You could be seeing a great picture here
_

Charles on… anything that comes along

Monday 29 November 2004

Filed under: — Charles @ 12:08 pm

Post-modern phishing

Lovely little phishing scam arrived the other day:

To provide our customers the most effective and secure online access to their accounts, we are continually upgrading our online services. As we add new features and enhancements to our service, there are certain browser versions, which will not support these system upgrades. As many customers already know, Microsoft Internet Explorer has significant ‘holes’ or vulnerabilities that virus creators can easily take advantage of.

In order to further protect your account, we have introduced some new important security standards and browser requirements. SunTrust security systems require that you test your browser now to see if it meets the requirements for SunTrust Internet Banking.

Please sign on to Internet Banking in order to verify security update installation. This security update will be effective immediately. In the meantime, some of the Internet Banking services may not be available. (Don’t worry, the URL is safe to click on.)

Lovely, isn’t it? Get the punters worried about one thing so they don’t spot where you’re taking them with the other. Classic magician’s trick. And all spelt correctly too.

The compromised machine being used to host this site is at 82.90.165.65 (in the subdirectory /s). It’s in Italy and has open ports all over the place; you can even FTP into it but I couldn’t get a listing. (It’s a Windows machine.) Anyone care to see if they can get any further?

2 Responses to “Post-modern phishing”

  1. Crawford Says:

    It comes to something when the ‘bait’ of a ‘bait and switch’ is the security concern around Microsoft. No other industry would tolerate this…as an almost all pervasive product surely this lack of integrity needs a much more enforced response?

  2. James Says:

    What intrigues me about this one is that it tries to trick you into trying correct something that hasn’t happened yet, but will if you take the bait!


    Dear eBay User,
    We regret to inform you, that we had to block your eBay account because we have been notified that your account may have been compromised by outside parties.

    Our terms and conditions you agreed to state that your account must always be under your control or those you designate at all times. We have noticed some activity related to your account that
    indicates that other parties may have access and or control of your information in your account.

    Please be aware that until we can verify your identity no further access to your account will be allowed.As a result,Your access to bid or buy on eBay has been restricted.To start using your eBay account fully,Please uptake and verify your information by clicking below

    http://signin.ebay.com/aw-c gi/eBayISAPI.dll?Verify

    Note the in the url (that’s just how it looked viewed in OE as text-only)

    The real url is http://signin_ebay_com_account.ministop.co.kr (220.85.13.40, in Korea)

    James

Leave a Reply

Powered by WordPress