phishing attacks against ISPs (also with Google translations)

Wed Mar 25 12:38:24 UTC 2009

In this email message I'd like to discuss two subjects:
a. Phishing against ISPs.
b. Phishing in different languages against ISPs as soon as Google adds a
new translation module.

[My apologies to those who receive this email more than once. I am
approaching several different industries on this matter]

In the past few weeks there has been an increasing number of phishing
attacks against clients of Israeli ISPs. I've only seen a few of these,
but the local ISPs confirm it's happening across the board.

In all these cases, the phishing email is in Hebrew.

While we have seen ISP phishing and Hebrew phishing before, these
attacks started when Google added translation into Hebrew.

Is this a trend? Have other countries (or populations) been targeted
when Google added a translation module for more languages?

Notes:
a. Some Israeli ISPs emailed their clients warning against such attacks.
Saying they'd never ask for their password, etc.

b. While I was certainly heavily involved with phishing originally and
even started the first coordination group to deal with the issue, I am
somewhat removed from it now, dealing more with phishing/banking Trojan
horses.
Can anyone educate me as to how often ISPs get phished, if at all?

c. If you get phished, what strategies if any have you taken to prevent
the attacks/respond to them/educate your clients? What worked?

d. I wonder if these translation misuses could eventually translate into
some intelligence we will see in Google security reports, such as on
malware.

	Gadi.