M
=B
- `O


- 77 /
M
v77
- 77

?Ediscussion

boardsF
77`I
- 77`S
M
 77=
?

7777 (
3777777

U774
77
%77&
)('776
M
+ 
=77777777=

?v77i3

101




W

 

KEweb-based emailF

H77
%77&('$"
77#$
i77n
77L
/77"
J 77]
U77
77`6/"

77
M
77Yc]S
773L
778 a

77 
fx778
]77bO
778
v773\
77o
77`S


K=B
- i]b
U4
Yn/4
4
 n
%  

(Visual Keyboard) : 5.5

<76

76`
7`6/"
74
6/7Z
- 7& 3
7 
)76
`6/
fx8
O

= 77
77& 
)('77
i]77#
M
77/
yO 77]
77S
776/
774
77C a

yO 7]
7S
7
H7"
7]
U74
/`I
+=]
6/
"
YI
^Z


KW 
U4
/

776/
774
6/77Z
- 77& 3
L/77Z
77,
./77
a
77/
yO 77]
77S
773"O

7Y

7
Ekey loggingF
yO ]
S
-/`&
VZO
t
EmalwareF
3
q

p^7

Y7i
7`6
Jx7
 7b
za
C 7={
7`O
<7h

i,


Ki,
b^W
i&$
- & 3

^77Z =_
77b
77S
77/
yO 77]
77S
E6-5F
(77
/776


Km ZS
za

 6/Z

- & 
)

/67"O


U7S

6 7b

7Z6
<r

S
za
  r
/
yO ]
S

^7
7L
7
M
7/
yO 7]
S

43"
- & 3`
$
3
q/



K&
)('dL
M
/
yO ]
S

- 77& 3
U774
_/77
773
q/77
/677"O
77
7`S$
77/ ^(
776
77L


K/
yO ]
S
"(





 

W



102

) (6-5

6.5 : )

Two-Factor

(Authentication
?

77

7,6?

_/76
67b`
x78
M

KEStrong AuthenticationF
?
J7
)
/7
.

<6^
/

`6/
 ,
6b
=

?

U4

K6b
/
-ph
E I8


W6b

103




W

 

K=/

^Z
<
W?what you know??
_/O

 J

Esmart cardF
 x
L "3
W?what you have??


J

d37#)
7b3

76@
- ]7b
%78
W?what you are??
w7&?

7
J


KEfingerprintF

7Yr
<76

I
%8
6b
4
M
^Z
6``
6/"

7bO$
4
M
r/"
(

r/
L
- & 3
6b
0
6BO


K=/

^Z <


76B
fp74?
+= x7
7&

4&
<
^6
% I
6b
M


K x
L "3
?
^
d3#
b
=/

^Z<


^77ZO
t77
EATM

cardF
_/77b
77L "
% 77I
677b
U774
77

7
7`6
J7`I
0i7Z
74
M

K
%7_
/b
+BY
?

J`I
0iZ

7

{ ,6?
`6
?
?
%& 
I

O
t
L "3{



K?_/O


? I

6
Jx=
/

77
77
6/77Z
- 77& 3

/7ZO
%77&('$"
77#$
- 774
M
+ 74

\/7 ?
- 7& 
07
<76
x
?_/O


? I

FIbO
t
=/

67b
7&?
7
6/7
4I
za
%IO
- & 3
6b
4
M
r na


K?w&?
?

???


74

%7&('$"
7#$
- VC
,
./
a
^Z6

% I
6b

" 7777#$
EMan-in-the-middle

AttackF
7777
M

7 77
/
7777V8
77776/

KEIdentity AttackF
b^
i&
dL
F6BO
6/
4
%&('$






W

 

104

(Mutual Authentication) : 7.5

x78
M

KETwo-way AuthenticationF
?f $
% I
6b
?7
,6?
_/6

677b
77
77`r
/77

Y77,
77
77
77
7
7 b6}
./77
)

N6 7`
6b

 
fg

?%b^
F6/
B=
6/
4


m7&?
7

7`i6
7
73L
7

6bO
<6
,6?
EBiometricsF
6@


K ]6B
L
(6


b^
iI
N
b`

b

7
7`i

7L/

7bO
74
M
r/7"
7
7(
73
6b
y6


K3
Y,
68
i#

(7
y7n6

f 7$

J 7S
67b
74
E7-5F
(
yn6


K 3
6b
4
E8
J5F

7`6
7S

m7&?

%78

3L


6b
^Z
/"\
Sa

^7ZO
EphraseF
7

?+=7#
= 7
7{
7r
7
\
VZ 


7`6
7


bO
. &a
Ir

K
3L


6b
`S$

+=
7b
w7&
{r
VZ
4
M
`3Z
+o
X
+=b
/



K
6bO
<6
ii#
X

74

%7&('$"
7#$
- 7VC

7,
./
a
^Z6
3
6b

" 7777#$
EMan-in-the-Middle

AttackF
7777
M
7777
/
7777V8
77776/

KEIdentity AttackF
b^
i&
dL
F6BO
6/
4
%&('$

105


 

W



) (7-5

) (8-5

8.5 :
)(Anti-Phishing Toolbars

6/77W?
+774
J77
6/77W
778
-==

7777I
F 77
77(6

4
M
+
YX/76

KEApplicationF
7
73"O
7
76

6/7W
E9-5F
(7
?
y]77b
U774
?77

?
-
(377777777 F
?==377777Z a
w77&'&a?
77


KEExplorer

Internet






W

 

106

- /77
77
776
77L

%7 &('$"
77#$
- 77V8
/77"
U774
=

-
?/777W?
777& 
?wr777/(6 ?
7777
- 777k
%777VI?
eBay?
 /777

U7774
EAdd-onF
- r 777na
0777 /O

%7 7&('$"
777#$
777ir (
M
777bb^


KEE-Mail ClientF
%&
)('6
4
q/
 (
3
- i]b

" 7#

d7L
mO= 6
I4
^Z
m3IO
8
4
(
/W
fx8
]

U74
_/7

%7&('$"
7#$
ir (
-
?/W?
p

6
K83

m7O= 6
/7
d7L
74
p$
6/
4
%&('$"
#$
?
= 
dL

7Yr
V

7ZO}
EdatabasesF
- 7& 
74L
7
=7
6
4

?^Z
3L


Y67
<76
t
83
(]
?
.
%&('$"
#$
= 
dL

76/
74

?
%7&('$"
7#$
d7L _
7
M
7bb^
- Y

3L


M
7`

7L/
^7ZO
-
7
K6/
^Z

+
=- p3

7736/V

/77"
773"

%7 &('$"
77#$
d77L 
77=
U774
_/77

" 7#$
- 74
_ 7 $
EpatternsF
/8
7c
U74
_/
Eheuristic methodsF


K%&('$

" 77#$
77ir (
-
?/77W?
F77^
77 L

E1-5F
77X
/776


K (
3
U4
Y"
=za
r n) 
%&('$
Phishing

F
q 7&/

%7&('$"
7#$
ir (
-
?/W?
U4
$ 

x778
77`i6
K
 77Z^
77ZI==?
377Z a
w77&'&a?
y]77b

d77
q77
1 EFilter

8377
i]77b
w77&
a
77YO= 6^
77Z
077"6
i]77#
77
77
q 77&

/6x77i
/]77# 
77
=
-77I
6/77W
077& Q-
y]77b
U774?
M
/Yc77Zr
(1) Microsoft Phishing Filter: A New Approach to Building Trust in E-Commerce
Content, anti-phishing white paper, Microsoft.com,2005

107




W

 

- 7& 
J?
. 7ra
7
y7bIO

7Y3IO
 =
/
=B
U4
, 
^Z

KE10-5F
(
M

i]b
fxC
b^W

?6/

73L
7
m7O= 6
H7"
dL

?
EPhishing

FilterF
q &/
 O
S
M

7I

6/7W
07& Q

y]b
U4?
M
/Yc
J
" #
dL
8
^Z

" 7#$
i]7#
/74
dI7
m&?
r n) 
^Z
/6xi
/=
 



i]7b
p7a
7a
=7
Yr
6/6x
i]#
YI
$
/6
%&('$

7
^
7Z 

7Z
U4
%&('$"
#$
i]#
/4
M
=/$?



KE11-5F
(
M
-5F
(77
M
/77
1 ?SpoofGuard?
-
6/77W

778
/77
77

L
dL{

r
^Z
3L

mO= 6
/
dL

+
fx8
`iO
KE12

+
d"7ZO

a
./7
7&`6?
+
/7Zr
" 7#
dL
m&?
U4
_/ 4}

./]7#
7&`6?
+
/7Zr
$
"
?7#
d7L

d7L

a

U4
_/


K./,
&`6?
+
/Zr

m&?
U4
dL`

i

a

"( " 9-5)

(Internet Explorer)

1 crypto.stanford.edu/SpoofGuardL






W

 

108

. .(1-5)

microsoft.com/ie

Internet Explorer 7 Phishing Filter

pages.ebay.com/ebay_toolbar
www.callingid.com
cloudmark.com
earthlink.net
toolbar.trustwatch.com
crypto.stanford.edu/SpoofGuard

eBay
CallingID
CLOUDMARK
EarthLink
TrustWatch
SpoofGuard

( 10-5)
""

109


 

W



) (11-5 "
"

) (12-5 ""SpoofGuard






W

 
Anti-

110

) : 9.5
(Phishing Software

- 77V8
77n
776 @
Esecurity

softwareF
776 @
q/77
<77c
77,O

p77
U774
77
?

 77/
U774
77
77Y4I

%7 &('$"
77#$

KI
-/

" 777#$ 
777=
d777L
U7774
_/777
7 74

q777
fx7778
d"777ZO


%7&('$"
7#$
ir (
-
?/W?
M
3
YZ]&
`6/" 

%&('$

(377
- i]77b
U774
- r 77na
-
?/77W?
077 '
77`O
776 @
q77r


K%&
)('6
4
q/
 

" 77#$
- 77VC
J77b
za
r 77n) 3r

K77 (
$77S
776 @
y77O

-/77`&
-pV77 Z
EmalewareF
773
q77
yr 77(O
7 ,6?
77Y&{r
%77&('$


Kb^
6/Z
- & 3
L/
za
JO
L
t
Ekey loggerF
yO ]
S


K YI
+
/
+ ]`
i
% ?
/W
/Z
6 @
q/
v6

77n
776 @
U774
77
776 @
q77
77 L
/776
E2-5F
77X


K (
3
U4
Y"
=za
r n) 
%&('$"
#$
- V8



( 2-5)
 (
3=

kaspersky.com
symantec.com
mcafee.com
trendmicro.com
bitdefender.com
grisoft.com
pandasecurity.com

6 @
q &/

Kaspersky Internet Security
Norton Internet Security
McAfee Internet Security Suite
Trend Micro Internet Security
BitDefender Internet Security
AVG Internet Security
Panda Internet Security

111




W

 

)( 
Access

bO

Active Attack

I
VC

Address Obfuscation

I
6O

ATM
Anti-Phishing Toolbars

%_
/b
+BY
?

" 77777777#$
77777777ir (
-
?/77777777W?


%&('$

Anti-Phishing Softwares
Application

%&('$"
#$
ir (
q/

3"O

Attachments

- `r/

Attacker

<
Y

Authentication

6b

Backdoors

]
H?

Bandwidth

bO$
+ IL


Bank

_/b

Biometrics

6@
N6 `

Black List

.Z` 

Blog
Bounced E-Mail
Browser

&


+O/
%&
)('6= 

y]b






W

 
Chat Rooms
Commercial Whitelists
Computer
Configuration

112


h o_
/


6= V
. ,3`<

H S
3n
L
4
L
PYO

Content

\

Cracker

H/

Database
Data Integrity
Dialog Box

- & 
+4 L
- & 3
E (O
?F
p
J=S
I#

Dictionary Attack


` V8

Discussion Boards

` I
- `S

DNS Poisoning
Domain Name
Download
E-mail

- L "I
. ?
<
ZO

" I<


%&
)('6

E-mail account

%&
)('6
H ZS

E-mail address

%&
)('6
I4

E-mail client

%&
)('6
4
q &/

E-mail Filtering

%&
)('6]
bO

E-Mail Header

 /
=?
Z6/O

E-Mail Route

%&
)('6 =
= 
Z

113

E-mail Server
Fax




W

 

%&
)('6



EN ]F
 &

Filtering

]bO

Firewalls

6 @
=

Form



Forums

- 6I

Hackers

E/ CF
 (
3
L'

Heuristics Methods
Hosts File
HTML
HTTP
Inquiry
Install
Instant Messenging
Internet
Integrity Check

36/V
/"


],

F


0
%bI
B'



0
%bI`
I 
O/
p
w3O
L
0bIO
L
0 /O
/W 3
'
L
%&'



 (
3


 (`

i

IP Address

w&'&$ 
O/
I4

IPS

- L '$
dI
c&?

Junk mail
Keystroke Logger
Locally

H/
g
6
yO ]
S
-/`&
VZ


%






W

 
Look and Feel
Malicious content
Malware
Man-In-The-Middle
Message body
Mutual Authentication

114


ZS)
/cI
v3
\
3
q



M

/
V8
 /&



3
6b

OCR

n
_@
U4
_/

Online

/W 3
bO
L
%&
bO

Online trust
Open Mail Rely
Operating System
Passive Attack
Password

Pharming

Phishing

%&
h


]
%&
)('6




c&


Z
VC
L
Sp
VC


=/ 



- 7L "I
. 7?

-pV
M
04p


3
4=B
L

%&('$"
#$

POP3

6
0(
 O/

Popup

`3I
- i]b

Programming Flow
Regular Expressions
Scam

%k/



r
-g3

4

115

Search Engines
Security Updates
Server
Smart Card
SMTP
SMS
Social Engineering
Spywares
Strong Authentication
Subject
Text Field
Tools
Traffic
Two-Factor Authentication
Upgrade
User name
Version number
Virus
Visual Keyboard




W

 

vi3
- /
I
- 6i

 x
L "3


Z3
6 
&`
O/


+gbL
b&
 =


4 
$
IC
NZV
q/


J`
6b
 /
n


%b&
`S
+4 Z
-


r


% I
6b
L'
-=#a

^Z<

^ZI<
L=
gr


/
yO ]
S

Vulnerability

+/h

Web browser

 (
3
y]b






W

 
Webmail
White List
Window
Worm
www

116

 (
3
U4
3
%&
)('6

. ,3` 



+xr &
+
 (
3

117




W

 

+ *



Jonathan B. Postel, "SIMPLE MAIL TRANSFER PROTOCOL", RFC 821,
(http://tools.ietf.org/html/rfc821), August 1982.
Network Working Group, "Requirements for Internet Hosts -- Application and
Support", RFC 1123, (http://tools.ietf.org/html/rfc1123), May 1996.
Network Working Group, "Post Office Protocol - Version 3", RFC 1939,
(http://tools.ietf.org/html/rfc1939), May 1996.
Network Working Group, "MAIL ROUTING AND THE DOMAIN
SYSTEM", RFC 974, (http://tools.ietf.org/html/rfc974) , January 1986.
Network Working Group, "Common DNS Operational and Configuration
Errors", RFC 1912, (http://tools.ietf.org/html/rfc1912) , February 1996.

7P8
?
67Z
7/
(
M
 iL$ 
/
8/
dn`<
O?

2008
J77777777777781429
- 77777777777
77777777777I`O
-$ 77777777777bO$

Ehttp://www.spam.gov.sa/Statistics-Arabic.docF
The State of Spam, A Monthly Report February 2007, Generated by
Symantec Messaging and Web Security
(http://www.symantec.com/avcenter/reference/Symantec_Spam_Report__February_2007.pdf).

2006
Spam Trends Report: Year of the Zombies, December 27, 2006,
Commtouch Software Ltd.,
(http://www.commtouch.com/documents/Commtouch_2006_Spam_Trends_Ye
ar_of_the_Zombies.pdf).
CALIFORNIA BUSINESS AND PROFESSIONS CODE, DIVISION 7,
PART 3, CHAPTER 1, ARTICLE 1.8.Restrictions On Unsolicited
Commercial E-mail AdvertisersK

?Virus

description service" from "F-Secure", (http://www.f-secure.com/v-

descs/novarg.shtm).

WI
2004\Z6\31
6= 
`6/r?
HIX
24
= 3 
+6/

SA cops, Interpol probe murder ?

(http://www.news24.com/News24/South_Africa/News/0,,2-7-

E1442_1641875,00.html

Thomas A. Knox,Technologies to Combat Spam, GIAC Security Essentials






W

 

118

Certification (GSEC) Practical Assignment, Version 1.4b, Option 1 , SANS

Institute, June 16, 2003K
Gmail uses Google's innovative technology to keep spam out of your inbox,
gmail.com, (http://www.google.com/mail/help/fightspam/spamexplained.html),
December, 2007K

? Nick Johnston, PDF Spam: Spam Evolves, PDF becomes the Latest Threat",
Anti-Spam Development at MessageLabs, A MessageLabs Whitepaper,
August 2007K

Anti-Spam Research Group (ASRG) of the Internet Research Task Force

(IRTF), (http://asrg.sp.amL).

Mark Ciampa, Security + Guide to Network Security Fundamentals, 2nd

edition, THOMSON, 2005.
M. Jakobsson, S. Myers, Phishing and Countermeasures: Understanding the
Increasing Problem of Electronic Identity Theft, WILEY, 2007.
R. Lininger, R. Vines, Phishing: Cutting the Identity Theft Line, WILEY,
2005.
L. James, Phishing Exposed, SYNGRESS, 2005.
A. Emigh, "Online Identity Theft: Phishing Technology, Chokepoints and
Countermeasures", Radix Labs, October 3, 2005.

EI3
S
.p
Y

%&('$"
#$
= 
h]

@ L?

77V@
J
77
14
w377Z
677Z
776/
+776/

77
77
?677Z
13718


J
2006
/6 I6
14

J
781426
Christopher Abad, The economy of phishing: A survey of the operations of
the phishing market, First Monday, volume 10, number 9, September 2005,
(http://firstmonday.org/issues/issue10_9/abad/index.html). M. Jakobsson, S.
Myers, Phishing and Countermeasures: Understanding the Increasing Problem
of Electronic Identity Theft, Wiley, 2007.
The Anti-Phishing Working Group, www.apwg.com.
Phishing Activity Trends, Report for the Month of November, 2007, AntiPhishing Working Group (APWG), apwg.org
Gartner, Media Relations, 2008 Press Releases, Gartner Survey Shows
Phishing Attacks Escalated in 2007; More than $3 Billion Lost to These
Attacks, (http://www.gartner.com/it/page.jsp?id=565125), 05-March-2008.
Joris Evers, Staff Writer, PayPal fixes phishing hole, CNET News.com,

119




W

 

(http://www.news.com/PayPal-fixes-phishing-hole/2100-7349_36084974.html) , Published: June 16, 2006 4:12 PM PDT.

Sebastian Bauer, Knorr.de SQL Injection and XSS Vulnerabilities,
(http://blog.gjl-network.net/blog/index.php?/archives/78-Knorr.de-SQLInjection-and-XSS-Vulnerabilities.html) , 01/12/07.
http://www.antiphishing.org/phishing_archive/Citibank_3-31-04.htm
Ingrid
Marson,
Firefox
flaw
raises
phishing
fears,
(http://www.news.com/Firefox-flaw-raises-phishing-fears/2100-1002_35517149.html), Published: January 7, 2005 11:06 AM PST
Network Working Group, "Hypertext Transfer Protocol -- HTTP/1.1", RFC
2616, June 1999, (http://tools.ietf.org/html/rfc2616)
Microsoft Phishing Filter: A New Approach to Building Trust in E-Commerce
Content, anti-phishing white paper, Microsoft.com,2005