Someone got this Facebook phishing attempt the other day. Lets check it out, first I'll explain some tell tale signs that make this a phish attempt, then I'll address the response. All I have is a screenshot to start with.
message screenshot:
A good first check to see if something is malicious is to Google the message text in quotes, usually just the first ten words or so. Think of it as crowd sourcing the reputation of something and it works well with, a text message, an email message, or even the title of software. When the results are negative in the first few pages we can safely assume it is malicious. Below you will see some results and with all ten hits negative or describing some phishing and or scam.
google-search: "your account has been reported by other users, and"
One thing that makes this message suspicious is the odd characters for "Message Facebook" this is supposed to be the user who sent the message, so possibly an account was hacked or created, and they used different language characters for the user name to get past Facebook filters. Another possibility is someone is injecting messages by maybe a replay attack, but I haven't researched this.
Assume the message is real and think about the language, "If you still want to use your account, please confirm your facebook account below." One, the lowercase "facebook" would most likely get fixed by editors. Two, the odd logic of the language is why would I need to confirm my account when it is either hacked by criminals, I'm violating the rules on purpose, or I accidentally violated the rules. Confirming my account does not help or change anything from Facebook's point of view. A conformation of an account should go through a predefined way of communication that only the user would have access to, like email or text message on a cell phone.
Another tip off is the URL, which doesn't look like a Facebook domain.
hxxp://sadasdw[dot]ucoz[dot]org/Help_Confirm_Your_Facebook_Account[dot]user[dot]htm
Checking whois we see the registrant is Compubyte Limited in the British Virgin Islands, just a provider of some sorts, so move on.
Another safe way to look at a site is to use the Wayback Machine which creates an image of the site like a historical reference. It's little use in this situation because you won't see source code, but I figured it would be good to mention. Checking the Wayback Machine gives us no results because of robots.txt, meaning the site asks web crawlers or bots not to index the site.
credentials = hxxp://rahmat02[dot]altervista[dot]org/gowa/
statistics = hxxp://openstat[dot]net/ and hxxp://mc[dot]yandex[dot]ru/watch/
counter = hxxp://counter[dot]yadro[dot]ru/hit
To help you understand what a credential harvester looks like below are the screenshots of the entire process.
Entering info on the last pages redirects you to the real Facebook log in.
This is an old harvester and probably auto generated. There are ways of creating much better harvesters that look almost exactly like the real Facebook. Now you are aware of what harvester can look like so you can avoid being duped.
_________________________________________________________________________________
Incident Response
Now you, your kids, or someone in your company has made a boo boo, they went to the site and filled out the all the questions. What do you do?
- Praise whoever reported the incident particularly whom ever fell for the phish.
- Make detailed notes of all information "lost," meaning we lost control of information where otherwise shouldn't have. Below is the list for this example.
- email address
- email password
- web mail client
- web mail password
- date of birth
- security question and answer
- country
- first and last name
- credit card number
- credit card type
- credit card expire date
- credit card security code
- billing address
- billing country
- facebook log in
- facebook password
- Now remove the items that are public, or can't be changed. Below are the items we will remove the list, why not respond, and some alternatives solutions that will better protect you.
- email address
- Even if you go to great lengths to hide your personal or business email it is still public so migrating to a new email address is overkill.
- web mail client
- What you use for a web mail client could open avenues for social engineering and vulnerability exploits, but hiding what you use will not stop the attack, instead focus on recognizing when the topic comes up over the phone, email and other communication where the speaker is not immediately identifiable.
- Patch your software and proper monitoring will prevent vulnerability exploits.
- date of birth
- Your date of birth is public information with several databases keeping track, plus your mother cannot re-birth you so don't worry about it.
- country
- The country you are in is public information.
- first and last name
- Your name is public information nothing to do here
- billing address
- Your billing address is public information and moving is overkill, but you can keep an eye your credit report and bank accounts see Check Your Accounts
- billing country
- The country you are in is public information, and moving to Timbuktu is a little crazy.
- facebook log in
- At the time of this blog you cannot change your Facebook log in, instead change your Facebook setting to use a different email publicly and only use a private email for log in purposes.
- The above list is little to worry about, below are the major concerns for this situation, change or report stolen all of them.
- email password
- web mail password
- security question and answer
- Regarding the security question, this is a good example why I recommend lying for all your security questions and never reuse the same question, see How to Choose a Password.
- credit card number
- credit card type
- credit card expire date
- credit card security code
- facebook password
- Now the incident is mitigated we now need to concentrate on the final step continuing education. Below are some suggestions on education in the enterprise atmosphere.
Teach enough details to the person whom was phished to give a 10 minute class on the incident, and include some technical and personal advise. They will be nervous giving a class so the Security Engineer, Officer, or Analyst should be supportive at all times and act as a teaching lead to answer complicated questions and keep the class moving. Most of all keep it simple, generalize the situation (don't include security sensitive details), and record the class for future use.
In my experience people will remember and respond better to a fellow employee giving the class. If the same Security Engineer Officer, or Analyst is always giving the classes it can become a mundane task, which leads to blank stares.
To make it more personable relate the situation to home use for the company personal. When possible allow the employees to share the class video with families. The more you show people how it can affect them at home, the better.
No comments:
Post a Comment