* Score one for the phishers
Last week we discussed “ping” and “tracert” and how the usefulness of these commands has been diminished because they could be exploited for illegitimate purposes. We ended by talking about how “ping” could still be useful for determining IP addresses as a first level of diagnostics in some cases, for checking on the status of a Web site. Nevertheless, we only wrote about the direct use of an IP address in a URL as http://[the_IP_address] instead of substituting the string of numbers.
The reason for this was quite simple. Yet again, we’re the victims of miscreants who are involved in “phishing” for personal information. A very common method of phishing involves asking you to go to http://seems.innocent.com in an http formatted e-mail. However, it is relatively trivial (translation – took Steve less than 30 minutes to figure it out) to have the actual address that is accessed demoted by a numeric IP address – sending the person who clicks on the address to a false site. After all, most of us don’t notice immediately if the URL displayed in the address bar is numeric, and we also don’t know whether the numeric address is the “real” site or a phishing site.
We stumbled onto this tidbit last summer when trying to help a friend with a home networking problem. SOHO routers only use a very limited number of well-known IP addresses for the control port, so it’s a great diagnostic tool to determine whether the local router can be reached by accessing http://[that_specific_address]. However, any e-mail that contained these instructions was rejected by the friend’s e-mail service provider. After a little investigation, we were able to determine that indeed the service provider blocked any e-mail with an IP address following http://.
Knowing this, we knew that there was a good chance that many of you would not have received the newsletter and had written the address as a numeric address, hence our use of http://[the_IP_address].
By the way, the blocking of IP numeric addresses, while occasionally annoying, is now considered as a “best practice” in trying to prevent phishing. In fact, it’s included in the document, “Fighting the Phishers: Suggested Countermeasures for the Phishing Phenomenon,” available at Webtorials here.
