Website spoofing is a common problem that has doubled in the last year, resulting in $1.3 billion in losses, according to the 2019 Thales Access Management Index (registration required). In a high-profile example of website spoofing that has left the business world more than a little rattled, hackers successfully diverted about 500,000 customers visiting the British Airways website last summer to a realistic-looking but fraudulent site, without the airline having any idea it had been spoofed.
The spoof site gathered names, addresses, login information, payment card details, and other data. After a review by the EU's Information Commissioner's Office, British Airways faces a possible record-breaking fine for violating the terms of General Data Protection Regulation (GDPR), to the tune of £183.5 million — about 1.5% of the airline's annual revenue. Because of website spoofing, not only does the airline suffer losses to its customers and its brand but the additional government-levied fines and financial pain.
This attack vector has been around for decades and continues to be popular because it's difficult to detect until it's too late. For a fairly small investment, adversaries can acquire all the tools they need on the Dark Web to set up highly convincing website-spoofing schemes, as part of a larger phishing campaign. Website spoofing works on all of the major Internet browsers and is not prevented by "secure" connections. The adversary can observe and modify all website pages and form submissions, even when the browser's "secure connection" indicator is lit. The ..
Support the originator by clicking the read the rest link below.
