The short tale of an online scam • Hacker News Board

Re: The short tale of an online scam

#61

Post by flutas » Thu, Jul 01, 2021, 5:09 PM UTC

pineapple128 wrote: post #52

egman_ekki wrote: post #45

Since most card transactions these days require strong authentication and this is done in Denmark via NemId, which requires second factor (either an app or a key card sent to individual's officially registered address), I wonder what their game plan is. They could use up all your codes and steal the key card from your mailbox, but otherwise I'm not sure... Maybe they wanted victims to pay for 'shipping' the item, but…

The phishing scenario in the article allows the malicious actor to impersonate the victim simultaneously, while asking the victim for any 2FA codes. The attacker can be a man-in-the-middle and make the victim authorize a costly transaction (say $100), with the victim seeing a cost of $1. These is an example video here: https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.htm... Of course, the real transaction can…

I'm US based, so not sure on the exact details of the payment system.

But since the article mentions confirming the bank balance, couldn't that be basically sending a pay request for the entire bank account balance?

Re: The short tale of an online scam

#62

Post by aand » Thu, Jul 01, 2021, 5:13 PM UTC

weinzierl wrote: post #22

> "Also, (2) if you want to protect other people from falling victims to scams like these: tell them to always look at the url bar. Always." This is good advice, as things stand right now, it is in fact the best advice we can give. In absolute terms it is borderline useless advice. Many companies still communicate from and operate from domains other than their well-known main domain. How is anybody supposed to know t…

Until they build a fake Chrome window with the correct URL... https://twitter.com/chokotrix/status/1376979077748375553

Re: The short tale of an online scam

#63

Post by Jolter » Thu, Jul 01, 2021, 5:17 PM UTC

arch-ninja wrote: post #55

> In an attempt to add some confusion to his operation, I decided to create a little script. This little script would send him about 5000 different combinations of the above parameters in a completely random fashion. Fun. I've done this with college scammers requesting email + passwords, loads of fun. Would highly recommend as it turns an O(1) operation (db full of valid stolen credentials) back into O(n) (randomly g…

You’re assuming they don’t store a time stamp with the DB entries. It would be fairly trivial to filter out the 5000 fake entries that all arrived within a minute of each other.

Re: The short tale of an online scam

#64

Post by willstrafach » Thu, Jul 01, 2021, 5:35 PM UTC

slugiscool99 wrote: post #60

What's going on with .icu domains? Any idea on why they've been so prone to spam?

.icu, .club, and a few other gTLDs can often be found for sale at $1-2/year, so they are used by entities in need of low cost disposable domains.

Re: The short tale of an online scam

#65

Post by pwned1 » Thu, Jul 01, 2021, 5:40 PM UTC

mnd999 wrote: post #3

Namecheap. Surprise. They seem to be the preferred DNS provider for this sort of thing.

99% of the phishing domains that target my company's site come from Namecheap. I don't know why they can't get their act together when it comes to fraudulent domain registration.

Re: The short tale of an online scam

#66

Post by xsmasher » Thu, Jul 01, 2021, 5:47 PM UTC

isolli wrote: post #21

"always look at the url bar" I remember reading about a scam where the URL seemed legit, and the suspicious part was pushed after so much white space that it was no longer visible in the URL bar. I don't remember the details and I'd be curious to know if anyone remembers it. I remember even sophisticated users saying they might have fallen for it.

I've seen that with an @ symbol.

http://www.amazon.com@192.168.0.1/login

Re: The short tale of an online scam

#67

Post by Abishek_Muthian » Thu, Jul 01, 2021, 5:55 PM UTC

weinzierl wrote: post #22

> "Also, (2) if you want to protect other people from falling victims to scams like these: tell them to always look at the url bar. Always." This is good advice, as things stand right now, it is in fact the best advice we can give. In absolute terms it is borderline useless advice. Many companies still communicate from and operate from domains other than their well-known main domain. How is anybody supposed to know t…

Two days back I searched for Indian Govt. Tax website in Google(It had changed the website recently) after DDG did not produce desired result and logged into one of the top results.

The password manager didn't suggest my password, I attributed it to recently changed website domain or site quirk and quickly copied my password from the manager to the site only to get SSL certificate revoked notification.

I have logged into a phishing site mimicking the old url of Indian Govt.'s tax website. I quickly tweeted out to some journalists[1], The website went down soon enough.

I've never been phished before AFAIK(This wasn't targeted, I've protected myself from couple of targeted attacks & helped several others in the past) and even though this is embarrassing I want to state couple of reasons why my usual rationale didn't work this time.

1. The new tax website being quirky(to say the least) was on news constantly and my CA kept complaining about it for past several days. I expected a quirky website even before I logged in. Even our Finance Minister had complained publicly to the Chairman of Infosys(Who developed it) on Twitter about the issues with the site days earlier.

2. I made couple of prior searches in Google as I didn't get the website where there was login, So I think Google produced less trustworthy results on my final attempt. I've noticed this happen in the past as well in the Google i.e. When you enter the same search term couple of times, 3rd or 4th results are not same as 1st in the front page.

3. The muscle memory to check https and URL didn't help much as the site had SSL and the URL was close enough to old IT website's unmemorable subdomain URL. The 'filing' was 'filling', Domain was co.in instead of gov.in. (Which of course I didn't notice).

4. Password manager not working should've caused me to check the domain again, But (1).

I presume this was intended sequence of the events for the scammer, Especially since many are searching for old Income Tax website. But I never expected the phishing site to make it to Google front page this soon.

[1] https://twitter.com/heavyinfo/status/1409761416865746956

Re: The short tale of an online scam

#68

Post by aeorgnoieang » Thu, Jul 01, 2021, 8:01 PM UTC

3np wrote: post #16

An obvious red flag for me is always an opening message with "I'm interested in X", where "X" is verbatim copied off the title of the ad.

I think I do that, on the off chance that a person might have multiple listings, and my general preference for precision. I probably also figured it'd be easier for them to know what I was referencing if I used the exact same text.

Re: The short tale of an online scam

#69

Post by aeorgnoieang » Thu, Jul 01, 2021, 8:05 PM UTC

TheFreim wrote: post #34

tialaramex wrote: post #6

Earlier quoted context omitted.

Lots of scams want your bank details. Unlike with SMS 2FA where the phone company never offered their service as a magic universal authenticator, the scammers want your bank account because it's a bank account. To the extent such scams work, we should be pretty unequivocal that it is your bank's fault. Banks are always reluctant to put their hands in their pockets when it comes to meaningful security. Whereas merchan…

My bank thinks banning right click on their site and disabling default inspect element is security. I'm sure making it annoying for me to copy the routing numbers is really going to help out.

That's weird. I'm pretty sure routing numbers (the bank portion) in the U.S. are all public anyways. I've been routinely looking-up my bank's routing number via Google for a while!

Re: The short tale of an online scam

#70

Post by TheFreim » Thu, Jul 01, 2021, 8:14 PM UTC

aeorgnoieang wrote: post #69

TheFreim wrote: post #34

Earlier quoted context omitted.

My bank thinks banning right click on their site and disabling default inspect element is security. I'm sure making it annoying for me to copy the routing numbers is really going to help out.

That's weird. I'm pretty sure routing numbers (the bank portion) in the U.S. are all public anyways. I've been routinely looking-up my bank's routing number via Google for a while!

They are public, it's just that the easiest way to copy it is to go to the banks website.