Friday, April 2. 2004
Why does Phishing work so well?
Because our financial institutions are teaching us bad habits, and encouraging us to do the exact behavior security people are discouraging.
#1: Sites should NEVER open frameless popups for logging into secure sites. No address bar, no lock icon - perfect format for a hacker to fake. But lots do. If yours does, COMPLAIN.
#2: Banks are sending out emails that look EXACTLY like phishing scams. Don't believe me? See below: This is an ACTUAL email that got caught in the SPAM filters at work, with some snide comments from me. I talked to a very knowledgable guy in their Incident Response team. He acknowledged that this was a legitimate communication from Household Bank, and said "The marketing guys don't talk to me before they do things".
N.B.: ALL identifying information has been changed:
#1: Sites should NEVER open frameless popups for logging into secure sites. No address bar, no lock icon - perfect format for a hacker to fake. But lots do. If yours does, COMPLAIN.
#2: Banks are sending out emails that look EXACTLY like phishing scams. Don't believe me? See below: This is an ACTUAL email that got caught in the SPAM filters at work, with some snide comments from me. I talked to a very knowledgable guy in their Incident Response team. He acknowledged that this was a legitimate communication from Household Bank, and said "The marketing guys don't talk to me before they do things".
N.B.: ALL identifying information has been changed:
Headers:
From HouseholdBank@ebusiness.householdaccount.com Thu Apr 1 16:14:04 2004
Received: from ([63.111.163.37])
by smtp1.recipientdomain.com with ESMTP ;
Thu, 01 Apr 2004 16:14:04 -0500
From: "Household Bank"
Reply-to: HouseholdBank.23983542.21947.1@ebusiness.householdaccount.com
To: RECIPIENT@recipientdomain.com
Subject: Your Household Bank account balance is over the credit limit
Date: Thu, 1 Apr 2004 15:23:20 -0600
Message-ID: <1080854601594. HouseholdBank.23983542.21947.1@ ebusiness.householdaccount.com>
X-Mailer: ehouse
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="1080854601594.MimeBoundarY"
Status: RO
Things to note:
The mail is from 'ebusiness.householdaccount.com'. That's not the domain that anyone doing business with them would be used to. Trains people to not bother looking critically at domain names.
Note the email addresses include the string "23983542.21947.1" (that's random, changed from the actual numbers, same format). We'll see that string many times.
Text Format Message:
Dear Household Bank Cardmember,
This alert is to inform you that your account is currently over the credit limit and has been assessed an over the credit limit fee. You can make a payment online at www.householdbank.com or by calling the number on the back of your card to arrange for other payment options.
http://ebusiness.householdaccount.com/21764826.29261.6.234
We appreciate your business. If you have any questions please visit us online at www.householdbank.com, or contact a Customer Care Representative using the number on the back of your card.
Thank you,
Household Bank Customer Care
PLEASE DO NOT REPLY TO THIS EMAIL Replies to this email will not be received. If you wish to submit an account-related question, please login to our secure website at: http://ebusiness.householdaccount.com/23983542.21947.1.132
ABOUT THIS MESSAGE This email was sent to: RECIPIENT@recipientdomain.com. As an Household Bank Cardmember, you are receiving this account notification because you provided us your email address. Household Bank Credit Card is committed to safeguarding your privacy online. To view our privacy policy please visit: http://ebusiness.householdaccount.com/23983542.21947.1.2459
Note: Residents of CT & TX: We are attempting to collect a debt and any information obtained will be used for that purpose.
Household Bank is a registered mark of Household Bank. Copyright 2002 Household Credit Services, Inc. MasterCard is a registered mark of MasterCard International.
Comments: OK, text format messages are OK. But the URLs have identifying information - note that every URL has 23983542.21947.1 in it. Yes it makes it easy...but the easier you make it, the easier it is to fake it! Tell your clients to log in their NORMAL way, and put clearly labeled links on the website.
Here's the kicker...the html version in the email:
Note the links that say one thing, but link to a different URL. <A HREF= > links in the email that are easy to click on.
Also, when you DO click on one of the ebusiness.householdaccount.com link, you are redirected to ANOTHER domain - this time housholdbank.com. Again, training the user that changing domains is OK.
$ telnet ebusiness.householdaccount.com 80
Trying 63.111.163.92...
Connected to ebusiness.householdaccount.com.
Escape character is '^]'.
GET /23983542.21947.1.610 HTTP/1.1
Host: ebusiness.householdaccount.com
HTTP/1.1 301 Moved Permanently
Location: http://www.householdbank.com
Connection: close
P3P: CP="NOI COR ADMa OUR IND UNI"
Set-Cookie: kc_customer=23983542; path=/; expires=Fri, 01-Apr-2005 21:51:12 GMT; domain=.householdaccount.com;
Set-Cookie: kc_click_92334=/23983542.21947.1.610; path=/; expires=Fri, 02-Apr-2004 21:51:12 GMT; domain=.householdaccount.com;
From HouseholdBank@ebusiness.householdaccount.com Thu Apr 1 16:14:04 2004
Received: from ([63.111.163.37])
by smtp1.recipientdomain.com with ESMTP ;
Thu, 01 Apr 2004 16:14:04 -0500
From: "Household Bank"
Reply-to: HouseholdBank.23983542.21947.1@ebusiness.householdaccount.com
To: RECIPIENT@recipientdomain.com
Subject: Your Household Bank account balance is over the credit limit
Date: Thu, 1 Apr 2004 15:23:20 -0600
Message-ID: <1080854601594. HouseholdBank.23983542.21947.1@ ebusiness.householdaccount.com>
X-Mailer: ehouse
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="1080854601594.MimeBoundarY"
Status: RO
Things to note:
The mail is from 'ebusiness.householdaccount.com'. That's not the domain that anyone doing business with them would be used to. Trains people to not bother looking critically at domain names.
Note the email addresses include the string "23983542.21947.1" (that's random, changed from the actual numbers, same format). We'll see that string many times.
Text Format Message:
Dear Household Bank Cardmember,
This alert is to inform you that your account is currently over the credit limit and has been assessed an over the credit limit fee. You can make a payment online at www.householdbank.com or by calling the number on the back of your card to arrange for other payment options.
http://ebusiness.householdaccount.com/21764826.29261.6.234
We appreciate your business. If you have any questions please visit us online at www.householdbank.com, or contact a Customer Care Representative using the number on the back of your card.
Thank you,
Household Bank Customer Care
PLEASE DO NOT REPLY TO THIS EMAIL Replies to this email will not be received. If you wish to submit an account-related question, please login to our secure website at: http://ebusiness.householdaccount.com/23983542.21947.1.132
ABOUT THIS MESSAGE This email was sent to: RECIPIENT@recipientdomain.com. As an Household Bank Cardmember, you are receiving this account notification because you provided us your email address. Household Bank Credit Card is committed to safeguarding your privacy online. To view our privacy policy please visit: http://ebusiness.householdaccount.com/23983542.21947.1.2459
Note: Residents of CT & TX: We are attempting to collect a debt and any information obtained will be used for that purpose.
Household Bank is a registered mark of Household Bank. Copyright 2002 Household Credit Services, Inc. MasterCard is a registered mark of MasterCard International.
Comments: OK, text format messages are OK. But the URLs have identifying information - note that every URL has 23983542.21947.1 in it. Yes it makes it easy...but the easier you make it, the easier it is to fake it! Tell your clients to log in their NORMAL way, and put clearly labeled links on the website.
Here's the kicker...the html version in the email:
Note the links that say one thing, but link to a different URL. <A HREF= > links in the email that are easy to click on.
Also, when you DO click on one of the ebusiness.householdaccount.com link, you are redirected to ANOTHER domain - this time housholdbank.com. Again, training the user that changing domains is OK.
$ telnet ebusiness.householdaccount.com 80
Trying 63.111.163.92...
Connected to ebusiness.householdaccount.com.
Escape character is '^]'.
GET /23983542.21947.1.610 HTTP/1.1
Host: ebusiness.householdaccount.com
HTTP/1.1 301 Moved Permanently
Location: http://www.householdbank.com
Connection: close
P3P: CP="NOI COR ADMa OUR IND UNI"
Set-Cookie: kc_customer=23983542; path=/; expires=Fri, 01-Apr-2005 21:51:12 GMT; domain=.householdaccount.com;
Set-Cookie: kc_click_92334=/23983542.21947.1.610; path=/; expires=Fri, 02-Apr-2004 21:51:12 GMT; domain=.householdaccount.com;
Comments
Display comments as
(Linear | Threaded)
Based on my experience with Household Bank (and a forty year history of scamming customers)I'm not surprised by their lacadaisacal approach to security. Customer "Care" is an oxymoron in their case. I've received these generic, "phishy" e-mails WHEN I'VE SENT AN E-MAIL ON THE HOUSEHOLD BANK SECURE SERVER regarding errors THEY'VE MADE ON MY ACCOUNT!! Funny thing, they say they can't address anything account related, or they don't have enough information to address concerns about their gouging the consumer, refusal to cancel "memberships" they've attached to credit customer accounts, but JUST CAN'T CANCEL.
I realize I've moved a bit outside the box in regards to the original issue, except that "secure" would not describe ANY ASPECTS of how Household deals with their "customers. "Security" is definitely not a feeling they foster! Why bother with the hassles of ensuring secure transactions/communications online, when they don't care to address it offline--unless you pay a premium, of course!
I realize I've moved a bit outside the box in regards to the original issue, except that "secure" would not describe ANY ASPECTS of how Household deals with their "customers. "Security" is definitely not a feeling they foster! Why bother with the hassles of ensuring secure transactions/communications online, when they don't care to address it offline--unless you pay a premium, of course!
Hello, I received a very similar email this morning from "HouseholdBank@ebusiness.householdaccount.com" The email looked very suspicious so I did some searching and I found your site. Here is what the email looks like:
and here are the email headers:
It looks like the person(s) phishing have modified the code slightly but using the same basic format. Note the only changes I made to the images is to scrub out my prefix to my real email address; all else is unchanged.
I hope this helps someone.
- Neal
and here are the email headers:
It looks like the person(s) phishing have modified the code slightly but using the same basic format. Note the only changes I made to the images is to scrub out my prefix to my real email address; all else is unchanged.
I hope this helps someone.
- Neal
Back in April, I called Household Bank to warn them about some strange emails that I thought MIGHT be phishing schemes, but the Security person I talked to told me the Marketing department wasn't consulting them, and was sending out these emails. He said
Tracked: Sep 28, 11:33