Yes, the story of the bank in China that was being used to host a phishing site to spoof messages and collect personal information from customers of a different bank, as well as eBay customers, made it all over the news today.
Such an ironic situation; exploiting the security weaknesses of one bank’s network infrastructure to host a site to exploit the vulnerabilities of another bank’s (and eBay’s) customers. What is discouraging with regard to security diligence is that the exploit was reported by a customer receiving one of the phishing messages, and not (at least as reported) noticed by the bank itself being used as the host. In fact, some reports implied the bank may still not be aware of the exploit, but that is hard to believe…or is it?
Just imagine how many organizations possibly are currently being exploited…and possibly have been for years…because they do no activity logging, vulnerability checks, or audits of their systems on a regular basis. There have already been many reported instances of the computer systems of several organizations being used as repositories for warez, illegal music and CDs, and porn stockpiles. Folks, part of an effective regulatory compliance program is establishing safeguards to prevent such situations from happening.
Technorati Tags
privacy
regulatory compliance
phishing
information security
personal information