Just thought of a way to scam... security threat...

DrPizza

Administrator Elite Member Goat Whisperer
Mar 5, 2001
49,601
166
111
www.slatebrookfarm.com
Remember the worms/viruses that changed the hosts file so that when you typed in www.google.com or yahoo or several other common sites, it caused it to redirect to a different page other than the page you were seeking?

Uhhh, what if someone did that, but instead of redirecting google or yahoo to a porn site, the hosts file directed ebay, paypal, or any number of bank pages to fake sites set up to mimic the real sites.

Thus, rather than getting an email (which most of us recognize immediately as a scam) that wants us to click some link and put in all our credit card information, the scam would rely instead on someone sincerely thinking they were going to www.ebay.com or paypal, or wherever. Then, I doubt most people would become suspicious if they were asked to re-enter their credit card information.

I hope someone here knows of a way to prevent this from happening.

(crossposted to Software... didn't know where else to post security issues)
 

Argo

Lifer
Apr 8, 2000
10,045
0
0
This won't work if the site is secure. Always check for yellow lock icon prior to entering your password.
 

DrPizza

Administrator Elite Member Goat Whisperer
Mar 5, 2001
49,601
166
111
www.slatebrookfarm.com
I'm not exactly sure what you mean... couldn't the scumbags who pull off these scams set up a secure site that mimics ebays real site? Heck, they could even serve as a proxy server of sorts... allowing a person to view the real ebay pages through their site. Then when someone bid on an item, while they thought ebay was receiving their CC info, they could be handing it over to the scammers.

(granted this is a much more sophisticated level of scamming, especially if all the words are spelled correctly :D, than a simple grammatically incorrect and poorly spelled email that asks the user to click on a link that seems to go to a fake site. They have been getting the fake sites to look pretty convincing though. )
 

Argo

Lifer
Apr 8, 2000
10,045
0
0
Certificate name has to match the server name. Otherwise you'll get a warning.
 

DrPizza

Administrator Elite Member Goat Whisperer
Mar 5, 2001
49,601
166
111
www.slatebrookfarm.com
That's a good point. But, if they didn't do it as a secure site, I'm thinking they'd still be able to fool the average computer user.
 

BillGates

Diamond Member
Nov 30, 2001
7,388
2
81
Most average puter users just click yes anyway - I could definitely see this happening.
 

DrPizza

Administrator Elite Member Goat Whisperer
Mar 5, 2001
49,601
166
111
www.slatebrookfarm.com
Wow, not many replies in this thread... I'll bet you're all out there frantically coding away, trying to release the first virus that redirects ebay attempts to your own scam pages :p
I'm not worried about myself... but I bet my wife would fall for it... my parents would fall for it...
 

SagaLore

Elite Member
Dec 18, 2001
24,036
21
81
Originally posted by: Argo
Certificate name has to match the server name. Otherwise you'll get a warning.

An alternate domain could get a valid certificate for their domain, then no warning would appear.

DrPizza, you are absolutely right - I haven't seen this happen yet, but I'm really surprised it hasn't.
 

hevnsnt

Lifer
Mar 18, 2000
10,868
1
0
lol... Or you could do one of those image scams.. That makes it appear that you are at paypal with a secure connection.
 

Argo

Lifer
Apr 8, 2000
10,045
0
0
Originally posted by: SagaLore
Originally posted by: Argo
Certificate name has to match the server name. Otherwise you'll get a warning.

An alternate domain could get a valid certificate for their domain, then no warning would appear.

DrPizza, you are absolutely right - I haven't seen this happen yet, but I'm really surprised it hasn't.

Since they're changing the hosts file the url would still read: www.paypal.com. The certificate would be for some other site, for example www.iamadirtyscammer.com. IE would detect that and warn the user. Also the problem with getting a certificate is that you have to provide enough documents to make it easy to track you.
 

DrPizza

Administrator Elite Member Goat Whisperer
Mar 5, 2001
49,601
166
111
www.slatebrookfarm.com
But, if they use the image scans, that include the URL, the unsuspecting user will *see* https:\\ at the top of the page. Thus, there would be no need for certificates.
 

Adul

Elite Member
Oct 9, 1999
32,999
44
91
danny.tangtam.com
Originally posted by: DrPizza
Wow, not many replies in this thread... I'll bet you're all out there frantically coding away, trying to release the first virus that redirects ebay attempts to your own scam pages :p
I'm not worried about myself... but I bet my wife would fall for it... my parents would fall for it...

Change your host file to read only then :)

also be sure to have up to date antivirus software.
 

DrPizza

Administrator Elite Member Goat Whisperer
Mar 5, 2001
49,601
166
111
www.slatebrookfarm.com
Originally posted by: Adul
Originally posted by: DrPizza
Wow, not many replies in this thread... I'll bet you're all out there frantically coding away, trying to release the first virus that redirects ebay attempts to your own scam pages :p
I'm not worried about myself... but I bet my wife would fall for it... my parents would fall for it...

Change your host file to read only then :)

also be sure to have up to date antivirus software.

Yes, I changed my host file to read only, and Spybot does something to it to prevent tampering. Nonetheless, can't worms/viruses still tamper with read only files? I'm not much of an expert on such things.
 

altering host file would require a worm/trojan/virus
the plot also involves a website, most likely a domain and hosting

tack on the act of getting a user to enter information (fraud?)

it's a risky plot...instead of getting busted for passing along malicous software...ya get nailed with fraud right with it

definately potential though, scary to think of all the people who would fall for it (hell..people fall for the paypal emails scams even now)
 

Falloutboy

Diamond Member
Jan 2, 2003
5,916
0
76
Originally posted by: jntdesign
altering host file would require a worm/trojan/virus
the plot also involves a website, most likely a domain and hosting

tack on the act of getting a user to enter information (fraud?)

it's a risky plot...instead of getting busted for passing along malicous software...ya get nailed with fraud right with it

definately potential though, scary to think of all the people who would fall for it (hell..people fall for the paypal emails scams even now)

no one domestically could pull this off but whats stoping someone overseas in a country somewhat lax on this type of thing.