full-disclosure - Paypal Phishing Again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu May  5 13:45:02 2005
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Paypal Phishing Again

Jeremy Heslop wrote:

<<snip>>
> :) Like some others have pointed out on this list (or Bugtraq) they are
> priming the pump so to speak by sending out alot of legit looking Paypal
> emails so that people get used to them coming. Then they will start
> sending more emails with redirected/phished links contained instead of
> the real ones.  Just my "not worth much" 2 cents.

Huh???

You didn't look too closely at that one did you?

When rendered in an HTML-capable MUA, the message has a link or button 
that looks as if it takes you to the (once) "legitimate" Paypal login 
page at:

   https://www.paypal.com/cgi-bin/webscr?cmd=_update

In reality, clicking that link led to a now long-closed page (this 
particular phish was spammed nearly three weeks ago) hosted at 
netfirms.com via a triple redirection (Yahoo! to Google to Yahoo! to 
netfirms) cleverly constructed with HTML form submission logic so that 
the full URL is not actually present in one piece in the HTML code.  
(It also uses some further obfuscation of parts of the URL by inserting 
entity-encoded HTML white-space characters.)

So, your take that this was a "non-malicious" phishing precursor is 
quite wrong.

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3267092