Slashdot Mirror

← Back to Stories (view on slashdot.org)

How Well Do Businesses Respond to Phishing Reports?

Posted by Cliff on from the is-abuse@-worth-anything dept.

FuzzyDaddy asks: "When I receive a phishing email, which I find has some new or interesting technique, I will usually forward it to the appropriate abuse department. I recently got one concerning 'my' paypal account (surprising, since I don't have one), which I forwarded to abuse@paypal.com. I received an automated reply telling me to 'please direct all customer service inquires through our website.' I didn't have time to do that, so I let it go. Is paypal being irresponsible, here? Have others on Slashdot been satisfied with their attempts to report Phishing?"

34 of 90 comments (clear)

  1. Wrong address. by DrEldarion · · Score: 4, Informative

    Paypal does have an e-mail address to forward them to, it's just not "abuse". Forward the e-mails to spoof@paypal.com. They actually do take these pretty seriously.

    What I like to do until the site gets taken down is to fill out their form with bogus information, then after submitting it, hit the refresh button. It'll ask me if I want to submit the form again, and I'll say "yes". I'll just sit there for a while hitting F5 and enter just to fill their results with bogus crap.

    I know a lot of people actually fall for them. I always tell them that the surefire way to tell if it's a spoof is to put a fake username/password in when prompted. Not only do they then get fake information, but if it gets accepted, you know that the site is fake. I've gotten my whole family to start doing this after my sister fell for one.

    1. Re:Wrong address. by TFGeditor · · Score: 4, Informative

      Ditto for eBay--spoof@ebay.com.

      Always include original full headers.

      You might also want to submit phishing scams to reportphishing@antiphishing.org.

      --
      Ignorance is curable, stupid is forever.
    2. Re:Wrong address. by DrSkwid · · Score: 2, Insightful

      I don't know why they don't just use mod_proxy and Man-in-the-middle everything

      (something like)

      ProxyPass / http://www.ebay.com/

      ProxyPass / https://www.ebay.com/

      and then just log all the mitm data they are interested in

      --
      There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
    3. Re:Wrong address. by Eivind+Eklund · · Score: 2, Informative
      abuse@ is one of the standard mail addresses from the Internet standard RFC2822 (I think it was in 2822 the standard names were, anyway). In my opinion, PayPal is being irresponsible.

      Eivind.

      --
      Doubting the existence of evolution is like doubting the existence of China: It just shows that you're uninformed.
  2. Our reports aren't very important by Nuclear+Elephant · · Score: 5, Interesting

    Our reports aren't very important, as most institutions pay fraud takedown companies to monitor the net for phishing attacks using their name, and outsource the legal aspect of it all together. A company like Paypal wouldn't directly address phishing attacks, instead they would pay a very large sum of money to someone else to make it go away.

    With that said, those hosting the phishing sites have been very responsive. I came across a paypal phish on poly.edu's network, emailed abuse, and it was gone when I checked an hour or so later, along with an email response in my inbox. Problem is that the burden of enforcement is more on the company being phished than the source of the attack.

    1. Re:Our reports aren't very important by TexasRodeoClown · · Score: 2, Informative

      Reports directly to PayPal and eBay are handled by those companies directly. Our reports, our rather your reports, do make a huge differnce. I say "your reports" because I head the abuse department for a large webhost. We deal directly with eBay, PayPal, AOL, and more directly on abuse issues. Banks tend to outsource if they are US Banks whereas EU banks tend to outsource. Reports that are CC'd to the webhost are acted on very quickly. To properly report a phishing scam the following information, while seemingly common sense, helps greatly:

      1. Full headers from the email
      2. The IP and hostname of the server

      Always CC the the webhost on your reports as we take these reports very seriously. I cannot say what host I work for the usual reasons but we actively check for phishing as well. We run scripts to check for phishing sites, we scan outbound email for URLs containg the names of the most common phished entities.

      Here is a list of the companies we have dealt directly with in recent days:

      1. AOL
      2. PayPal
      3. eBay
      4. Verisign

      There are more but with the security measures we have implemented we generally do not have to deal with a lot of phishing.

    2. Re:Our reports aren't very important by FuzzyDaddy · · Score: 2, Interesting
      I only submit a report if I find the phishing web site is up. Businesses, I think, ought to forward the abuse@xxx.com emails to the correct place, as abuse has become like webmaster - an account name people expect to be answered. (Heck, if you want to sort the abuse emails by type, modify spambayes to score the complaint emails based on your human reps training - it shouldn't take long to train it up.)

      Also, why is the email header information so important? I presume the email came from a zombie machine somewhere, and that the most pressing lead (and threat) is the phishing website itself.

      --
      It's not wasting time, I'm educating myself.
    3. Re:Our reports aren't very important by TexasRodeoClown · · Score: 3, Insightful

      The headers allow us and the wronged entity to attempt to get something done about said zombied machines, bad formmails, and so on. Sometimes it leads nowhere but other times we can put a stop to a source of spam. You would be amazed at how many phishing emails come from things like the php-nuke webmail module. We this is the case the offending provider usually takes swift action. Reporting a phishing site should lead to a chain of events and while rarely leads to those phishing it can help to stem the flow of spam over the net to a small degree.

  3. Paypal security center - "Alert us to fraud" by arb · · Score: 5, Informative

    Fake Email/Website (Spoof, Phishing)

    Paypal, eBay, Amazon, etc all have pretty good security centres. I am surprised that abuse@paypal.com gave that automated reply, but if you visit their website the security centre is prett yeasy to find. You might not get a personalised response to your report because they get so darn many reports, but they do follow through on all reports.

    1. Re:Paypal security center - "Alert us to fraud" by arb · · Score: 3, Informative

      In what way? Given that they actually link to PayPal's security centre and seem to be recommended that recipients of phishing attacks report them to PayPal (and other relevant agencies) I would take that to imply that they agree with me.

      I'm not a fan of PayPal by any means (I refuse to use PayPal myself) but I do know that they (and parent company eBay) take phishing reports seriously.

    2. Re:Paypal security center - "Alert us to fraud" by Almost-Retired · · Score: 2, Insightful

      The std form letter that says we're too gawddamned busy to worry about your little squeek is all I've ever gotten from them when fwding such crap to abuse@. As for useing a new 'spoof' address for this when IIRC the RFC says it should be abuse@ is just ducking the issue and hoping it will go away.

      Personally, I sort ALL that crap to the JunqueMail folder and make it all go away about daily.

      Personally also, I've always looked at my fellow man as a like minded person, but the last 65+ years has taught me there are lots of them, who like bad puppies, should have been drowned at birth. But I still let each one prove him(or her)self before I pass judgement.

      As for it being our problem, and not ebay/paypal's, somebody in a position of power at these don't give a damn companies needs to get bit & have his life ruined. Then maybe they'll hire a lobbyist firm who will see to it that crimes of this nature are both harder to pull off, and a damned sight more costly, effectively ruining the perps life for even trying it, let alone doing it successfully a few times. Then and only then, when the chances of pulling it off vanish, will we get rid of such slime.

      Their warped mind needs to be removed from the gene pool by whatever means is both effective, and permanent until such time as they've proved themselves worthy of the name 'human'. Society and its goody two shoes people are not doing humanity a favor when they want to let them breed more of them just to keep the welfare agents busy.

      Sorry, in a bad mood tonight. These phishers are not the kind of "fishers of men" Jesus had in mind.

      --
      Cheers, gene

  4. Someday, take a look at those phishing websites by destuxor · · Score: 4, Interesting

    Once I looked at the website scamming PayPal (it was somewhere in South America) to see if I could get anything out of the server stats (http://example.com/server-stats) and other such Apache functions. To my horror, the Perl script that would accept input from the "verification" web page had several hundred hits. Either people are submitting bogus information, or hundreds of individuals are being fooled by these scams.

  5. Outside of the actual businesses by BMIComp · · Score: 3, Informative

    You could always report it to CERT (US Computer Emergency Readiness Team) or the FBI's Internet Crime Complaint Center.

  6. Bank of America by MikkoApo · · Score: 3, Interesting
    I almost submitted a report about a phishing attack to the Bank of America. What stopped me was that the feedback form required me to submit my email address with the feedback and the feedback page's EULA had something like this in there: "we might use your address to send occasionaly information about our services". I may be paranoid but that translates way too easily to "we will be sending you spam as soon as possible".

    And no, I didn't send them feedback on how they could improve their website.

    1. Re:Bank of America by Harker · · Score: 4, Interesting

      I actually did fill out their form for one I received. I'm not too terribly worried about spam from someone like them. Perhaps I'm naive, but I don't believe they will continue if I request them to stop sending it.

      Anyway, I got a reply, from a real person, telling me they needed my account number in order to proceed. I told them I didn't have one, and that I only forwarded the information to them so they could stop possible fraud. They replied that they still needed my account number to proceed.

      My final response to them was not very kind, and I never heard back from them again. I'm certain the profanity in it caused them to dump my 'case' right there. Too bad for their customers. Luckily, I won't ever be one.

      H.

      --
      When VCR's are outlawed, only outlaws will have VCR's.
    2. Re:Bank of America by MikkoApo · · Score: 2, Insightful
      You're right, I could have lied about my identity. But CastrTroy was right, that was about a principle. I support things which I like and I don't support things which I don't like. I hope that in the long run market forces will make the "good" things flourish and drive the "bad" things/companies/whatever out of business. For example: Sony bad, open source good. When enough people start making conscious choises the companies might actually start caring about their customers again.

      And for the record, since I'm Finnish I couldn't care less about Bank of America or its offerings, specially if I might get spam from it.

  7. RFC Violation by strredwolf · · Score: 3, Informative

    Paypal's been dropping anything that comes to abuse@, which not only is an RFC Violation (and there's a DNSBL of those), but is part of a slow trend of ISP's and other similar service providers to kill off abuse@ and postmaster@.

    --

    --
    # Canmephians for a better Linux Kernel
    $Stalag99{"URL"}="http://stalag99.net";
    1. Re:RFC Violation by Ash-Fox · · Score: 2, Informative

      Actually the RFCs if I recall correctly just stated that the mailserver had to accept mail to those addresses if it accepts incomming mail at all. Not that anyone had to read it, or that it had to goto some 'real' mailbox.

      --
      Change is certain; progress is not obligatory.
    2. Re:RFC Violation by Mike+Markley · · Score: 2, Informative

      I dare you to point me at the RFC that says abuse@ must be read, and prohibits autoresponding to inform legitimate senders of the proper procedure.

      Go ahead, I'll wait.

    3. Re:RFC Violation by Skapare · · Score: 2, Interesting

      I read elsewhere that 75% of what is coming OUT from Hotmail/MSN server is spam of one sort or another (and apparently mostly phishing and similar scams based on what I've gotten in the past). It's time to just refuse all email from Hotmail/MSN servers ... except for specific email addresses you know of by whitelisting them. This is what I have had to do (because Hotmail/MSN reached the point of representing more than 50% of all incoming spam because I've been rather effective at blocking spam from lots of other sources such as the bulk of home zombie machines). Just block them, whitelist any friends that still use it, and move on.

      --
      now we need to go OSS in diesel cars
  8. Considered sending paper mail? by Michael+Spencer+Jr. · · Score: 2, Insightful

    The original poster asked about experiences with other companies.

    Personally, I feel email is not a reliable way to make first contact with someone, unless you have some arrangement made with them in advance. While email sent to abuse@ and postmaster@ should always be read by a live person, many spammers send bulk email to abuse@ and postmaster@ addresses. Any published email address is likely to receive a large number of unwanted email messages, and anyone who reads mail at that address must spend extra time removing unwanted messages. Sometimes important messages are deleted or ignored by mistake.

    Some companies ask to be contacted by email. They might publish a customer service email address on their web site, or publish a 'Contact Us' page which lists email addresses which can best handle different kinds of issues.

    If you just guess an email address, or if you send mail to a published address where the recipient hasn't requested your email, I don't think you can assume your email will always be read, or that you can fairly call a company irresponsible for failing to read your unsolicited email.

    Phone calls, faxes, and paper mail require more effort than an email message. If a company doesn't respond to an email message, but you really are interested in helping them find this web site, it might be worthwhile to look up their fax number or mailing address, and contact them that way. If you don't really want to help them, you don't have to. It's completely optional.

  9. Why bother? by cdrguru · · Score: 2, Insightful

    Do you believe there is anything that a company that is the target of a phishing attack can do? Let's see here, someone signs up for a hosting account and the hosting company is under legal obligation to protect the identity of their customer. If that hosting company is in a different country than the target, then without international police cooperation, you aren't going to get anywhere. No court is going to force a hosting company to disclose the identity of someone that might be either the perpetrator or a victim.

    So, your helpful report (along with a few thousand others) is likely to be met with either silence or open rejection. There isn't much they can do, and it is unlikely they can do much for the fools that fall for such scams. If you believe you bank is going to send you email from a host they don't have their domain name on, you will believe anything. More over, these days if you think your bank is going to send you email at all you are being silly. They already figured out that email is useless given the density of spam.

    The problem is the target is helpless. It is up to people to stop responding to this stuff. If we aren't going to go after the people that send this out, what do you want the target to do?

    1. Re:Why bother? by FuzzyDaddy · · Score: 2, Insightful
      It is up to people to stop responding to this stuff.

      Here's where I'd draw an analogy to the credit card business. Credit card companies did not used to be liable for fraud, and did very little to protect people from it. In fact, they would do things that were very insecure (like sending out live, unsolicated credit cards to people, that would get intercepted and used by thieves.) It was a huge problem, and it was eventually solved by Congress limiting individual's liability in credit card fraud cases to $50. Suddenly, the credit industry had a huge incentive to fix the problem, and it is much better than it used to be.

      If the companies involved take a "what can we do?" approach (which I don't think they are doing at the moment), then the entire credibility of their online business is going to suffer, to their and everyone else's ultimate detriment. The rational customer response to getting Phished out of their Paypal information is to stop using Paypal.

      So what can they do? If a website is in the process of committing fraud with their name, I'm sure they have legal options to pursue in getting it taken down. If not, they certainly should be fighting for the legal tools to do so. Blaming the consumer is very easy, but it's not going to solve the problem. It's just a way to feel like our failures to do anything about it are OK, because WE'RE too smart to fall for it.

      --
      It's not wasting time, I'm educating myself.
  10. Banks send legitimate e-mail from other domains by tech-law-ny · · Score: 2, Informative

    About half of all banks that send legitimate e-mail send it from
    a host they don't have their domain name on, in my experience.
    I don't have a bank message in my current inbox but Discover Card,
    for example, sends e-mail from arm149.bigfootinteractive.com. The
    bigfootinteractive.com web site (which I believe is legitimate) says
    it's a "leading provider of strategic, ROI-focused email
    communications solutions."

    Actual banks, credit unions, etc. use similar e-mail outsourcing.
    The messages that give me short https URLs are useful in some
    cases. But mostly they give http URLs to the bank's web site, or
    worse, http URLs to a legitimate but different domain (such as
    a domain ending in ".m0.net").

  11. Halifax and Cyota by JJC · · Score: 2, Informative

    I recently received a phishing mail pretending to be from Halifax (a UK bank). I clicked the link and it worked so I forwarded the mail to the address (onlineemailinvestigations@hbosplc.com) listed on their real web site. I've done this before and got the usual instant form response but this time I got that and a bounce message saying that my message could not be delivered to HBOSfeed@cyota.com. Cyota appears to be a company which Banks outsource their phishing responsibilities to.

    I figured this was just a misconfiguration somewhere so I tried mailing postmaster@cyota.com and that bounced too so I think I then filled in the Contact Us form on their web site (I'm not certain if I got round to doing it, but I think I did). Next time a phishing e-mail came I forwarded it as usual but I got the same bounce so this time I tried mailing postmaster@hbosplc.com. This one didn't bounce so I figured someone was sorting it out.

    Then yesterday another phishing e-mail came so I forwarded it to the designated address again and got the same bounce again. Now I'm out of ideas, but to answer the original poster's question: In the case of Halifax and Cyota, I'd say, "not very".

  12. Ditto. by antdude · · Score: 2, Interesting

    I also ran into this a few weeks ago with my own account when I accidently stumbled into phishing on a dot.tk Web site (stupid of me not paying attention to the domain at 3 AM). I never entered real datas when I signed up for a Yahoo! account about a decade ago so I didn't know what I used when they asked for my birthdate, Q&As, and stuff. Yahoo! wouldn't even lock my account!

    I managed to get the phisher's two Web sites shut down by dot.tk's abuse department. So, the second time phisher came on to spam people, I told everyone on my buddy list (I had their e-mail address in local files) to fill out Yahoo!'s abuse forms to close my account so the phisher couldn't use it anymore.

    --
    Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  13. Only stops the low-tech phishers by Beryllium+Sphere(tm) · · Score: 2, Insightful

    Typing in a wrong password first is a brilliant trick but it's not "surefire" any more.

    Now that banks are issuing one-time passwords and SecurID tokens, reports are that some phishers have invested in the software and infrastructure to do real-time man in the middle attacks. They talk to the genuine version of the web site they're impersonating and pass along your credentials. If you supply the wrong password, they echo back the "invalid login" from the real site.

    I'm currently recommending "go to your bank from a bookmark" to non-technical people and adding "read the SSL certificate details" to everyone else. And I'm feeling inadequate because even those two together won't protect from a scammers who tampers with DNS or hosts files and who gets a cheapo cert that doesn't verify the organization name.

  14. Yahoo doesn't respond by WoodstockJeff · · Score: 3, Funny
    Well, actually, that's not true. How can you respond to mail you don't receive?

    A week ago, I got a phishing scam that used the address http://paypal-com-us-ssl.info/ for its responses. At the time (it's dead now), that address resolved to a YAHOO server. So, I reported it, including the whole phishing message, with headers, to abuse@yahoo.com.

    Their response? Don't know - their abuse@yahoo.com address has a spam filter on it, which rejected the message because it contained a phishing scheme:

    abuse@yahoo.com: host mx1.mail.yahoo.com[4.79.181.14] said: 554 Message type not allowed. UP Email not accepted for policy reasons. Please visit http://help.yahoo.com/help/us/mail/defer/defer-04. html [#4.16.3:120] (in reply to end of DATA command)
  15. Yes, there are things they can do! by WoodstockJeff · · Score: 4, Interesting
    Do you believe there is anything that a company that is the target of a phishing attack can do?

    The first thing they could do is to publish SPF records for their domains. And not the ones that end in "~all" ("and accept any other IP, in case we forgot one") like AOL, HOTMAIL, and many other sources whose domains are faked constantly use. The ability to tell your users "Hey, this didn't come from who it is claiming to have come from" is a start. But PayPal, eBay, and most banks I've seen scammed have no inkling of how a simple change to their DNS would protect them and their customers.

    The second thing would be to tell their web servers to not serve images up that have the wrong referrer. Hey, referrer checking isn't 100%, but any time you have an image request from a victim of one of these scam mails, it would be a lot better if that picture had "THIS IS A FRAUD MESSAGE" overlayed on it. It would force the scammers to go back to hosting the pictures on the scam site, which is a harder to do than simply uploading a single script to a slightly-insecure website in Brazil or Ohio. And the emails are as legitimate looking as they are because they use the scammed bank's own graphics, from their own servers!

    1. Re:Yes, there are things they can do! by sommere · · Score: 2, Interesting

      The problems with SPF is that its broken with regards to forwarding accounts.

      Unless the forwarding account is SPF aware (which is not trivial to do) legit e-mail will say its from ebay.com but the ip will be for forward-mail.com and ebay won't be able to send e-mail to those customers.

      Until everyone makes sure their servers are SPF compatible I can't see how companies like ebay can possibly use SPF records and reliably get their mail to their customers.

  16. Re:It isn't really abuse(of Paypal). by Lehk228 · · Score: 2, Informative

    often the fishers will pull images off the real site to save bandwidth, referrer detection can stop this but last i knew paypal never bothered to implement that.

    --
    Snowden and Manning are heroes.
  17. from the other side by rritterson · · Score: 3, Informative

    Just before I started working at my current job, our webserver was hacked and used as an ebay phishing site. It didn't take long before our offices were getting personal calls from agents at the FBI and urgent contact from the ISP who runs our node.

    Suffice it to say we took action ASAP. I have a feeling they would have forced us to do something about it if we dragged our feet. I'm assuming they do the same for other reports they receive.

    --
    -Ryan
    AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
  18. FedEx botches it by Animats · · Score: 3, Interesting
    My message to FedEx, after receiving a phishing scam and talking to the billing part of FedEx.
    • FedEx case number: 1752XXXX

      I've been referred to you by FedEx tech support, with the case number above.

      Attached is an obvious phishing scam using the FedEx name. It has the usual hallmarks of a phishing scam:

      1. A forged return address "aroundtheworld@fedexemails.01o.com", while it was actually sent from "snd6222.britecast.com". (This, of course, is a criminal violation of the CAN-SPAM act.)

      2. Phony links to fake sites: the link supposedly to "nba.fedex.com" actually goes to "http://fedex.00b.net/ajtk/servlet/JJ?H=h3cq6&R=28 6452495".

      So this is a clear phony.

      The real concern is that the sender of this message has some information about our FedEx account. The message contains the line

      "All shipments must be paid for with your FedEx account number ending in 811."

      That is in fact from our valid FedEx account number. So FedEx appears to have a security breach; account numbers have leaked to a scammer.

      Full message source appears below.

      Please let me know immediately if we need to cancel our FedEx account because of this security breach. Thank you for your attention to this matter.

    FedEx reply:

    • Response (Kristine C.) - 01/24/2006 09:13 PM
      Dear John:

      We received your inquiry. Thank you for contacting FedEx. We apologize for the inconvenience.

      We would like to inform you that you may need to contact your local FedEx Account Executive so they can further advise you of what you need to do regarding the status of your account.

      We hope this information is helpful. Again, thank you for contacting FedEx.

    Note that they've referred me back to the part of FedEx that referred me to them. So that's FedEx, clueless.

  19. The other side by Pig+Hogger · · Score: 2, Interesting
    I've been on the other site of a ph151n9 attempt... A client had his server b0rk3d into and a ph15h page installed on it.

    We caught it three weeks in the act. I analyzed the code, and made a script that would randomly send the receiver (a yahoo e-mail address) random login information (made from first and last name files downloaded from the US census bureau). Now, it's been running for at least three months.

    The ph151ng page has been left intact, except that it does not report back to the original receivers, but instead shows a message that basically says "you've been phished, sucker!!!". And at least 200 people a day still get sucked in after three months!!!

    I guess I will put google ads on the page...