Slashdot Mirror
How Well Do Businesses Respond to Phishing Reports?
FuzzyDaddy asks: "When I receive a phishing email, which I find has some new or interesting technique, I will usually forward it to the appropriate abuse department. I recently got one concerning 'my' paypal account (surprising, since I don't have one), which I forwarded to abuse@paypal.com. I received an automated reply telling me to 'please direct all customer service inquires through our website.' I didn't have time to do that, so I let it go. Is paypal being irresponsible, here? Have others on Slashdot been satisfied with their attempts to report Phishing?"
Paypal does have an e-mail address to forward them to, it's just not "abuse". Forward the e-mails to spoof@paypal.com. They actually do take these pretty seriously.
What I like to do until the site gets taken down is to fill out their form with bogus information, then after submitting it, hit the refresh button. It'll ask me if I want to submit the form again, and I'll say "yes". I'll just sit there for a while hitting F5 and enter just to fill their results with bogus crap.
I know a lot of people actually fall for them. I always tell them that the surefire way to tell if it's a spoof is to put a fake username/password in when prompted. Not only do they then get fake information, but if it gets accepted, you know that the site is fake. I've gotten my whole family to start doing this after my sister fell for one.
Our reports aren't very important, as most institutions pay fraud takedown companies to monitor the net for phishing attacks using their name, and outsource the legal aspect of it all together. A company like Paypal wouldn't directly address phishing attacks, instead they would pay a very large sum of money to someone else to make it go away.
With that said, those hosting the phishing sites have been very responsive. I came across a paypal phish on poly.edu's network, emailed abuse, and it was gone when I checked an hour or so later, along with an email response in my inbox. Problem is that the burden of enforcement is more on the company being phished than the source of the attack.
Fake Email/Website (Spoof, Phishing)
Paypal, eBay, Amazon, etc all have pretty good security centres. I am surprised that abuse@paypal.com gave that automated reply, but if you visit their website the security centre is prett yeasy to find. You might not get a personalised response to your report because they get so darn many reports, but they do follow through on all reports.
Once I looked at the website scamming PayPal (it was somewhere in South America) to see if I could get anything out of the server stats (http://example.com/server-stats) and other such Apache functions. To my horror, the Perl script that would accept input from the "verification" web page had several hundred hits. Either people are submitting bogus information, or hundreds of individuals are being fooled by these scams.
You could always report it to CERT (US Computer Emergency Readiness Team) or the FBI's Internet Crime Complaint Center.
And no, I didn't send them feedback on how they could improve their website.
Paypal's been dropping anything that comes to abuse@, which not only is an RFC Violation (and there's a DNSBL of those), but is part of a slow trend of ISP's and other similar service providers to kill off abuse@ and postmaster@.
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
A week ago, I got a phishing scam that used the address http://paypal-com-us-ssl.info/ for its responses. At the time (it's dead now), that address resolved to a YAHOO server. So, I reported it, including the whole phishing message, with headers, to abuse@yahoo.com.
Their response? Don't know - their abuse@yahoo.com address has a spam filter on it, which rejected the message because it contained a phishing scheme:
The first thing they could do is to publish SPF records for their domains. And not the ones that end in "~all" ("and accept any other IP, in case we forgot one") like AOL, HOTMAIL, and many other sources whose domains are faked constantly use. The ability to tell your users "Hey, this didn't come from who it is claiming to have come from" is a start. But PayPal, eBay, and most banks I've seen scammed have no inkling of how a simple change to their DNS would protect them and their customers.
The second thing would be to tell their web servers to not serve images up that have the wrong referrer. Hey, referrer checking isn't 100%, but any time you have an image request from a victim of one of these scam mails, it would be a lot better if that picture had "THIS IS A FRAUD MESSAGE" overlayed on it. It would force the scammers to go back to hosting the pictures on the scam site, which is a harder to do than simply uploading a single script to a slightly-insecure website in Brazil or Ohio. And the emails are as legitimate looking as they are because they use the scammed bank's own graphics, from their own servers!
Just before I started working at my current job, our webserver was hacked and used as an ebay phishing site. It didn't take long before our offices were getting personal calls from agents at the FBI and urgent contact from the ISP who runs our node.
Suffice it to say we took action ASAP. I have a feeling they would have forced us to do something about it if we dragged our feet. I'm assuming they do the same for other reports they receive.
-Ryan
AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
I've been referred to you by FedEx tech support, with the case number above.
Attached is an obvious phishing scam using the FedEx name. It has the usual hallmarks of a phishing scam:
1. A forged return address "aroundtheworld@fedexemails.01o.com", while it was actually sent from "snd6222.britecast.com". (This, of course, is a criminal violation of the CAN-SPAM act.)
2. Phony links to fake sites: the link supposedly to "nba.fedex.com" actually goes to "http://fedex.00b.net/ajtk/servlet/JJ?H=h3cq6&R=28 6452495".
So this is a clear phony.
The real concern is that the sender of this message has some information about our FedEx account. The message contains the line
"All shipments must be paid for with your FedEx account number ending in 811."
That is in fact from our valid FedEx account number. So FedEx appears to have a security breach; account numbers have leaked to a scammer.
Full message source appears below.
Please let me know immediately if we need to cancel our FedEx account because of this security breach. Thank you for your attention to this matter.
FedEx reply:
Dear John:
We received your inquiry. Thank you for contacting FedEx. We apologize for the inconvenience.
We would like to inform you that you may need to contact your local FedEx Account Executive so they can further advise you of what you need to do regarding the status of your account.
We hope this information is helpful. Again, thank you for contacting FedEx.
Note that they've referred me back to the part of FedEx that referred me to them. So that's FedEx, clueless.