Has anyone heard of thido you know if its true and weather to disable what it
says?
> Opening the wrong E-mail may soon be enough to empty your bank
account. In
an effort to woo security-conscious computer users, "phishers" have
come up
with a new technique to harvest online banking details without
requiring
users to click on a Web link and enter personal information on a
submission
form. This new form of attack, directed specifically at users of
online
banking, runs a script when a phishing E-mail message is opened,
according
to E-mail and virus security company MessageLabs Ltd. The script tries
to
rewrite the host files on the machine of the recipient. On subsequent
attempts to access online banking services, victims will unknowingly be
redirected to a fraudulent Web site designed to capture their log-in
details. Alex Shipp, senior antivirus technologist at MessageLabs,
says
such developments only make it harder to defend against phishing.
Traditional phishing attacks rely on tricking the user into following a
Web
link and then entering personal information. "This one is much more
insidious," he says. Some 3% of those targeted by phishers reveal
personal
information, according to a study released in April by research firm
Gartner. Shipp adds that this new technique, which has only been
detected
in Brazil, is probably being tested for wider deployment. That's what
happened with first-generation phishing attacks that were tested in
Australia before being directed at users in the United States. Only
systems
that have enabled Windows Script Host are vulnerable to this attack.
WSH
lets users run VBScript and JScript scripts within the Windows
operating
system. Sophos plc, an antivirus company, offers instructions on how to
disable WSH <http://www.sophos.com/support/wsh.html>. "Most businesses
these days probably have this disabled," Shipp says. "But home users
are
more vulnerable."