Computer Guru made good
comment on my
previous post and I think it bears addressing. He/she points me to
this link that makes a very good analysis of what
PIRT is doing and how they're doing it. Its a well researched, thought-out piece. However, I do think PIRT has the right approach - they're not just informing the ISP, they're going above and beyond that.
One of the key arguments in the post by Computer Guru is that many phishers leverage ISP hosts in developing countries and they quote NetCraft:
Fraudsters will often host their sites in developing countries with limited law enforcement resources and incentivize the hosting company to keep the site running as long as it possibly can.
But I think there's a key point they're missing - regardless of whether or not its an unscrupulous ISP - PIRT doesn't simply inform them and local law enforcement. According to PIRT they go above and beyond, informing all channels of the scheme including the victim company being misrepresented as they state on their Wiki site:
Once phish are confirmed, emails will be sent to various anti-phishing toolbar companies with copies of the full reports, including various other researchers and enforcement communities. This way PIRT not only works on shutting down the phish by contacting the appropriate ISPs, but we also help consumers who use antiphishing toolbars with our reports. All our reports are also copied to the company that is being phished as well as the APWG and other antiphishing groups.
This is the key thing that PIRT does - informing the company being phished, in my opinion is the key to all of this. Ideally that company is savvy enough and has a communications team in place that develop a cohesive plan of attack to deal with the issue whereby they:
- Identify the issue and immediately address it both internally and publicly
- Draw attention to the issue, alert current and potential customers of it either via e-mail or through the media
- Work with the appropriate law enforcement, ISPs etc. to put a stop to it to minimize or wholly eliminate the risk to current and potential customers
Most phishing schemes leverage big name companies, and if they're responsible corporate citizens, they'll deal with this the best way they can, by effectively communicating the issue to their customers.
Ramble on...