Phishing Site Using Valid SSL Certificates

UnderAttack writes to tell us the Washington Post SecurityFix blog has an interesting article about a new and rather sophisticated phishing scheme. The email not only used the first few digits of the users card number to look more plausible (even though the first part of the number is the same for all cards), but it also used a valid SSL certificate for its domain name."

Comments

In other news - Stupid People Still Stupid

[Anonymous Coward]

If you get scammed on the intarweb, your intarweb license should be revoked.

Clues for phishers from Geotrust

[14erCleaner]

From TFA: Mp> Geotrust has a rigorous process in place to check for phishy certificate requests that relies on algorithms which check cert requests for certain words, misspellings or phrases that may indicate a phisher is involved. In this case, she said, the technology did not flag the request because there was nothing in the Internet address to indicate the site was at all related to a financial institution.

If they rely on misspellings, they'll only catch the dumb phishers. They're generally the ones that don't catch a lot of people anyway, or at least not anybody who doesn't deserve to be scammed.

Geez...

[razzamatazm]

Soon all the good ideas will be taken and I'll be stuck selling penis pills again. Ugh...

Re:That's why I don't click html links...

[Anonymous Coward]

...and also why I hate html email and use pine as my mail client.

A fellow pine user! I think that makes 25 of us!

Just call up and ask for the (finger|thumb)print!

[Goyuix]

You have never truly had fun with the support staff at your bank/credit union/credit card/whatever until you have called and asked them to verify the thumbprint/fingerprint of their SSL cert for you.

Unfortunately, it looks like Geotrust lost this round, and it probably would be considered good practice to actually do that from time to time. For the truly paranoid, remove all root certificates, and only after verifying the thumbprint proceed to install that cert into your cache. No more trust hierarchy.

Gotta hand it to these guys

[Douglas Simmons]

I am very impressed that in spite of all the money there is to be made and all the money that gets lost as a result of loose security, and all the time that has passed for people to cash in on this huge demand for iron clad software, that the AOHellers out there keep coming up with ways to steal cards by getting around new deterrents. I mean, great security is something credit card companies and online services have been marketing themselves upon, spending lots of cash-money for these campaigns... they might as well come through with security a la openbsd.

To add to this craziness, the culprits behind these accomplishments, in this case certificate hacking of all things, are brilliant enough to get ultra-high paying jobs and hire a nude secretary. With this new age of cyber-terrorism threats, I gotta side with the pro-hacker mantras claiming that they help the world by exposing threats with mostly benign things like pbrushing a hitler mustache on Bush before the real bad guys, the ones who have similar high levels of expertise [though in bombs], figure out the holes. High five, 31337-speakers.

Re:That's why I don't click html links...

[Anonymous Coward]

Ah, for the days when you could finger someone when she wasn't even in the same room with you! And if you didn't ask first, that was okay -- she wouldn't mind.

These days, it's all about safe hex. You start talking about fingering, and everyone tells you SSH!

Re:un-possible!

[Anonymous Coward]

public JavaRulesRubySucksLargeNiggerCocks {
    public static main(String[] args) {
        while (true) {
            System.out.println("Ruby users suck dirty nigger-cocks.\n");
        }
    }
}

Nice try, but I can tell you're trolling

[rsilvergun]

you spelled 'intarweb' right both times.

Re:That's why I don't click html links...

[93 Escort Wagon]

"...users are capable of doing it if they weren't ignorant. 10 years ago when GUI mail readers barely existed... Windows is to blame for dumbing down our computer users to the point of being completely incompetent when it comes to dealing with a non-clicky-clicky interface."

Congratulations! You've earned extra Slashdot Coolness Points for 1) slamming Windows; 2) insulting the average user; and 3) being blissfully unaware that most normal people actually prefer a GUI interface!

Re:That's why I don't click html links...

[heinousjay]

Yeah, I don't know where people get off not doing things your way. I can't imagine why people would prefer to use a GUI. The more natural interaction, superior information organization, and overall higher visual appeal can't have anything to do with it. It must be ignorance.

(in keeping with a prior story, can anyone guess the intended tone of my post?)