> http://www.honeynet.org/papers/phishing/

I wonder about the number of *fake* honeypots out there...

If a naive friend of Ivan had a vulnerable machine tweaked to report back hijacking for the purpose of phishing, Ivan could phish the phisher's phishing, or, in other words, harvest the same data the phisher harvested through his innocent friend's machine. It would be easy for Ivan to protect his friend from prosecution by proving his machine was compromised, and highly improbable that the 'authorities' would detect 1) Ivan was deliberately monitoring the vulnerable machine 2) had harvested the harvested identity data.

Too Cunning :-)

I suspect you would have to be a bit lucky and get access to the right machine; as phishing is generally a multi-phase operation, and different phases go over different machines and different channels. You wouldn't want to monitor the mail-out machines, you'd have to get the web-server machines.

It might also be a cover for an inside job I suppose, so as to rake out the data as an insider, and if ever there was an investigation one could simply point at the naive machine that had been compromised.

Speaking of insiders raking out data. How does one identify the source of the leak of a secret known by more than two people? I am almost convinced that it is theoretically impossible and hence we have a huge tragedy-of-commons situation with every secret shared by three or more parties: if the per-individual slice of the shared cost of compromise is significantly lower than the private benefit of selling the secret, it will be sold. Hence, I tend to be suspicious of any system where more than two people have access to any particular secret.

I do not think phishing per se is illegal under anything more than tort or trademark law. If your friend uses the information for financial fraud then, duh, its illegal. If your friend does not us the information for fraud then it is not illegal but it is also without value. In one case your friend is phishing. In the other case your friend is taking a risk with no benefit.

Security can be evaluated based on the risk in a large system. "I know the data" is not itself fraud or every merchant who sells on the net (START YOUR ACCOUNT, not PAY FOR YOUR PURCHASE) would be busted.

-Jean

In spy novels, the mole is caught by feeding in lots of tracer secrets to different people and seeing which tracers pop up on the other side.