Suspicious "your session has expired" Wells Fargo notice

[Evander]

So after my computer reboots, I see 3 windows of IE automatically open up and say 'your session has expired' and the url is:
https://voltage-pp-0000.wellsfargo.com
with some other junk at the end of the .com

This looked VERY suspicious to me to I tried to google that url and found this:
http://rossander.org/infosec/2008/09/spam-phish-or-secure-mail/
"Reminder: The only part of the domain that matters is the part immediately before the top-level domain (.com, .org, etc). Ignore everything to the left or right of the dots. In the link voltage-pp-0000.westfieldgrp.com/mail/32/, only ‘westfieldgrp’ matters for verifying the legitimacy of the message. The rest is set up by the company’s IT department to point to specific places within the company’s domain."

Well I don't put all my trust in some random person's blog so that's why I'm here. I'll run a full system scan when I get back later but thought I'd try to see right now your opinions if this is a case of malware on my system that's looking to take me on a phishing expedition

 

[seepy83]

You're smart for not trusting something you read on 1 random person's blog, but in this situation the information you found on Mike Rossander's blog is correct. A link in a phish email might look like:

http://www.whatever.com/wellsfargo.com/index.php

Your browser would go to some page on whatever.com if you clicked that link. The wellsfargo.com after the first top-level domain is just there to trick you into thinking you're going to Wells Fargo.

As for the domain that you're seeing (voltage-pp-0000.wellsfargo.com), a quick google search for just voltage-pp-0000 shows that it's a naming convention used by Voltage SecureMail (http://www.voltage.com/products/securemail/) . I'm drawing that conclusion from an eastsussex.gov.uk page with instructions for exchanging secure email with them (http://www.eastsussex.gov.uk/contactus/secureemail/default.htm).

I've never heard of Voltage SecureMail, but there are many different Secure/Encrypted Email products, and this one looks legit. If you follow the first link in your post, you'll be taken to Wells Fargo's Voltage SecureMail page. If you still have doubts, you can contact Wells Fargo and ask them if that's a system that they use.

The real question here is: why does your computer try to access Wells Fargo's secure email system when you log in? I would probably look in msconfig and see if there is anything running on Startup that references IE and/or the Wells Fargo website.

 

[John Connor]

If you use Firefox or Pale Moon or other Mozilla based variant you can use the add-on called PWDHash which is a password creator and it will not generate the correct password for a phish site. It has three levels of protection, really; Anti-phish, Anti-key logger and unique complicated passwords per site using the same input.

OpenDNS may help with Phish sites.

You really shouldn't use IE. It uses ActiveX and has a lot of vulnerabilities. Any vulnerabilities found in Firefox are patched a lot quicker.

 

[Elixer]

You really shouldn't use IE. It uses ActiveX and has a lot of vulnerabilities. Any vulnerabilities found in Firefox are patched a lot quicker.

Well...
http://h30499.www3.hp.com/t5/HP-Sec...wn2Own-2014-A-recap/ba-p/6413622#.UybxYvl_uAU

Mozilla Firefox was exploited four times with zero-day attacks launched by security researchers attending the annual Pwn2own hacking contest, making it one of the least secure popular web browsers.

While the other three major web browsers - Google's Chrome, Microsoft's Internet Explorer (IE) and Apple's Safari - were all exploited as part of the competition, along with the software application Adobe Flash, Firefox saw three takedowns on the first day and another on the second, making it the most exploited web browser of the bunch.

FF also don't have a 'sandbox' model, unlike chrome & IE.

Having said that, I still don't like IE or chrome.

 

[John Connor]

I don't see that quote in the article you linked to. And I use Pale Moon as my primary browser and Firefox second. I already downloaded an update which could have patches to Pale Moon.

Still, ActiveX is an exploit in IE.