Slashdot Mirror
Phishing Site Using Valid SSL Certificates
UnderAttack writes to tell us the Washington Post SecurityFix blog has an interesting article about a new and rather sophisticated phishing scheme. The email not only used the first few digits of the users card number to look more plausible (even though the first part of the number is the same for all cards), but it also used a valid SSL certificate for its domain name."
Seriously. I remember in the early 90s, tv ads for banks that ended with "...and remember, our staff will never ask for your credit card number over the phone." I think people *eventually* got the message on that one. How long will it take online? Remember, unsolicited email that links to a website ready to take your credit card number is bullshit, mom.
Did people honestly think that their techniques were going to get worse rather than better?
Ryan - http://www.thecosmotron.com/
Proving once again the relative lack of worth of requiring SSL certificates to be signed. All it does is make a few companies rich.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
...and also why I hate html email and use pine as my mail client. Unfortunately, most people don't know enough to not click html links sent to their email account. As a result, this is especially worrisome because it looks legit.
These phishers are getting more and more sophisticated, but it's only a matter of time before they're caught. To get more sophisticated requires better services and equipment, which requires the phishers to either:
a) Give out their true information - name, address, etc, making for easier law enforcement tracking
b) Give out flase information - which may buy them some time, but will only cause the bite taken out of their ass by law enforcement to be that much bigger.
Even still, Valid SSL certificates and whatnot don't mean shit against a true savvy user who knows better. Any user who actually reads the warnings by their banks/credit card companies/etc will know that said companies will never send emails asking for credit card information.
Frink: Nice try floyd, but you were designed for scrubbing, and scrubbing is what you shall do.
Beyond the cert saying the business was in Salt Lake City Utah, I don't really see how there was some big confidence broken here. The SSL cert was issued for "www.mountain-america.net". The bank in question is "www.mtnamerica.org". Whoever thinks that a signed SSL certificate is supposed to verify anything other than the person/entity asking for the cert is the same person who owns the domain is assuming waaaay to much.
In essense signed certs are only supposed to protect from a man-in-the-middle attack, not someone being fooled into going to a similarly named website. Why shouldn't I be able to get a signed cert for mountain-america.net if I own it? There's plenty of similarly named legit businesses that all have certs issued to them.
AccountKiller
the ssl cert companies don't verify who you are, just who you say you are
they're in it for the buck. why would they go that extra mile when it just cuts into their bottom line?
vodka, straight up, thank you!
You know, if that SSL certificate traces back to a valid human, then you can arrest him/her for phishing and they've provided all your evidence for you.
It's like leaving your digitally signed confession at the scene of the crime. No CSI team needed. Only the crooks know the corresponding private key.
If you can't trace that certificate it back to a valid human, than the CA needs to be beaten with a large stick.
...or maybe not.
You mean people would never give out credit card numbers, when asked over the phone? I think you place too much faith in humanity.
Most people would agree it's stupid, and fewer people will behave stupid after an education campaign (or after being bitten in the ass). Scam artists may not bother anymore with a certain method. But not because it wouldn't work; but because they've moved onto easier methods, methods that (these days) give them more return for their effort.
For the same reason, e-mails with attachments like "Anna Kournikova.jpg.pif" will keep getting clicked on. You may think it's silly, but there's a new sucker born every day.My question is: Did these dogs give equifax enough information for the cops to have some hope of tracking them down? I'm guessing that at least some of this information is faked, but if there's nothing here that the cops can use, then the identity information in SSL certificates is less than worthless.
Free Software: Like love, it grows best when given away.
They're generally the ones that don't catch a lot of people anyway, or at least not anybody who doesn't deserve to be scammed.
You know, I hate hearing that anybody deserves the financial ruin that results from falling for one of these scams.
Remember, the more that geeks put on the "you're stupid so you deserve what you get" attitude, the fewer folks who are less-computer-savvy will buy computers for fear of being taken for a ride (and knowing no one will help them.)
This, in turn, results in less money floating around in the tech sector, which, in turn, results in less money being invested to develop convieniences upon which we have come to rely - such as online banking.
Which, of course, results in less money in the pocket of the geeks that were so callous to begin with. Remember - we NEED the end user just as much as the end user needs us.
I hope the land around you yields, a crop like all the other fields, and then your waiting might make sense...
Take Commerce Bank. They have CommerceOnline.com for their main domain and CommerceOnlineBanking.com for their online banking. But why not CommerceBankHome.com as GoDaddy suggest? Or CommerceBanking.com? Or CommerceBankingOnline.com?
Unfortunately their domain names are a soup of common names and it's impossible to remember. With common names, a small alteration of the site and that's all you need to confuse some folks.
The best phishing URL I've ever seen was one that was www.amazon.com.exec-obidos.com. If anyone remembers, previously Amazon URLs always had an exec-obidos in their path when the link lead to a product. Even I had to blink a few times before I realized it was a phishing scam. (All the links went to a working Amazon section).
Small potatoes make the steak look bigger.
They have your phone number.
They have your address.
They can send you a letter, they can call your phone. And their phishing rate would drop to almost zero.
IE used to have a bug where they would check the revocation list for every domain except microsoft.com. Worked well until someone walked into VeriSign's office one day impersonating Microsoft and walked out with several signed certs for microsoft.com. Hee hee. I don't know when MS fixed this, but as I recall they weren't in a big hurry to issue a patch.
If the domain name of the website you're visiting is correct, and you didn't get an SSL error, you know for sure that you're connecting to the right server, and your communication to the server won't be modified or eavesdropped in transit.
What's going on with this phishing site is that they have a bogus domain name, which unfortunately is good enough to fool people. If you know know that your bank's website is citibank.com, not secure-citibank-website.com or something like that, you will never fall prey to this. You're wrong that a check would not have done any good.
And a "self-signed" cert is useless because a man-in-the-middle could issue his own "self-signed" cert and just replay traffic between the client and your server.
Hands in my pocket
Let's quote what Geotrust says about relying on certificates:
GeoTrust's solution is that the browser should display ...
"The name and logo of the CA who issued the certificate. Consumers will soon learn from news reports which CAs to trust and which CAs use sloppy procedures and should not be trusted."
We should take Geotrust at their word. Now that we're certain that their procedures are sloppy and they can't be trusted, their certs should be pulled from all browers. New releases of Firefox should not contain root certs for Geotrust. They had their chance, and they blew it.
Well, yeah, why wouldn't you assume that? In fact, there's no need to examine it to try to prove otherwise, just go to your online banking site (which, it doesn't take a genius to bookmark when you sign up for it), if the bank wanted to tell you something, you'll be notified there too.
What, are you saying I should also assume that the letters I get telling me I won 10 million dollars are not real either?
sic transit gloria mundi