Anti-Phishing Solution Protects Against Pharming

Sestus Data Corporation announced today its anti-phishing solution will also protect consumers against Pharming attacks.

(PRWEB) August 6, 2005 -- Sestus Data Corporation announced today its anti-phishing solution will also protect consumers against Pharming attacks.

Pharming is the exploitation of vulnerabilities in DNS servers, machines responsible for resolving internet names into their real addresses. Phishers exploit these vulnerabilities to redirect their victims browser away from the desired website to their own malicious web site. In January 2005, the domain name for New York-based Internet Service Provider, Panix, was redirected to a site in Australia. In 2004 a German teenager redirected the eBay.de domain name. Secure e-mail provider Hushmail also fell victim to pharming on 24th of April 2005 when an attacker rang up the domain registrar and gained enough information to redirect users to a defaced webpage.

Perhaps the most troubling type of Pharming is the redirection of individual web browsers via software secretly installed on a users computers by the attacker. In this type of attack, the attacker does not need to rely on the victim clicking a link in an email to direct them to their malicious website. The attacker infects the victim's computer with auto-redirection software, often through a virus or simply by the victim visiting a malicious website. Even if the victim correctly enters a valid web address into their browser's address box, the software silently redirects the browser to the attacker's malicious website copy, where the attacker proceeds to capture login IDs, passwords, and other confidential information. Combined with URL masking techniques (hiding the true web address from the browser address box), this type of identity theft is among the most insidious to defeat.

Sestus Data Corporations anti-phishing solution, called PhishCops" by the company, is capable of defeating phishing and pharming in all their forms using a patent-pending implementation of authentication algorithms developed by the National Institute of Standards and Technology (NIST) and approved by the U.S. Department of Commerce. Unlike other anti-phishing / anti-pharming approaches recently touted in the news, PhishCops does not simply enhance an existing login webpage with an additional layer of images, challenge questions, or voice recordings, nor does it require software or hardware to be installed by the business owner, the ISP, or the individual user. Implementation involves little more than simple copy and paste" actions by webmasters. PhishCops authenticates Webpages in real time, using true authentication techniques, before users have entered any confidential or personal information. PhishCops does not filter or block access to any internet websites based on obscure filtering rules, nor does it rely on a 'black-list database of known phishing websites or on an analysis of domain IP records which themselves may be fraudulent. It uses true authentication algorithms. It does not read nor write any information to a consumers computer and is an entirely anonymous solution, protecting a users privacy absolutely. In fact, Sestus Data records no personal or identifying information during the PhishCops User ID sign-up process, not even an email address or users name.

Simply put, PhishCops is capable of authenticating Webpages in such a way that cannot be replicated by phishers. Once a website has been equipped with PhishCops, phishers must abandon their attempts to lure or misdirect victims to malicious copies of the targeted webpage, whether through pharming or other means, simply because they will be unable to replicate the PhishCops authentication process on their fraudulent webpage. The absence of the PhishCops authentication process on a fraudulent webpage, when the authentic webpage is known to be equipped with this protection, will also alert the victim to the fraudulent nature of the website despite what their browsers address box may be reporting. As a result, it will no longer matter how victims arrive at phishing webpages, whether through pharming techniques or more traditional means, if the webpage fails to authenticate, it will be identified as fraudulent.

PhishCops includes options for defeating a type of phishing that, until now, has been virtually impossible to prevent, the "man in the middle" phishing attack. PhishCops User IDs, once created, will also be valid at all participating websites, meaning PhishCops Users will not need to establish a separate user account at each website they wish to authenticate. PhishCops was recently selected as a semi-finalist for the 2005 Homeland Security Awards in Washington D.C.

PhishCops is scheduled for launch later this year and the company is already negotiating with numerous banks and other financial institutions, many of whom have had technical teams evaluating the process for several months. The service will be free for users and fee-based for businesses.

Media Contact Info:

Media Relations, Sestus Data

info@sestusdata.com

Fax: (866) 621-1885

http://www.sestusdata.com

###