Anatomy of a Phishing Scam

As my Information Technology major in school has a concentration in network security, I have been learning a lot--especially lately--about the variety of tactics that hackers will use to compromise our networks, gain our usernames and passwords, and even steal our digital identities.

Also, as I work at a web design company and am now fluent and certified in HTML and CSS, two basic web programming languages, and have a general understanding of other languages as well, it has inspired me to take a closer look at the scams and "hacks" that we see--and often disregard--on a daily basis.

In this article, I will take a closer look and analyze three types of attacks:  A Facebook "hack," a mobile SMS (text message) scam, and the classic email scam.

The Facebook "Hack"

Everyone has seen what is commonly referred to as a "Facebook hack" or scam, and most people have grown wise enough to disregard them without a second thought.  These "hacks" can often be easy to recognize, as they are usually mass-distributed messages from your Facebook friends whose accounts have already been compromised, requesting that you visit some obscure URL (web address) to see an "outrageous video" or obtain some sort of special offer.

If these messages are uncharacteristic of the friend, such as a message to check out a viral video of a schoolgirl pole dancing in her dorm room when you know that the friend is devoutly religious and would never post such a thing, it should immediately raise a red flag in your head that the post is not legitimate.

However, sometimes mere curiosity or a cleverly worded scam might fool someone into clicking the link.  The screenshot below is of a scam post that was posted one of my friend's wall.  The post was published by one of his trusted friends, most definitely without their knowledge.

So, if someone posts something like this on your wall, or you notice it in Facebook's News Feed, how do you know whether or not it is legitimate or if it is indeed a scam?  Well, there are a few warning signs to look out for.

First of all, read the message in the screenshot above, and then ask yourself, "Is this how my friend actually talks?"  In this case, I don't actually know the person who left the message on my friend's wall, but I can clearly tell by reading it that it sounds more suitable to being spoken by a used car salesman and not somebody whose profile picture is of him on a walk with his daughter.

Second, I see the link to a URL that I don't recognize.  If it was a link to YouTube or CNN or another website that I had heard of, I would probably click on it without any question.  But if it is a site like the one above, I myself would be a bit skeptical about where it might take me.  Now, maybe this is just me being paranoid, but when it comes to Internet security, I live by the motto "better safe than sorry."

If I encounter a website that I wish to visit that could quite possibly be legitimate, I will oftentimes highlight and copy the URL, open an Incognito window if I am in Chrome (which is done by holding down Ctrl+Shift+N) so that it is not in in a browser window that is already logged into my Facebook account, paste the link in the address bar, and then go to the website.  Also, since I understand HTML and how to read it, if a site looks suspicious to me, I will first view it in its pure source mode by typing "view-source:" (without the quotes) into Chrome's address bar, followed by the URL.  However, this is more of an advanced technique.

The third sign that the post in the above screenshot is suspicious, which is most often a tell-tale sign of a Facebook "hack" is the information next to the timestamp on the post.  In the example above, it says "March 23rd at 1:24am via Check It Out!"  The mere fact that the post was done via some kind of Facebook app tells me that this individual must have clicked on a link that asked them to install an app on their Facebook account.  Before installing an app, you will always receive a notice of what permissions you are giving the app over your account, but most people disregard these warnings and proceed with the installation.  But without reading it, you may be opening the door wide open to your Facebook account to a malicious app and saying "Come on in!"  The app can then post on others' walls in your behalf, as seen above.

Now let's take a deeper look into what this particular post does.  I followed the steps I mentioned in a paragraph above to view the source code of the link, and discovered the following:

The link in the Facebook post actually had a trail of website redirects, meaning that going to that website would simply forward you on to another website, and then another, and then another.  Scammers will use this tactic to have several routes to their malicious trap, in case one or more of the web addresses get flagged as spam links and are blocked or present warnings.

Finally, I was able to trace the redirects to an actual website.  This website had code written to track a visit to the web page and reported the visit back to the Facebook app, in an attempt to "prove" to Facebook that it was a well-traveled page, attempting to fool its anti-spam filters.  After tracking the visit, the website would then promptly redirect the user to the final destination where, in this case, it would offer its free Six Flags passes.

If one were to actually view the website, it would look professional and raise no suspicions in regards to what it offers.  Essentially, it would look like any other website.  But a closer look at the code behind the page would tell a different story.

The first thing I noticed in the code is that it mentioned a number of tickets left, trying to get the visitor to hastily enter their information so that they could claim their ticket before they ran out.  However, the code says differently; the remaining number of tickets is static, meaning that it never changes.

The website would ask the visitor for their information as a way for the ticket to be delivered.  In this way the visitor promptly hands over their name, address, phone number(s), email address(es), and other information, which can be then be used to sell to third-party marketers, meaning that you'll be getting a lot more phone calls during dinner.  If the scammers are smart, they may also ask you to create a username and password, or what you think is a username and password.  Why would they do this?  Well, because many people use the same username and password for several accounts online.

Yesterday I had a friend approach me and have me look at an email that she had received, claiming that her Gmail account was going to be deactivated if she didn't click on a link and enter he login credentials. She did so and nothing happened.  I looked at the email, and noticed some tell-tale signs that it was a scam email that had somehow made it through the filter (but we'll get to email scams later).  After finding out that she had already provided her information to the false website, I asked her if she had another other accounts that used the same login credentials, and she said that her Facebook and even her PayPal account used the same information.  I told her to promptly go through the real channels to change those passwords, but what if she hadn't been warned?  How long would it have taken before her savings account had been emptied via PayPal?

In the Facebook example that I have been citing, I was actually impressed (for lack of a better word) that the scammers even took legality of their actions into consideration with their scam website, providing official Privacy Policy and Terms and Conditions pages...essentially "covering their bases."  This is what I found--in the code--when I viewed the Privacy Policy:

Notice how they blatantly say that they will be selling your information to third-party marketers and that you will be receiving special offers via phone calls, emails, etc.  The Terms and Conditions page showed a similar message:

The visitors may say to themselves, however, that "at least there is an unsubscribe button at the button of the page, so I won't receive marketing ploys if I don't want them, right?"  Wrong.  I viewed the source of the Unsubscribe page, and this is what I found:

Essentially, the unsubscribe page shows a form where they can enter their email address to unsubscribe from the offers, but in this case they are literally just going through the motions, because this form is simply an empty shell.  Although it looks like it submits the information, it never actually gets sent anywhere.  In other words, there is no unsubscribe option.

So, as you can see, Facebook "hacks" can have dire consequences, but only if you ignore your common sense and click on things that you probably shouldn't.

Text Message Scams

A few weeks ago, I got a text from an unrecognized number that my Google Voice account (which I love, as it's directly integrated with my Sprint phone) told me was from Washington DC.  The message told me that I had won a $1000 gift card from Walmart and could obtain it by entering a promo code at a certain website.

As crazy as it sounds, I didn't drop everything I was doing and click on the link while popping open a bottle of champagne when I got the message.  In fact, I even showed  it to my family, who said that they'd all received the same text message at different times over the past few days.  In fact, my mom said that she had heard a story on the news, mentioning a disgruntled ex-employee of Walmart that was sending out a phishing scam.  Whether this text is from the same source, I do not know.

I was curious to know what the link actually did so, like with the Facebook hack mentioned above, I used Google Chrome's "view-source" feature to check out the HTML code behind the "offer."  What I found was this:

Instead of routing the user through several domains like with the Facebook hack, this pulled up a page at the direct URL.  From looking at the HTML, it appears that the page displays a form which asks the visitor to input a variety of information to "claim their prize."  This input includes a first name, last name, email address, up to three phone numbers, and even a username and password.  The data is then submitted to a PHP file that is a server-side script that I did not have access to view.  But let's just assume that it doesn't use the data collected to generate a legitimate Walmart gift card and email it to the customer.

So what would happen if someone were to fall into this trap and fill out their information?  Well, first of all, that person would soon become fast friends with Mr. and Mrs. Spam.  Not just email spam, but text message spam as well, and possibly even telemarketing calls and/or scams.  (Is there a difference?)

If the visitor enters a username and password, they are compromising themselves in many ways, mainly because the majority of computer users tend to use the same username and password for several different accounts, as was the case with my friend mentioned in the previous case.

I would sincerely hope that people wouldn't fall into a trap as obvious as this, but if nobody fell for them, then scammers wouldn't take the time to generate false websites, so it definitely makes me wonder how many people were caught in the Walmart Scammer's net.

Spam Emails

Everyone hates spam email, but thanks to sophisticated filters within web-based email services like Gmail and Hotmail, many of us never have to deal with them unless we decide for some reason to go exploring in the Spam or Junk folder.

Another nice feature that has been incorporated into such web-based mail systems is the validation of emails from particular companies to prove their legitimacy, especially financially-related emails such as from banks and PayPal.  Hotmail, for example, will show a green shield next to emails like these.

But phishing scammers still try to catch those that are less vigilant with similar emails.  I have always been a fan of web-based email systems--Gmail in particular--and often wonder how well applications such as Microsoft Outlook, Mozilla Thunderbird, and others detect spam messages.

There are many tell-tale signs that can be used to detect whether or not an email is from a legitimate source.  Let's take the following email that I found in my own spam folder as an example:

The first warning sign, obviously, is the warning message displayed in red by the email system itself, warning the user that the email appears to be malicious in nature.  However, the other signs may be obvious to some yet more subtle to less-experienced users.

The wording of the email itself is at least attempting to sound professional, but for a company as renowned as Chase bank, I would expect something a bit more formal.  Also, if the user wasn't already mentally blinded by panic at having his or her account deactivated, it would be hard not to raise an eyebrow when seeing that the email from Chase Bank was supposedly sent from an email address from a very strange domain, being email.discover.com.  If it was a legitimate email from Chase, wouldn't it come from an email such as abuse@chase.com or something similar?

On a similar note, it is curious that the web link itself is from a strange domain, being fbren.com, as opposed to Chase's actual website.  These are things that I notice in a heartbeat and even laugh about, when others may not even notice in their panicked hurry to reactivate their supposedly canceled account.

Wanting to see where exactly this link would take me, I once again used the "view-source" feature in Chrome to view the HTML behind the so-called "re-activation website."

I noticed that, like the first example in this blog, this website also had an immediate redirect to another website.  However, this website was quite clever in its redirect, if it's not too ironic to say so.  They used an IP address as the domain, as opposed to an actual registered domain name, and then named the subdirectory of the site in such a way that the visitors would perhaps not notice the actual address and believe in its legitimacy.

Curious to know where the attackers originated, I used a simple WHOIS command in my Linux terminal, which gave me all the information I needed to know about the hackers:

It was interesting to note from the information above that the attack was actually originating from a university in China, meaning that some bored students were performing a scam right under their instructors' noses...and doing so from the school computers.

Knowing that this website was obviously a known phishing/scam website, and being very confident in the security of my computer and firewalls, I decided to take the plunge and click on the link--using the "view-source" feature, of course--to see what would happen.  Sure enough, I was immediately presented by a warning sign from Google Chrome, warning me about visiting the website in question.

Viewing the HTML code, it was very clear to me that this was web page that was designed to look identical to a legitimate page provided by Chase, complete with logo and color scheme.  However, when the visitor entered their information, it would be submitted to a PHP file called login, which would most likely execute code to capture the visitor's login information and redirect them to the actual home page of Chase Bank, so as to remove any suspicion.

And thus we see exactly how an email phishing scam works.

Conclusion

Having a strong background in Information Technology, especially in Internet security and web development, I look at all of these attacks and laugh to myself, thinking that there is no way that anyone could ever fall for such a thing.  Yet, as mentioned previously, hackers wouldn't spend so much time meticulously designing these traps unless they had at least enough people fall into them to make it worth the effort, which is highly alarming.

Kevin Mitnick, one of the world's most renowned hackers and--believe it or not--a personal hero of mine because of his vast well of knowledge of the Internet security world, recently said a quote on his Twitter feed that really makes sense with everything that I have mentioned in this post:  "Send a man a phish and he will click on it.  Teach a man to phish and 10,000 people will click on it."

It is shocking that, in such a day and age where computers and technology are so prevalent in our lives that so many people are still ignorant to the risks they take each time they click on their web browser.  But as long as they are vigilant, they need not fall into the traps that lay waiting.

A Silver Medal and a Thumb Drive

Oh the joys of running into your professors while making a pit stop in the restroom at school.

About a month ago, I decided to take advantage of a few minutes between classes to hit the head.  Upon walking inside, I found a friend of mine and one of my old professors, Professor Ormond, having a conversation.  I said a quick hello, and then went about my business.

Listening in, I noticed that Ormond was telling my friend Nathan about the SkillsUSA contest, which is a nationwide contest that recognizes a variety of different technical skills at both high school and post-secondary levels.  Ormond was trying to convince Nathan to sign up for the Web Design portion of the contest, as nobody had entered the competition at the university level, and whoever signed up would automatically be competing in the statewide competition.

After washing my hands (of course) and sliding past them toward the door, Nathan promptly said, "I don't know anything about web design...but Jeff does!"  Ormond's face lit up, and before I knew what was going on, I was being dragged into his office, and was presented with numerous packets of information regarding the competition.  Needless to say, I was about forty-five minutes late for my next class.

The contest involved designing a website from scratch for a client, who would be presenting the company's web design-related dilemma, and we would need to prepare and present a solution.  This content was unique to many of the other IT-related competitions, as it required the participant to work with a partner.

Luckily for me, I work at a web hosting and design company called Marketecture now, at which I design and support websites on a daily basis.  I entered this job, already possessing a pretty solid knowledge of web programming languages such as HTML and CSS, but my company actually paid for all of us to become certified with W3Schools in both languages.

Not only that, but I work with a fellow Utah Valley University student, Travis Harley, who is very skilled when it comes to the design aspect of websites, such as using tools like Photoshop and others to create magnificent-looking designs for clients.  I asked him to be my partner in the competition, and he readily accepted.

Over the subsequent weeks, we prepared vigorously for the competition, studying up on our coding skills and gathering the equipment necessary to participate.  For example, the rules instructed us that we would need to supply a hub or switch with two patch cables, in order to provide communication between our two laptops, which we also had to provide.  I purchased a pretty nice switch on Amazon, but it ended up not making a difference, because the rules changed soon after, allowing us to have a WiFi connection during the competition.

This was a great relief to us, as it meant that we could draw upon the previous sites that we had created in designing the website for the competition itself.

The design portion of the contest took place at 8am on Thursday, March 29th at Salt Lake Community College.  Travis lives in Saratoga Springs, which is on the way to the campus, so we carpooled up there together.  Upon arriving, we were introduced to the client, who explained that he needed a blog site created.  We were told that we just needed to design the home page of the website, depicting how it would be laid out, and not requiring us to create a functioning blog.

We were provided with some images from the company to use on the website, and commenced our work about an hour later.  We immediately put our heads together to decide on a layout and wireframe of the website itself, which I drew out on a notebook that I had brought with me.  I then began the coding of the actual site from scratch, using Microsoft's Web Expression 4 software, while Travis worked with Photoshop to design the background and banner images.

We worked extremely hard, continually modifying our designs to accommodate new ideas and concepts, and by the end of our time limit had a very professional website designed, complete with a JavaScript-powered animated main navigation menu, and an image rotator as the banner, which is Travis' specialty.

In essence, I was very proud of our work.  When our time drew to a close, we placed the website on a thumb drive and copied it to the presentation laptop.  We were then told to report the next day at the same time to present to the client, along with some other professionals in the web design field.

The presentation actually went quite well.  Travis explained his reasoning behind the color scheme and designs that he chose, taking the role of web designer, while I assumed the role of web developer and described the coding behind the project.  I also displayed the code itself, which I was very proud of, having placed many comments and indentations to make it very readable and understandable to any outsider.

Later that night was the award ceremony.  We sat in an auditorium filled with people from high schools, colleges, and universities all over the state of Utah.  At long last, our division was called, and we waited with bated breath to hear what our ranking would be.

To our surprise, we took second place in the competition, which to me was a tremendous accomplishment.  We stood on a podium not unlike those used during the Olympics, and were presented with silver medals.  We were then directed backstage, where we were presented with......a thumb drive.

Apparently each division had its own sponsor, and ours was Adobe.  They had a prize, which was any Adobe software package of the winner's choice, but only for those that placed first.  But, although I didn't receive any free software, I was still extremely grateful for the work that I had done, and felt very proud of our accomplishment.  If nothing else, it proved that I was able to take a task that, at first, sounded impossible, or at least extremely daunting, and follow through with it until the end.

Overall, it was a great experience, and I'm glad that I was able to be a part of it.

New Beginnings [...And Haters]

Well, life has pretty must been speeding past, and I've barely had enough time to breathe, let alone continue to add blog posts...especially since there probably aren't many who even read them, if anyone at all.  But, basically I began this blog to essentially give me another output medium for my thoughts, if nothing else as a way to keep my sanity and put my thoughts and feelings into words.

I have been thinking about the point of keeping a blog, and remembered the original reason for starting this blog, which can be found by clicking here.  So, since I'm getting very tempted to read the book Feed by Mira Grant again, and I know that it will give me the kick in the pants I need to start writing here again, I might as well start now.  That....and I can't sleep.

So, I'm hoping that I can start writing again, giving brief updates of my life, some music-related, and others that are not.  I want this blog to be another way for me to express myself, as doing so through music has been put on hiatus since the break-up of my band Formerly So (which I will talk more about later).  So tonight's post will be about an incident that I would like to mention involving the band, mainly because it is already past 2am and I don't want to be up much longer.

As I mentioned in the previous paragraph, my band Formerly So officially disbanded in May of 2011, which is foreshadowed by some of my blog posts around that time.  However, I don't think that I ever mentioned the disbandment on this blog, although I did on Facebook, Myspace, the band's official blog, and all of the other media used with the band to notify our fans, in the form of an official Press Release.

Here is an actual copy of the press release, as it was posted on Facebook:

Although the band may not have split up under the best of terms (the full explanation would require much more time to describe than I want to spend tonight), I still consider myself to be friends with every member of the band, albeit I haven't communicated with two of the members in quite some time, outside of the occasional Facebook "like" or comment.

In fact, not too long after the band broke up, I actually got together with Brayden (the vocalist) and his cousin Andrew (who was Formerly So's rhythm guitarist for a short time before we found Tim) and attempted to begin a new project.  We wrote a couple of songs, and even laid down a the guitar and bass tracks in ProTools on Andrew's MacBook.  Jason Stapleton, Formerly So's keyboardist--who had since returned from his mission to Romania and which whom I currently work--also stepped in for a time to make some music with us.

Unfortunately, the new project never really got off the ground, mainly because of schedule conflicts and the lack of a drummer, which slowed the motivation.  So, once again, I was without a means to play my bass, except by myself to my dog or along with iTunes.

I have thought often about doing some kind of solo project, especially now that I have a Mac Mini with 8GB of RAM and GarageBand, but that hasn't happened yet.  But, musically related, there is a light at the end of the tunnel.  I have recently jammed with Jason, in an attempt  to work on some more piano-and-bass driven songs that we could hopefully perform.  It is extremely fun to jam with Jason, as he is one of my closest friends, and we have written some pretty sweet stuff together.

I also will be trying out with a really good band called Goodnight Annabelle in about two weeks, for which I am super excited.  They are a great band, their members seem extremely friendly and chill, and I am very impressed with the music they have already written.  There is also another musician with whom I've been in contact, who wants to get together and see if I want to jam with them and possibly start a project.  So there is still potential for me to reintroduce myself to the music scene.

But now for the whole reason that I decided to write a post tonight.  As I mentioned, I am still in contact with both Brayden and Jason, but have also been in contact with Adam and Tim, if only via texts, Facebook, and other technological means.  Today, for example, Tim texted me and asked if I still had administrator rights to the Formerly So YouTube channel, which of course I do.  He informed me that some Internet troll had posted some pretty nasty comments on a couple of our YouTube videos, and to see if I could remove them.

Today was the Priesthood session of General Conference, so once I was home and able to sit down at my computer, I checked out these comments:

As you can see, this person decided to attack the band because of the number of views that the videos had received.  One post was on our official music video, and the other was on the video posted by Utah Music Scene, where we were interviewed at the Salt Lake City venue Club Vegas.

Due to YouTube's new layout, it is much more difficult to remove posts, even if they are on your own videos.  I immediately changed the music video's settings to allow comments only by the owner's approval, and marked the comment to be removed and to block the user.

I even sent a private message to the poster, as I was so confused by why he would randomly attack my band, saying the following:

Hey man,
I just noticed your comments on a couple of our videos, and I'm wondering what would cause you to say all of that. Looking at your previous comments on your channel, it looks like you singled out this band for all of your hate comments and trolling, when I really don't see a reason.
Yeah, we didn't a ton of views on our video, but who cares? We were a local band, and were doing what we could to make it in an industry overflowing with local music. On top of that, we were a bunch of friends, getting together to do what we loved: making music and performing. If that's a sin, then put me down as a sinner.
So, clearly you have some kind of beef with the band, but either didn't do 30 seconds of research enough to find out that it had disbanded about a year ago, or hold a grudge on behalf of a member of the band due to reasons that you completely do not understand.
Regardless, your comments were childish and there was no reason for them. If you don't like the music, move on to another song from another band, it's as easy as that.
But the fact of the matter is that, despite the band not growing in its fanbase and disbanding due to reasons that you are not privvy to knowing, we produced some music that every member of the band is incredibly proud of, and we see it as a great accomplishment.
So, I would appreciate it if you would keep those ill-informed comments to yourself, and focus your efforts on something more worthy than attempting to demean a band that has parted ways such a long time ago.
If you really want to continue acting this way, then be a man and talk about it to us personally. I welcome your response: send it to formerlysoband@gmail.com and, assuming it's more than belligerent hate and prejudice, I promise to take the time to thoughtfully write out a response to any question you may have.
Thanks.- Jeff

I posted the same message as a comment on his actual channel as well, as I noticed that somebody else had commented on it after being bashed by him for some stupid reason.  Also, because the second comment (which appears in the screenshot above) was on a video not uploaded by me, I wasn't able to remove the comment, but instead posted the same message above in the form of a reply to his comment.  I believe that the reply was frank, yet professional in the sense that I didn't result to vulgarity or name-calling, so if anyone is to read it, they will see that he truly is a troll, and hopefully believe that it was handled well on our part.

I sent Tim the message via Facebook, but he replied back several hours after I had removed the comment, and told me that it was still visible, so he didn't know if it just took time to remove, or if there was more I needed to do.  I tried several things, including marking the comment as spam with several accounts and replying with a shorter version of the above message (just in case). I'm not sure what exactly I did to solve the issue, but the comment is now gone from our music video's page.  It shows my reply and has a link to show the original comment, but when clicked on, an error message displays, saying that the original message has been removed.

In closing, I don't understand why people decide to bash others for really no reason.  The comment on the music video page said something along the lines of "since this band only has X amount of views in a year's time and other mediocre bands have tons more, they should think they're a great band," whereas the comment in the screenshot above goes on to claim the reason why our band didn't succeed, which--for the record--is definitely incorrect, as we were successful and could have continued on to have a bigger fan base and more success, had other obstacles not hindered us.

Anyway, I don't know if one of the band members was disgruntled and was complaining about the band to someone, who went on to "help" by placing those comments, but I don't believe that could be the case, because it made all members of the band equally look bad.  I'm guessing it was just some Internet troll, who was just hate-filled and wanting to cause a stir.  Basically, being the quintessential Internet troll that everyone knows and hates, that CollegeHumor depicted so well in this video: