Countering phishing attacks

1. A method for countering phishing attacks, the method comprising:

generating a plurality of synthetic victims, wherein each of the synthetic victims includes synthetic victim information that represents a computer user identity and includes associated sensitive information, wherein the computer user identity and its associated sensitive information are fictitious in that they are not known to be associated with a legitimate computer user, wherein the generating includes generating a user name for each of the synthetic victims and using a predefined algorithm to derive an associated password using the user name and a predefined salt;

providing the predefined algorithm and the salt to a computer-hosted target site, wherein the computer-hosted target site is configured, upon receiving any user name and any password from any requestor, to use the predefined algorithm and the salt to determine that the received password was derived from the received user name, and thereby determine that the received user name and the received password are associated with any of the synthetic victims;

receiving from the computer-hosted target site, information provided to the computer-hosted target site by a requestor;

identifying in a computer-accessible database that stores the synthetic victim information, any of the synthetic victim information matching the requestor information; and

notifying the computer-hosted target site that the requestor information is of a synthetic victim.

2. The method according to claim 1 wherein the generating comprises encoding additional information into the password, wherein the computer-hosted target site is configured to extract the additional information encoded into the password.

3. The method according to claim 2 wherein the encoding comprises encoding a network address of a computer-hosted phishing site into the password.

4. The method according to claim 1 wherein the generating comprises signing the password with an asymmetric private key, wherein the computer-hosted target site is configured to validate the signature using an asymmetric public key paired with the asymmetric private key.

5. The method according to claim 1 and further comprising:

receiving from the computer-hosted target site a network address of the requestor;

storing in the computer-accessible database, in association with the synthetic victim information, the network address of the requestor and a timestamp; and

making any information stored in the computer-accessible database available to parties for security purposes.

6. A system for countering phishing attacks, the system comprising:

a computer-accessible database; and

a computer-hosted protector configured to

generate a plurality of synthetic victims, wherein each of the synthetic victims includes synthetic victim information that represents a computer user identity and includes associated sensitive information, wherein the computer user identity and its associated sensitive information are fictitious in that they are not known to be associated with a legitimate computer user, wherein the computer-hosted protector is configured to generate any of the synthetic victims by generating a user name and using a predefined algorithm to derive an associated password using the user name and a predefined salt,

provide the predefined algorithm and the salt to a computer-hosted target site, wherein the computer-hosted target site is configured, upon receiving any user name and any password from any requestor, to use the predefined algorithm and the salt to determine that the received password was derived from the received user name, and thereby determine that the received user name and the received password are associated with any of the synthetic victims,

receive from the computer-hosted target site, information provided to the computer-hosted target site by a requestor,

identify in a computer-accessible database that stores the synthetic victim information, any of the synthetic victim information matching the requestor information, and

notify the computer-hosted target site that the requestor information is of a synthetic victim.

7. The system according to claim 6 wherein the computer-hosted protector is configured to encode additional information into the password, wherein the computer-hosted target site is configured to extract the additional information encoded into the password.

8. The system according to claim 7 wherein the computer-hosted protector is configured to encode a network address of a computer-hosted phishing site into the password.

9. The system according to claim 6 wherein the computer-hosted protector is configured to encode sign the password with an asymmetric private key, wherein the computer-hosted target site is configured to validate the signature using an asymmetric public key paired with the asymmetric private key.

10. The system according to claim 6 wherein the computer-hosted protector is configured to:

receive from the computer-hosted target site a network address of the requestor;

store in the computer-accessible database, in association with the synthetic victim information, the network address of the requestor and a timestamp; and

make any information stored in the computer-accessible database available to parties for security purposes.

11. A computer program product for countering phishing attacks, the computer program product comprising:

a non-transitory, computer-readable storage medium; and

computer-readable program code embodied in the storage medium, wherein the computer-readable program code is configured to

generate a plurality of synthetic victims, wherein each of the synthetic victims includes synthetic victim information that represents a computer user identity and includes associated sensitive information, wherein the computer user identity and its associated sensitive information are fictitious in that they are not known to be associated with a legitimate computer user, wherein the computer-readable program code is configured to generate any of the synthetic victims by generating a user name and using a predefined algorithm to derive an associated password using the user name and a predefined salt,

provide the predefined algorithm and the salt to the computer-hosted target site, wherein the computer-hosted target site is configured, upon receiving the user name and the password from a requestor, to use the predefined algorithm and the salt to determine that the password was derived from the user name, and thereby determine that the user name and the password are associated with the synthetic victim,

receive from the computer-hosted target site, information provided to the computer-hosted target site by a requestor,

identify in a computer-accessible database that stores the synthetic victim information, any of the synthetic victim information matching the requestor information, and

notify the computer-hosted target site that the requestor information is of a synthetic victim.

12. The computer program product according to claim 11 wherein the computer-readable program code is configured to encode additional information into the password, wherein the computer-hosted target site is configured to extract the additional information encoded into the password.

13. The computer program product according to claim 12 wherein the computer-readable program code is configured to encode a network address of a computer-hosted phishing site into the password.

14. The computer program product according to claim 11 wherein the computer-readable program code is configured to encode sign the password with an asymmetric private key, wherein the computer-hosted target site is configured to validate the signature using an asymmetric public key paired with the asymmetric private key.

15. The computer program product according to claim 11 wherein the computer-readable program code is configured to:

receive from the computer-hosted target site a network address of the requestor;

store in the computer-accessible database, in association with the synthetic victim information, the network address of the requestor and a timestamp; and

make any information stored in the computer-accessible database available to parties for security purposes.