{"id":850,"date":"2008-04-02T07:01:57","date_gmt":"2008-04-02T05:01:57","guid":{"rendered":"http:\/\/firefang.net\/blog\/850"},"modified":"2008-04-02T07:03:07","modified_gmt":"2008-04-02T05:03:07","slug":"%d7%98%d7%9b%d7%a0%d7%99%d7%a7%d7%aa-%d7%a4%d7%99%d7%a9%d7%99%d7%a0%d7%92-%d7%97%d7%93%d7%a9%d7%94-new-phishing-technique","status":"publish","type":"post","link":"https:\/\/firefang.net\/blog\/850","title":{"rendered":"\u05d8\u05db\u05e0\u05d9\u05e7\u05ea \u05e4\u05d9\u05e9\u05d9\u05e0\u05d2 \u05d7\u05d3\u05e9\u05d4 – New phishing technique"},"content":{"rendered":"

English translation below.<\/p>\n

\u05d3\u05d9\u05d9\u05d2\u05d9 \u05d6\u05d4\u05d5\u05ea \u05d4\u05de\u05e6\u05d9\u05d0\u05d5 \u05e9\u05d9\u05d8\u05d4 \u05d7\u05d3\u05e9\u05d4 \u05e9\u05de\u05e1\u05ea\u05d9\u05e8\u05d4 \u05d1\u05e6\u05d5\u05e8\u05d4 \u05d8\u05d5\u05d1\u05d4 \u05de\u05d0\u05d5\u05d3 \u05de\u05de\u05e9\u05ea\u05de\u05e9 \u05dc\u05d0 \u05d8\u05db\u05e0\u05d5\u05dc\u05d5\u05d2\u05d9 \u05d0\u05ea \u05d4\u05de\u05d4\u05d5\u05ea \u05e9\u05dc \u05de\u05d4 \u05e9\u05e7\u05d5\u05e8\u05d4.
\n\u05d1\u05e0\u05d9\u05d2\u05d5\u05d3 \u05dc\u05d3\u05e8\u05da \u05d4\u05de\u05e7\u05d5\u05d1\u05dc\u05ea, \u05d1\u05d4 \u05d4\u05de\u05e9\u05ea\u05de\u05e9 \u05de\u05d5\u05e4\u05e0\u05d4 \u05dc\u05d0\u05ea\u05e8 \u05e9\u05dc \u05d4\u05e4\u05d9\u05e9\u05e8\u05d9\u05dd, \u05e9\u05e0\u05e8\u05d0\u05d4 \u05db\u05de\u05d5 \u05d4\u05d0\u05ea\u05e8 \u05d4\u05d0\u05de\u05d9\u05ea\u05d9 (Paypal, Bank of america \u05d5\u05db\u05d3\u05d5\u05de\u05d4) – \u05d1\u05e9\u05d9\u05d8\u05d4 \u05d4\u05d7\u05d3\u05e9\u05d4 \u05d6\u05d4 \u05de\u05d4 \u05e9\u05e7\u05d5\u05e8\u05d4:<\/p>\n

1. \u05d4\u05de\u05e9\u05ea\u05de\u05e9 \u05de\u05e7\u05d1\u05dc \u05d0\u05d9\u05de\u05d9\u05d9\u05dc \u05e9\u05e0\u05e8\u05d0\u05d4 \u05db\u05d0\u05d9\u05dc\u05d5 \u05d4\u05d2\u05d9\u05e2 \u05de\u05de\u05e7\u05d5\u05e8 \u05d0\u05de\u05d9\u05ea\u05d9 (\u05d1\u05de\u05e7\u05e8\u05d4 \u05e9\u05dc\u05d9 \u05de\u05d7\u05d1\u05e8\u05d4 \u05d1\u05e9\u05dd Moneybookers, \u05e9\u05d3\u05d9 \u05d3\u05d5\u05de\u05d4 \u05dcPaypal), \u05d4\u05d0\u05d9\u05de\u05d9\u05d9\u05dc \u05d8\u05d5\u05e2\u05df \u05e9\u05de\u05e1\u05d9\u05d1\u05d5\u05ea \u05d0\u05d1\u05d8\u05d7\u05d4 \u05d4\u05d4\u05d5\u05d3\u05e2\u05d4 \u05d1\u05e7\u05d5\u05d1\u05e5 \u05de\u05e6\u05d5\u05e8\u05e3:<\/p>\n

\nFor security reasons we have sent the message as an attachment file.
\nThis measure has been adopted to prevent personal information theft and data loss.<\/strong>
\n————————————————-
\n\u00a9 Moneybookers Ltd. All Rights Reserved. Use of this Web site is subject to our Terms and Conditions.
\nRegistered in England and Wales under Company No 4260907. Registered office: Welken House, 10-11 Charterhouse Square, London, EC1M 6EH.
\nNone of the information contained in this website constitutes, nor should be construed as Financial Advice.
\nInternal complaint handling procedures can be requested by contacting our Customer Service Department.\n<\/div>\n

2. \u05d4\u05e7\u05d5\u05d1\u05e5 \u05d4\u05de\u05e6\u05d5\u05e8\u05e3 \u05d4\u05d5\u05d0 \u05e7\u05d5\u05d1\u05e5 HTML \u05e8\u05d2\u05d9\u05dc \u05dc\u05d7\u05dc\u05d5\u05d8\u05d9\u05df, \u05e9\u05dc\u05d0 \u05de\u05db\u05d9\u05dc \u05e9\u05d5\u05dd \u05d3\u05d1\u05e8 \u05e9\u05d9\u05d4\u05d9\u05d4 \u05e7\u05dc \u05dc\u05d6\u05d4\u05d5\u05ea \u05d1\u05e1\u05e8\u05d9\u05e7\u05d4 \u05d0\u05d5\u05d8\u05d5\u05de\u05d8\u05d9\u05ea (\u05d4\u05d9\u05d5\u05e8\u05d9\u05e1\u05d8\u05d9\u05ea), \u05d5\u05e0\u05e8\u05d0\u05d4 \u05db\u05de\u05d5 \u05d3\u05e3 \u05e8\u05e9\u05de\u05d9 \u05e9\u05dc Moneybookers,
\n\u05e9\u05de\u05d8\u05e8\u05ea\u05d5 \u05dc\u05de\u05e0\u05d5\u05e2 \u05d2\u05e0\u05d9\u05d1\u05ea \u05d6\u05d4\u05d5\u05ea, \u05d5\u05db\u05d9\u05d1\u05d5\u05e1 \u05db\u05e1\u05e4\u05d9\u05dd. \u05de\u05d8\u05e8\u05d5\u05ea \u05e8\u05d0\u05d5\u05d9\u05d5\u05ea \u05dc\u05dc\u05d0 \u05e1\u05e4\u05e7, \u05de\u05d4 \u05e9\u05e2\u05d5\u05d6\u05e8 \u05dc\u05d4\u05d5\u05e8\u05d9\u05d3 \u05d0\u05ea \u05d4\u05d4\u05d2\u05e0\u05d5\u05ea \u05d4\u05e4\u05e1\u05d9\u05db\u05d5\u05dc\u05d5\u05d2\u05d9\u05d5\u05ea \u05e9\u05dc \u05d4\u05de\u05e9\u05ea\u05de\u05e9 \u05e9\u05e8\u05d5\u05e6\u05d4 \u05dc\u05e2\u05d6\u05d5\u05e8.<\/p>\n

phishery.png<\/a><\/p>\n

\u05d4\u05d3\u05e3 \u05de\u05e7\u05e9\u05e8 \u05dc\u05dc\u05d5\u05d2\u05d5\u05d0\u05d9\u05dd \u05d5\u05e7\u05d1\u05e6\u05d9\u05dd \u05de\u05d4\u05d0\u05ea\u05e8 \u05e9\u05dc Moneybookers, \u05de\u05d4 \u05e9\u05de\u05e2\u05dc\u05d4 \u05d0\u05ea \u05e8\u05de\u05ea \u05d4\u05d0\u05de\u05d9\u05e0\u05d5\u05ea \u05d4\u05d5\u05d9\u05d6\u05d5\u05d0\u05dc\u05d9\u05ea \u05e9\u05dc\u05d5.<\/p>\n

3. \u05d1\u05e8\u05d2\u05e2 \u05e9\u05d4\u05de\u05e9\u05ea\u05de\u05e9 \u05de\u05de\u05dc\u05d0 \u05d0\u05ea \u05d4\u05e4\u05e8\u05d8\u05d9\u05dd \u05d5\u05dc\u05d5\u05d7\u05e5 \u05e2\u05dc submit, \u05d4\u05e0\u05ea\u05d5\u05e0\u05d9\u05dd \u05e0\u05e9\u05dc\u05d7\u05d9\u05dd \u05dc\u05e9\u05e8\u05ea \u05e9\u05dc \u05e9\u05dc \u05d4\u05e0\u05d5\u05db\u05dc\u05d9\u05dd, \u05e9\u05e9\u05d5\u05de\u05e8 \u05d0\u05d5\u05ea\u05dd \u05d5\u05de\u05d7\u05d6\u05d9\u05e8 HTTP 302, \u05e9\u05de\u05e4\u05e0\u05d4 \u05dc\u05e9\u05e8\u05ea \u05e9\u05dc MoneyBookers:<\/p>\n

\nPOST \/recordings\/theme\/images\/verification.pl.php HTTP\/1.1
\nHost: 0x9f.0xe2.0x3a.0x88<\/strong>
\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko\/20080129 Iceweasel\/2.0.0.12 (Debian-2.0.0.12-1)
\nAccept: text\/xml,application\/xml,application\/xhtml+xml,text\/html;q=0.9,text\/plain;q=0.8,image\/png,*\/*;q=0.5
\nAccept-Language: en-us,en;q=0.5
\nAccept-Encoding: gzip,deflate
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
\nKeep-Alive: 300
\nConnection: keep-alive
\nCookie: ari_lang=zh_CN; ARI=afb3d2a453d93cb6f2d23ad9fb940710
\nContent-Type: application\/x-www-form-urlencoded
\nContent-Length: 72<\/p>\n

day=02&month=Jan&year=1912&cvv=44324&txtEmail=44&txtPassword=&txtTuring=<\/p>\n

HTTP\/1.1 302 Found<\/strong>
\nDate: Wed, 02 Apr 2008 04:13:22 GMT
\nServer: Apache\/2.0.52 (CentOS)
\nX-Powered-By: PHP\/4.3.11
\nLocation: https:\/\/www.moneybookers.com\/app\/help.pl?s=laundering<\/strong>
\nContent-Length: 0
\nConnection: close
\nContent-Type: text\/html; charset=UTF-8\n<\/div>\n

\u05d9\u05e9 \u05db\u05de\u05d4 \u05d3\u05d1\u05e8\u05d9\u05dd \u05e9\u05db\u05d3\u05d0\u05d9 \u05dc\u05e9\u05d9\u05dd \u05d0\u05dc\u05d9\u05d4\u05dd \u05dc\u05d1 (\u05de\u05d5\u05d3\u05d2\u05e9\u05d9\u05dd).
\n* \u05d4\u05db\u05ea\u05d5\u05d1\u05ea \u05e9\u05dc \u05e9\u05e8\u05ea \u05d4\u05d9\u05e2\u05d3 \u05d4\u05d9\u05d0 0x9f.0xe2.0x3a.0x88. \u05d4\u05d3\u05d1\u05e8 \u05d4\u05de\u05d5\u05d6\u05e8 \u05d4\u05d6\u05d4 \u05d4\u05d5\u05d0 \u05db\u05ea\u05d5\u05d1\u05ea IP \u05d1\u05de\u05e1\u05d5\u05d5\u05d4, \u05de\u05d4 \u05e9\u05de\u05e7\u05e9\u05d4 \u05e2\u05dc \u05d4\u05de\u05e9\u05ea\u05de\u05e9\u05d9\u05dd \u05dc\u05d6\u05d4\u05d5\u05ea \u05de\u05d4 \u05e7\u05d5\u05e8\u05d4 \u05e4\u05d4.
\n* \u05d4\u05ea\u05e9\u05d5\u05d1\u05d4 \u05d4\u05d9\u05d0 HTTP 302, \u05e9\u05de\u05e4\u05e0\u05d4 \u05dc\u05e9\u05e8\u05ea \u05d4\u05de\u05d0\u05d5\u05d1\u05d8\u05d7 \u05e9\u05dc MoneyBookers, \u05de\u05d4 \u05e9\u05d2\u05d5\u05e8\u05dd \u05dc\u05de\u05e9\u05ea\u05de\u05e9 \u05dc\u05d7\u05e9\u05d5\u05d1 \u05e9\u05dc\u05e9\u05dd \u05d4\u05d5\u05d0 \u05d4\u05d2\u05d9\u05e2 \u05db\u05e9\u05d4\u05d5\u05d0 \u05dc\u05d7\u05e5 \u05e2\u05dc Submit.<\/p>\n

\u05d6\u05d3\u05d5\u05e0\u05d9.
\n\u05d4\u05d1\u05e2\u05d9\u05d4 \u05e4\u05d4 \u05d4\u05d9\u05d0 \u05e9\u05d0\u05d9 \u05d0\u05e4\u05e9\u05e8 \u05dc\u05de\u05e0\u05d5\u05e2 \u05de\u05d4\u05de\u05e9\u05ea\u05de\u05e9\u05d9\u05dd \u05dc\u05d4\u05e8\u05d9\u05e5 \u05e7\u05d5\u05d1\u05e5 HTML \u05de\u05e7\u05d5\u05de\u05d9, \u05d5\u05de\u05db\u05d9\u05d5\u05d5\u05df \u05e9\u05d4\u05de\u05e9\u05ea\u05de\u05e9\u05d9\u05dd \u05dc\u05d0 \u05d9\u05d3\u05e2\u05d5 \u05e9\u05e2\u05d1\u05d3\u05d5 \u05e2\u05dc\u05d9\u05d4\u05dd \u05dc\u05d0 \u05d9\u05d4\u05d9\u05d5 \u05d4\u05e8\u05d1\u05d4 \u05d3\u05d9\u05d5\u05d5\u05d7\u05d9\u05dd \u05e2\u05dc \u05d4\u05e2\u05e0\u05d9\u05d9\u05df, \u05d5\u05d2\u05dd \u05d0\u05dd \u05d9\u05d4\u05d9\u05d5 \u05e8\u05d5\u05d1\u05dd \u05dc\u05d0 \u05d9\u05e9\u05db\u05d9\u05dc\u05d5 \u05dc\u05d4\u05d1\u05d9\u05df \u05e2\u05dc \u05de\u05d9 \u05dc\u05d4\u05ea\u05dc\u05d5\u05e0\u05df. \u05d5\u05dc\u05db\u05df \u05db\u05dc\u05d9\u05dd \u05d0\u05d5\u05d8\u05d5\u05de\u05d8\u05d9\u05dd \u05db\u05de\u05d5 \u05d6\u05d9\u05d4\u05d5\u05d9 \u05d6\u05d9\u05d5\u05e3 \u05e8\u05e9\u05ea \u05e9\u05dc \u05d3\u05e4\u05d3\u05e4\u05e0\u05d9\u05dd – \u05e9\u05de\u05ea\u05d1\u05e1\u05e1 \u05e2\u05dc \u05e9\u05e8\u05ea \u05de\u05e8\u05db\u05d6\u05d9 \u05e9\u05d0\u05d5\u05e1\u05e3 \u05ea\u05dc\u05d5\u05e0\u05d5\u05ea \u05de\u05d4\u05e8\u05d1\u05d4 \u05de\u05e9\u05ea\u05de\u05e9\u05d9\u05dd – \u05dc\u05d0 \u05d9\u05e2\u05d1\u05d3\u05d5 \u05db\u05de\u05d5 \u05e9\u05e6\u05e8\u05d9\u05da \u05db\u05d9 \u05dc\u05d0 \u05d9\u05d4\u05d9\u05d5 \u05d4\u05e8\u05d1\u05d4 \u05ea\u05dc\u05d5\u05e0\u05d5\u05ea.<\/p>\n

\n========== ENGLISH TRANSLATION ==========<\/p>\n

Phishers have come up with a new method to conceal well from non-technical users the essence of what's happening.
\nUnlike the usual approach, where the user is pointed to a site owned by the phisher, that looks like the original site (Paypal, Bank of America etc) – this is what really happens with this approach:
\n1. The user receives an email that looks like it came from a real source (in my case from a Paypal like company called MoneyBookers), and that for security reason the real message is attached:<\/p>\n

For security reasons we have sent the message as an attachment file.
\nThis measure has been adopted to prevent personal information theft and data loss.<\/strong>
\n————————————————-
\n\u00a9 Moneybookers Ltd. All Rights Reserved. Use of this Web site is subject to our Terms and Conditions.
\nRegistered in England and Wales under Company No 4260907. Registered office: Welken House, 10-11 Charterhouse Square, London, EC1M 6EH.
\nNone of the information contained in this website constitutes, nor should be construed as Financial Advice.
\nInternal complaint handling procedures can be requested by contacting our Customer Service Department. <\/p>\n

2. The attached HTML is a normal HTML file that does not contain anything that will be easy to detect in an automatic (heuristic) scan, and looks like an official MoneyBookers page that is supposed to help prevent identity theft and money laundering. worthy causes with no doubt – that help lower the user mental defenses that wants to help.<\/p>\n

phishery.png<\/a><\/p>\n

The page links to logos and files from MoneyBookers, a thing which increase it's visual reliability level.<\/p>\n

3. When the user fills up the details and hit submit, the data is posted to the crooks site, which stores them and return HTTP 302, which redirect the user to the MoneyBookers site.<\/p>\n

POST \/recordings\/theme\/images\/verification.pl.php HTTP\/1.1
\nHost: 0x9f.0xe2.0x3a.0x88<\/strong>
\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko\/20080129 Iceweasel\/2.0.0.12 (Debian-2.0.0.12-1)
\nAccept: text\/xml,application\/xml,application\/xhtml+xml,text\/html;q=0.9,text\/plain;q=0.8,image\/png,*\/*;q=0.5
\nAccept-Language: en-us,en;q=0.5
\nAccept-Encoding: gzip,deflate
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
\nKeep-Alive: 300
\nConnection: keep-alive
\nCookie: ari_lang=zh_CN; ARI=afb3d2a453d93cb6f2d23ad9fb940710
\nContent-Type: application\/x-www-form-urlencoded
\nContent-Length: 72<\/p>\n

day=02&month=Jan&year=1912&cvv=44324&txtEmail=44&txtPassword=&txtTuring=<\/p>\n

HTTP\/1.1 302 Found<\/strong>
\nDate: Wed, 02 Apr 2008 04:13:22 GMT
\nServer: Apache\/2.0.52 (CentOS)
\nX-Powered-By: PHP\/4.3.11
\nLocation: https:\/\/www.moneybookers.com\/app\/help.pl?s=laundering<\/strong>
\nContent-Length: 0
\nConnection: close
\nContent-Type: text\/html; charset=UTF-8<\/p>\n

A few things to pay attention to (in bold):
\n* The destination post address is 0x9f.0xe2.0x3a.0x88, which is an IP address in disguise.
\n* The user is redirected to the real secure MoneyBookers site, which makes him think this is where he have sent his data.<\/p>\n

Nasty.
\nThe problem is that you can't prevent the user from running local HTML file, and since the users will not know they have been fooled there will not be many reports about this. that's why automatic tools like browser web forgery detection – that are based on a central server that collects complaints from many users – will not work well because there will not be many complaints.\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

English translation below. \u05d3\u05d9\u05d9\u05d2\u05d9 \u05d6\u05d4\u05d5\u05ea \u05d4\u05de\u05e6\u05d9\u05d0\u05d5 \u05e9\u05d9\u05d8\u05d4 \u05d7\u05d3\u05e9\u05d4 \u05e9\u05de\u05e1\u05ea\u05d9\u05e8\u05d4 \u05d1\u05e6\u05d5\u05e8\u05d4 \u05d8\u05d5\u05d1\u05d4 \u05de\u05d0\u05d5\u05d3 \u05de\u05de\u05e9\u05ea\u05de\u05e9 \u05dc\u05d0 \u05d8\u05db\u05e0\u05d5\u05dc\u05d5\u05d2\u05d9 \u05d0\u05ea \u05d4\u05de\u05d4\u05d5\u05ea \u05e9\u05dc \u05de\u05d4 \u05e9\u05e7\u05d5\u05e8\u05d4. \u05d1\u05e0\u05d9\u05d2\u05d5\u05d3 \u05dc\u05d3\u05e8\u05da \u05d4\u05de\u05e7\u05d5\u05d1\u05dc\u05ea, \u05d1\u05d4 \u05d4\u05de\u05e9\u05ea\u05de\u05e9 \u05de\u05d5\u05e4\u05e0\u05d4 \u05dc\u05d0\u05ea\u05e8 \u05e9\u05dc \u05d4\u05e4\u05d9\u05e9\u05e8\u05d9\u05dd, \u05e9\u05e0\u05e8\u05d0\u05d4 \u05db\u05de\u05d5 \u05d4\u05d0\u05ea\u05e8 \u05d4\u05d0\u05de\u05d9\u05ea\u05d9 (Paypal, Bank of america \u05d5\u05db\u05d3\u05d5\u05de\u05d4) – \u05d1\u05e9\u05d9\u05d8\u05d4 \u05d4\u05d7\u05d3\u05e9\u05d4 \u05d6\u05d4 \u05de\u05d4 \u05e9\u05e7\u05d5\u05e8\u05d4: 1. \u05d4\u05de\u05e9\u05ea\u05de\u05e9 \u05de\u05e7\u05d1\u05dc \u05d0\u05d9\u05de\u05d9\u05d9\u05dc \u05e9\u05e0\u05e8\u05d0\u05d4 \u05db\u05d0\u05d9\u05dc\u05d5 \u05d4\u05d2\u05d9\u05e2 \u05de\u05de\u05e7\u05d5\u05e8 \u05d0\u05de\u05d9\u05ea\u05d9 (\u05d1\u05de\u05e7\u05e8\u05d4 \u05e9\u05dc\u05d9 … <\/p>\n

\u05dc\u05d4\u05de\u05e9\u05d9\u05da \u05dc\u05e7\u05e8\u05d5\u05d0 \u05d8\u05db\u05e0\u05d9\u05e7\u05ea \u05e4\u05d9\u05e9\u05d9\u05e0\u05d2 \u05d7\u05d3\u05e9\u05d4 – New phishing technique<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[],"class_list":["post-850","post","type-post","status-publish","format-standard","hentry","category-spam"],"_links":{"self":[{"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/posts\/850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/comments?post=850"}],"version-history":[{"count":0,"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/posts\/850\/revisions"}],"wp:attachment":[{"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/media?parent=850"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/categories?post=850"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/firefang.net\/blog\/wp-json\/wp\/v2\/tags?post=850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}