This is really interesting, though I can't see it exploited very widely in everyday use.
An Innovative Phishing Style
21–30 of 83 posts
Re: An Innovative Phishing Style
#22Apparently Cloudflare doesn't require a credit card to sign up for the free plan. Not that scammers couldn't figure out how to provide a credit card that wouldn't trace back to them.
Why would it require a credit card to sign up for the free plan? To "prevent" scams and abuse?
Re: An Innovative Phishing Style
#23Doesn't OAuth and similar work by redirecting you to the login page? I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).
At most 10% of the target audience (and that's a generous upper bound) are going to have the deep understanding of web technologies that is required to make those deductions. And even if they do, not all of them are going to realize this in that particular moment. (For instance, it didn't immediately occur to me while reading the article.)
Oh, I wasn't expecting people to make the deduction I made.
There was a time when popups were considered malicious by nearly everyone (my mother would have seen this as suspicious during that time).
Thanks to popup blockers this feeling seems to be fading, and I see no reason whastoever to not cultivate it again.:
"Unless you are already logged in to a website you trust, any popup means that this website cannot be trusted. Contact someone you trust to check it if you really really need to use that site."
Re: An Innovative Phishing Style
#24Hey, Russian detected in HTML/JS code. Takedown notice has to be issued from skins.cash.
Re: An Innovative Phishing Style
#25Doesn't OAuth and similar work by redirecting you to the login page? I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).
OAuth flow can certainly open a popup (or new tab if that's how your browser is configured). After you login it will use a redirect but that might be hidden from the user.
Pop-up blockers don't work when the user clicks "login".
It's not suspicious at all and I would say best practice. In any case, you always need to make sure the domain is trusted. That's a lot easier if your browser puts all windows in tabs.
Re: An Innovative Phishing Style
#26Browsers should implement some mechanisms to combat this type of phishing. I've gone ahead and reported this as a phishing site on Google safe browsing and other services.
> Browsers should implement some mechanisms to combat this type of phishing. combatting this doesn't require browsers - you can have a passwordless login mechanism (like email links!). Or, if browsers do indeed want to combat issues such as these, we'd need support for client-side certs (so you can login using a key-pair!), rather than username/password. Or, rely in a tool like lastpass to consistently enter the cred…
The problem with e-mail links is that if the e-mail inbox gets hacked the hacker now has access to all the user's services.
Re: An Innovative Phishing Style
#27Thanks for the good writeup. This technique however is not new, as others have mentioned. If you look at this phishing site on the "Similar Pages" feature on https://urlscan.io you can see a bunch of other phishing pages with similar themes (gaming / skin customisation) that employ the same phishing kit, going back five months: https://urlscan.io/result/24dc54ec-2008-4fe1-b526-4a25fca25f...
Some example domains: skinssoul[.]com, skinsnecro[.]com, dotaskins[.]eu etc...
Re: An Innovative Phishing Style
#28Doesn't OAuth and similar work by redirecting you to the login page? I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).
I don't recall ever seeing a version that
opens a popup to get you to login.
[1] https://developer.paypal.com/docs/classic/adaptive-payments/...
Re: An Innovative Phishing Style
#29Earlier quoted context omitted.
Yeah, and this one isn't any better in that regard. Was just examining it on a Mac, where it uses the same Windows UI style. One should think that malware authors would have already implemented some JS library of sorts for their fake popups that fakes Windows, MacOS and Linux UI styles more convincingly. Especially since they've applied serious thoughts to other parts of the fake, like the language chooser in the fak…
Unthemed Windows & Mac OS will be convincing to a lot, Linux will be pretty hard. Then again those who tinker with their computers are unlikely to fall into this trap.
This specific phishing website mimics an ingame website for Counter-Strike Global Offensive, a shooter game with the vast majority of players using Windows. Linux isn't supported at all and while the game technically runs on a Mac most people don't (or play it with Bootcamp).
I would not be surprised if 99% of the audience for this website is using Windows, the vast majority with default themes (and the ones without either won't notice this or think Windows is buggy when a popup shows the default theme).
Re: An Innovative Phishing Style
#30Apparently Cloudflare doesn't require a credit card to sign up for the free plan. Not that scammers couldn't figure out how to provide a credit card that wouldn't trace back to them.
Why would it require a credit card to sign up for the free plan? To "prevent" scams and abuse?
It's a common sales technique. People are willing to give their CC details for a free plan since they are not charging anyway. But by the time your site grows, this takes away the friction of switching to a paid plan. Mailgun does the same.