At 5:03 I received an email from DigitalOcean that my account has been disabled due to suspicious activity. Cool, that's what you'd expect them to do...Right?...Right?! Well, some may think otherwise after this.
It turns out this was a phishing email. This particular simply-put message made me think I had received a genuine message from DigitalOcean.
On mobile, the message looks like this:
Look at how stupid simple this looks. Don't you just instantly think "huh, maybe someone got into my ill-secured droplet"? And the sender: many of us know you can fake the sender name, but the actual email can't be. Here, I instantly assumed the email was "customer-support@digitalocean.com".
Anyway, I just want to bring it to people's attention because it's so stupid simple. Here's why I think it was effective (and will be more diligent on these weak points):
1. The wording is clear and well written.
2. The action said to have been taken is something super believable.
3. The email is super cut-off on mobile clients.
4. There was nothing other than the outgoing link that signaled warning bells in my head. It's actually the "are you sure you want to go to..." message that popped up that killed the illusion.
Had this been on desktop, it becomes blindingly obvious:
Note: I consider this phish successful because it got me to click the link. Luckily, again, the browser asked me if I wanted to navigate away, which saved me from navigating any further.
I've taken further investigation though, because clever phishes deserve to be looked into.
Turns out war-lords.net is a gaming community:
I'm assuming they may do a little more than gaming. Someone else can continue on this path.
I decided to look at the behavior of the URL given by the email using wget:
I'm not sure what the point is of this hoop-jumping but I'm sure it is common in phishing attacks.
The actual payload is just your typical enter-your-credentials type of phish (I safely went here in a new FireFox profile):
I inspected the code fetched with wget before loading the web page just to be sure about what I was getting myself into.
It turns out this was a phishing email. This particular simply-put message made me think I had received a genuine message from DigitalOcean.
On mobile, the message looks like this:
Look at how stupid simple this looks. Don't you just instantly think "huh, maybe someone got into my ill-secured droplet"? And the sender: many of us know you can fake the sender name, but the actual email can't be. Here, I instantly assumed the email was "customer-support@digitalocean.com".
Anyway, I just want to bring it to people's attention because it's so stupid simple. Here's why I think it was effective (and will be more diligent on these weak points):
1. The wording is clear and well written.
2. The action said to have been taken is something super believable.
3. The email is super cut-off on mobile clients.
4. There was nothing other than the outgoing link that signaled warning bells in my head. It's actually the "are you sure you want to go to..." message that popped up that killed the illusion.
Had this been on desktop, it becomes blindingly obvious:
I've taken further investigation though, because clever phishes deserve to be looked into.
Turns out war-lords.net is a gaming community:
I'm assuming they may do a little more than gaming. Someone else can continue on this path.
I decided to look at the behavior of the URL given by the email using wget:
I'm not sure what the point is of this hoop-jumping but I'm sure it is common in phishing attacks.
The actual payload is just your typical enter-your-credentials type of phish (I safely went here in a new FireFox profile):
I inspected the code fetched with wget before loading the web page just to be sure about what I was getting myself into.
"I'm assuming they may do a little more than gaming. Someone else can continue on this path."
ReplyDeleteI wouldn't paint them with THAT brush. Php Forums are notoriously riddled with vulnerabilities, it's more likely that someone untoward has exploited them and has begun launching spam from their site.