Phishing Phollies

According to ComputerWorld "Black Friday" is one of the most profitable events for hackers trying to steal your holiday cheer and anything else they can get their filthy paws on.

There are usually a handful of "hot" items that everyone is vying for this time of year; be it a Tickle-Me-Elmo or a Wii. Don’t fall victim to that email claiming to have your Holy Grail at an unbelievable price/quantity on a very popular site. Do NOT click on the link! VERIFY the code behind that link to see where it is really trying to take you. The scammers are not only trying to take you to a fake site to steal your info, their fake site may also be installing key stroke monitoring code on your computer to collect what you type in the future.

I’m disturbed by the following excerpt from the ComputerWorld article:

"Online fraudsters have been busy this year. Fraud losses related to U.S. e-commerce will top $3.6 billion in 2007, up 20% from last year, according to a report by the vendor CyberSource this month. The increase in dollar loss is due mostly to growing e-commerce sales, as the percentage of transactions that are fraudulent has held steady.

The run-up to Christmas and tax filing season are the two most dangerous times of the year for online shoppers, Yaneza says.

In addition to being wary of e-mails, be careful when searching for holiday deals or specific products on Google and other search engines. Operators of malicious sites have figured out ways to rise to the top of search listings.

"We’ve seen instances where the top site that is ranked actually gets there by gaming the Google search algorithm," Yaneza says."

$3.6 BILLION, These dirtbags have stolen THREEPOINTSIX BILLION bucks out of your pockets! WAKE UP PEOPLE!!!!!! And, remember, that is only the reported amounts. Many victims are too embarrassed to report their losses.

I don’t know how many different ways we; the people who don the superhero capes to fight these criminals, can say it: DON’T BE FOOLED!  Even if you are a regular customer of "Company X" do not click on a link in an email purported to be from Company X without making damn sure that email is real. better yet, open your browser and type the URL you always go to (www.amazon.com) rather than clicking on any link in an email. It only takes a second people, it isn’t going to destroy your day to exercise those fingertips and type rather than clicking on your mouse.

A message from your local superhero; Super Pessimist

OK, there are so many things wrong with this I just don’t know which one to address first!

Second, lets review the bottom of the email…. hmmmm a disclaimer about "Spheris.com" and "HIPPA" warnings… Spheris is a medical documentation company. Credit unions do not need a HIPPA disclaimer (Health Insurance Portability and Accountability Act). They don’t deal with patient information!

The scammer hacked into a Spheris mail account to send the mail without realizing that Sheris attaches the HIPAA disclaimer on all outbound mail. 1D10T5!

Next, the moron is "sending" the mail from "fcu.com" which is also NOT a credit union! They provide information on credit unions!

The next clue that this is a scam is the body of the email; a blurry screenshot image that is so bad you can hardly read it, but if you squint really hard you will see mistakes in the text.

Talk about "big game" phishing! The following article is from ComputerWorld (my morning coffee partner):

It pays to be vigilant no matter how big or small you are!

While not directly related to phishing emails, my newest friend covers the other side of email skanks.

and wants to send you money that does not belong to you or give you a check in excess of your price with the stipulation that you deposit the large amount and wire or transfer back to them any amount quickly, DELETE THE EMAIL ASAP!

Here’s an interesting twist on trying to bully you into giving them what they want.

The claim is that they discovered your credit card (BOA details) has been used on a site supporting our friend bin laden and because of this activity BOA is "limiting" your account.

The claimed website is a real website, however, it is not what you think… The guy running it is, IMHO, a sensationalist and is using the shock value of the domain name to spout his agenda. He claims it WAS bin Laden’s site but the domain name expired on 9-11-2001 and he snapped it right up.

In any event, the email is 100% phish phoop! By now I should not have to point out the obvious identifiers to you, the generic greeting, the threat of account problems, the mistakes ("that your that your" in the first line), and the all important URL that points to an IP number and not a domain name, which, BTW, is no longer reachable.

I did think it was fun that they included the text about always looking for your SiteKey before signing in…

WARNING: Personal opinion alert! Queasy people stop reading now…

I still am amazed at the large number of people who fall for phishing, even with all the obvious clues, or the "Nigerian" or Lottery scams. Then again, 52% of you voted for Bush… ‘nough said! As my pal Forrest says, "stupid is as stupid does"

Now, this is fun! I knew that Amazon was big and that I could get anything from steel cut oats to bandsaws, but according to the "From" address: onlinebanking@amazon.com they sell money too!

redshift.com is an ISP in Monterey, California. I notified them. I also sent this to Amazon. And, it is already submitted on PhishTank. The site, however, is still up. So, I paid them a visit using a proxy to mask my real IP number and filled in "my" name, which, I can’t tell you because it would make you blush, and my address happens to be the same as the ISP’s address in Monterey.

I did manage to grab the last page of it on the first round. The "success" page even had spelling mistakes! It automatically sent me to the real Amazon site after a few seconds.

Ha! while I was writing this I got the exact same email again, only this one points to an ISP in China (hinet.net). Once again, the URL has already been reported to PhishTank and I sent the URL to the ISP though they won’t do anything, they’ve probably got an arrangement to get a cut of any action the creep gathers on the site! The site even had the same stupid spelling mistakes on it as the first one.

 My browser of choice is Firefox, an excellent application IMHO!

  I just don’t know why it took me so long to switch over. I haven’t seen a pop-up or banner ad in years, I can get an indepth look into any site I’m on, I can block any script I want, easily download entire sites in mintues… but I’ll save that for another article.

If your Firefox does not do this you can change the settings by going to Tools/Options. It’s very quick and easy. 

IE needs to get its act together…..

Dear Robert Mickelsen

You’re truly an idiot:

Whois
Domain Name………. mymutualban.com
  Creation Date…….. 2007-10-03
  Registration Date…. 2007-10-03
  Expiry Date………. 2008-10-03
  Organisation Name…. robert mickelsen
  Organisation Address. 4400 Dixie Way
  Organisation Address.
  Organisation Address. Mims
  Organisation Address. 32754
  Organisation Address. FL
  Organisation Address. UNITED STATES

Admin Name……….. robert mickelsen
  Admin Address…….. 4400 Dixie Way
  Admin Address……..
  Admin Address…….. Mims
  Admin Address…….. 32754
  Admin Address…….. FL
  Admin Address…….. UNITED STATES
  Admin Email………. mickelsen.robert@yahoo.com
  Admin Phone………. +1.3213642642
  Admin Fax…………

Tech Name………… YahooDomains TechContact
  Tech Address……… 701 First Ave.
  Tech Address………
  Tech Address……… Sunnyvale
  Tech Address……… 94089
  Tech Address……… CA
  Tech Address……… UNITED STATES
  Tech Email………..  domain.tech@yahoo-inc.com
  Tech Phone……….. +1.6198813096
  Tech Fax………….
  Name Server………. yns1.yahoo.com
  Name Server………. yns2.yahoo.com

Here is a real quick and easy one. The first tipoff for me was my lack of association with this bank. I don’t live in Massachusetts or have an account with any bank there, let alone Mutual Bank.

Looking at the URL behind the "click here or die" link shows only a very minor difference; the "k" is missing at the end.

I reported this to the bank as the site was still up and I reported it to PhishTank.

Sometimes reporting these things to the company being used pays off!

I got a nice personal Thank You note for alerting them.

A million bucks would have been even better, but I’ll take the thank you!

To decode a URL you need to understand the following basic parts that make up the whole string. We’ll use one from a previous post.

In the above example you will notice "/%20%20/". This can be another ploy used by the scammer to conceal the actual site. Any character that can be seen/typed on a computer is schizophrenic, if you will. Characters have "Alter Egos" or other forms of representation. Computers like numbers and prefer numeric representations rather than text. One of these numeric representations is known as "hexadecimal". The hexadecimal representation of the character we know as space: " " has a hexadecimal equivalent of 20. It has another alter ego of "32" in the ISO-Latin character set that we use. When converted to hexadecimal, 32 becomes 20. And, in URL encoding 20 is referred to as "%20".

Dr. Cranor is a professor from Carnegie Melon University. Her team has developed a great game to help people learn how to spot Phishing attempts.

Anti-Phishing-Phil is a tiny little fish whose adventures teach him about the perils of scam emails and how to spot them.

While the game is cute, it is the initial series of frames that are really good in introducing the user to URL construction and what to look for and spot a fraud.

I sent Professor Cranor an email suggesting that she give the user a "Pause" button so they can go look up URLs presented in the game to see if they are or are not fakes. During one of my rounds on the game a URL was offered that I did not recognize, but the game did not give me enough time to go check it. The game also seemed to malfunction in that it was offerring users a chance to register and possibly win a prize, however, it never presented the screen to register.

The initial testing is over (no more prize), but you can still play the game. I suggest that everyone give the game a try, several in fact, so that you can become more familiar with the scams that exist.

You can also find more useful information on the CMU Usable Privacy and Security Laboratory(CUPS) page on Internet Trust issues.

In my next post I will show you how to decode a URL.