Obfuscated JavaScript, scam emails, and American Express
1–10 of 16 posts
Re: Obfuscated JavaScript, scam emails, and American Express
#2I wonder if scammers are intentionally misspelling subject lines because most security savvy people will just delete those as obvious scams and move on. This would have a two pronged effect:
1. it would filter out security savvy individuals from the actual payload, who might report the scam.
2. it would map to the least security conscious individuals who would be the most likely to fall for it.
Re: Obfuscated JavaScript, scam emails, and American Express
#3I wonder if scammers are intentionally misspelling subject lines because most security savvy people will just delete those as obvious scams and move on. This would have a two pronged effect: 1. it would filter out security savvy individuals from the actual payload, who might report the scam. 2. it would map to the least security conscious individuals who would be the most likely to fall for it.
Yes. See "Why Do Nigerian Scammers Say They are From Nigeria?"
https://www.microsoft.com/en-us/research/publication/why-do-...
Re: Obfuscated JavaScript, scam emails, and American Express
#4So in the end, what does the obfuscated JS do?
Re: Obfuscated JavaScript, scam emails, and American Express
#5So in the end, what does the obfuscated JS do?
It's a triple encoded payload that loads in a large HTML blob onto the page. The payload is 99% similar to Amex's actual page, it just submits the data to the attackers domain, and has a few extra fields like mothers maiden name, elementary school, etc.
The purpose of the obfuscation is 1) to prevent automated scanners and 2) prevent debugging of the script.
Since we did static analysis it did not impact the result.
Re: Obfuscated JavaScript, scam emails, and American Express
#6So in the end, what does the obfuscated JS do?
[deleted]
Re: Obfuscated JavaScript, scam emails, and American Express
#7So in the end, what does the obfuscated JS do?
It's a triple encoded payload that loads in a large HTML blob onto the page. The payload is 99% similar to Amex's actual page, it just submits the data to the attackers domain, and has a few extra fields like mothers maiden name, elementary school, etc. The purpose of the obfuscation is 1) to prevent automated scanners and 2) prevent debugging of the script. Since we did static analysis it did not impact the result.
I guess the few extra fields, gets them the possible security question answers for account takeovers
Re: Obfuscated JavaScript, scam emails, and American Express
#8The next logical step after finding where the data is sent, is to use a script to fill the phisher's database with rubbish... there are sites like https://www.fakenamegenerator.com/ which will help you create fake-yet-plausible identities.
I remember many years ago I was sent a keylogger. I reversed it, found it was configured to upload keylogs to an FTP server on a free webhost, and promptly replaced the existing contents of it with as many copies of The Bible as would fit in the few MB of space available.
Re: Obfuscated JavaScript, scam emails, and American Express
#9I wonder if scammers are intentionally misspelling subject lines because most security savvy people will just delete those as obvious scams and move on. This would have a two pronged effect: 1. it would filter out security savvy individuals from the actual payload, who might report the scam. 2. it would map to the least security conscious individuals who would be the most likely to fall for it.
Yes. See "Why Do Nigerian Scammers Say They are From Nigeria?" https://www.microsoft.com/en-us/research/publication/why-do-...
That page seems like it used a lot of fancy language to say something that could be said in two sentences.
Re: Obfuscated JavaScript, scam emails, and American Express
#10Earlier quoted context omitted.
Yes. See "Why Do Nigerian Scammers Say They are From Nigeria?" https://www.microsoft.com/en-us/research/publication/why-do-...
That page seems like it used a lot of fancy language to say something that could be said in two sentences.
What are the two sentences so I don’t have to click the link?