Introduction

When hacking turns to the dark side, motivations change from information wants to be free to how much is this worth to you? Criminals are not concerned with creating an elegant hack; they are concerned only with how much revenue the hack can generate. Where the hacker wants to leave his mark, criminals, corporate espionage agents, and government espionage agents prefer to remain undetected and leave no evidence at all. If they do leave evidence, they would prefer that it points to someone who can t be linked to them. Phishing attacks and botnets provide just such a mechanism for mounting directed attacks against an identifiable population.

Think of phishing as multimedia spyware. The term phishing describes only the front end of the attack, however. A phishing attack is launched by an e-mail or a Web site designed to masquerade as something it isn t (just like bait). If the user takes the bait, the masquerading Web site delivers the pay-load, which could be a traditional spyware attack (keystroke logging, Trojan horse, or remote access backdoor), an identity theft attack, a zombie client for a botnet, or anything the bad guy wants. Phishing attacks have the benefit of filtering those that take the bait from those that don t, making the former good candidates for the desired exploitation..

If phishing is multimedia spyware, a botnet is considered highly distributed spyware and a zombie client is a highly adaptive form of spyware, which is the latest in the evolutionary chain from the...