Obfuscation

This post is full of technicalities. It's about making things dark and obscure. URL basically and my mood too.
Phishers are improving their ways to avoid detection, report and closure of their web pages. It's bad news but it's also good news. It shows that reporting their sites is making a dent on their operation. But it's bad because it's going to make it more difficult for people without the knowledge to report them properly. This way the pages are going to stay up longer, more people is going to fall for it and the phisher is going to have more time to collect the information.

I'm going to dissect on that I've received this week. This is the full URL (be careful, at the time of this post it's still active)

http://0x42.0x4d.0x3f.0x6e/amazon/redirect.php?http://0x48.0x0e.0xdd.0x67
/pagead/iclk?sa=l&ai=Br3ycNQz5Q-fXBJGSiQLU0eDSAueHkArnhtWZAu-FmQWgjlkQAxg
FKAg4AEDKEUiFOVD-4r2f-P____8BoAGyqor_A8gBAZUCCapCCqkCxU7NLQH0sz4&num=5&ad
url=http://0xd1.0x55.0x7f.0x82/%77%77%77%2E%70%61%79%70%61%6C%2E%63%6F%6D
%2E%68%74%6D

Imagine all that in just one line, I formatted it to fit the blog. Believe it or not, this is a valid URL. Not the kind you're used to see daily. Let's take a look at the first part

http://0x42.0x4d.0x3f.0x6e/amazon/redirect.php

The domain is expressed as IP number in hexadecimal format. If you do the math (you can use your Windows calculator in scientific mode) the real IP number is 66.77.63.110. You can try this IP number and it will take you to Sony Pictures'web site. In that web site there's a directory called amazon, and in there a PHP script called redirect.php. Sony Pictures is not involved in the scam and, most likely, its site wasn't hacked. It's common to have such a script, in this case Sony probably uses it to redirect visitors to Amazon's web site where they can buy Sony's stuff. This redirector script is just that simple, it creates an HTML code that tells your browser to go and load some other page. Try it, pick any URL you want and use this redirector to access it. Luckily, if we piss them off enough they'll secure the script and won't be used for phishing anymore. Try this

http://0x42.0x4d.0x3f.0x6e/amazon/redirect.php?http://www.google.com

Or any other page you want. The result is the same, you're redirected to the page you set as parameter for the script. You can also try http://0x42.0x4d.0x3f.0x6e or http://66.77.63.110 or http://www.sonypictures.com/, you'll see Sony Pictures' web site. They're all different ways to link to the same site.

But the phishing page is not there nor is Sony involved in this kind of operation. They have a script they use as part of their business and it was left unsecured. The same way we used it for this examples, the phisher uses it to obfuscate the URL pointing to his page. Where's the phishing page then? Let's take a look at the second part of the URL. It's easier now that we know that the script will redirect to the second URL and this is it

http://0x48.0x0e.0xdd.0x67/pagead/iclk?sa=l&ai=Br3ycNQz5Q-fXBJGSiQLU0eDSA
ueHkArnhtWZAu-FmQWgjlkQAxgFKAg4AEDKEUiFOVD-4r2f-P____8BoAGyqor_A8gBAZUCCa
pCCqkCxU7NLQH0sz4&num=5&adurl=http://0xd1.0x55.0x7f.0x82/%77%
77%77%2E%70%61%79%70%61%6C%2E%63%6F%6D%2E%68%74%6D

Looks complicated but let's take a look at it part by part. The first thing is the IP number, again it has been obscured by writing it in hexadecimal format. The real number is 72.14.221.103. You can try both, go on, they're both safe.

Surprised? Yes, the IP number points to Google. But the phishing page is not in Google's server and they're not related to it. What the URL says is that in that server there's a directory named pagead and in there an object named iclk. No more information about iclk. Most of the time you can assume that the object is what's described by its extension (the .xxx thing at the end), in this case there's no extension. But, most likely it's a script of some kind. Then, there's a set of parameters. sa with value l, ai with a long chain of characters (the part that looks real complicated), num with value 5 and adurl with a URL. If it looks like a redirector to you, you're right. It is. This is part of Google's Adsense program and the object of the script is to count hits for a particular ad (defined by the long chain of characters) and redirect the browser to the URL assigned (defined by the adurl parameter). Try this (I just did). Go to any page with Adsense, Google Adsense or Google anything. Most likely you'll get an Adsense panel or a link to a page with one. Pick any ad you like and copy the URL (right button, copy link location or anything like that depending on your browser). Now paste the link in your browser's URL box. What you see is exactly the same as the URL we've been looking at. Same parameter names, some with different values. Change the URL for anything else and you'll be redirected to that URL of your choice. I wonder how is Adsense counting that "click"? Regardless of that, the point is that the script is out there, is not secured and it's being used to obfuscate phishing URLs (and probably other scam or spam related links).

Ok, Google's problems aside, we've finally found the phishing page. It has to be the URL passed to Adsense as adurl parameter, right? Wrong! Let's take a look at it

http://0xd1.0x55.0x7f.0x82/%77%77%77%2E%70%61%79%70%61%6C%2E
%63%6F%6D%2E%68%74%6D

Again, the IP number has been obscured. The real IP number is 209.85.127.130 and belongs to Everyone Internet in Houston, TX. The rest of the URL is the name of an object. Looks like a very complicated object but it isn't. The same way the IP number is obscured by writing it in hexadecimal format, a text can be obscured by writing it using ASCII codes in hexadecimal format. That's what your looking at. %77 means 77 hexadecimal or 119 decimal or a "w". %2E means 2E hexadecimal or 46 decimal or a ".". I'll save you the pain of going through all this. The name of the object is www.paypal.com.htm and it's not the phishing page. It's an HTML page redirecting to somewhere else. Yes, another redirector. The difference between this one and the two previous ones is that this is a static page while the others are scripts able to generate the page dinamically based on the parameters you give them. Also, the previous ones are legal (in lack of a better term) though insecure scripts used as part of a business operation while this one was written specifically to be used as part of the phishing operation. It's hard to tell how it was set in there. It could be a hacked site or a free web site space or a web site paid from a Paypal account phished on a previous operation.

But the phishing page is not this one, this is just the redirector. It's a web page instructing your browser to ignore it and move on to another URL. I'm not going to publish the whole URL here because it's too much code to dissect. The URL is

http://0x40.0x1a.0x19.0xfa/www4.4paypal.com/cgi_bin2/webscr.php.cmd
=restore-account-login945096845098034938/webscr.php?cmd=_login-run

Again, the IP number is obscured. The real number is 64.26.25.250 and belongs to Hostway Corporation in Chicago, IL. Like the one from Everyone Internet, it's most likely a hosting server and its server is being abuse somehow. The URL looks complicated but it has been created like that to give it a more business like look. The first directory is named www4.4paypal.com to make you think you're connected to a Paypal server while you're not. The second directory name is cgi_bin2. And the third is webscr.php.cmd=restore-account-login945096845098034938. It looks like the script name is webscr.php using a parameter cmd with a complicated value. The character before the cmd should be a "?" but that would make the filename invalid. But it's just the name of another directory, the real page is webscr.php and the real parameter is cmd with value "_login-run". Probably the parameter value means nothing anyway.

The obfuscation of the URL works two ways. First, it makes it a lot more complicated to report. You have to go all the way to the phishing page and translate the URLs to find out who to report to. And second, it helps to avoid detection by mail filters. This is done by setting a huge number of different URL pointing to the same phishing page. If one mail is reported and its URL is added to the filter database, it doesn't matter because more messages with different URLs will go through undetected.

As you can see, the phishers are going that far to protect their pages. They know that the success of a page depends on the time it can survive, the more the page stays alive, more people will access it and, hopefully, post valuable information.

It's bad news that they're evolving into more complex setups but, on the other hand, it shows that the fight against them is making a dent in their operations. So, I'll keep reporting them. At least those that reach my mail box. Meanwhile, if you're a regular user be careful, if you're in charge of a web site be on the lookout for a phishing page or a redirector installed by a hacker and if you have scripts secure them.

Guest writer

Today is Guest Writer day... actually, I don't have an article to post and this mail from a friend came apropos. She's talking about a previous article I wrote about Internet safety in general and passwords. I want to say on my behalf that the problem she has was her own fault. You're supposed to create a rule for your passwords AND REMEMBER IT!!!

Her mail was too long for a comment and too good to be dissmised, so I decided to post it here. The text was edited to suit the requirements of the "Stop the Online Exploitation of Our Children Act" wrote by republican senator (and "freedom lover") John McCain, who doesn't seem to be aware that there's a pesky First Amendment that clearly protects the freedom of speech. Anyway, I've censored an couple words just to keep her safe (and all of your children out there reading this blog). She's my friend and I don't want to turn her in to the feds (but I will if the alternative is to pay $300,000 :-O ).

So, without further a due, I give you the Guest Writer of the day, Alex

After reading your article on Are you safe? Are you sure? I became, like any normal person would, completely paranoid about the vulnerability of my virtual * posterior *ets. You were so right, everything was out there, open to any interested hacker. I've never been the victim of identity theft or any other online crime. But you know what they say . there's always a first time for everything, so I'd rather be safe than sorry!
Conscious of the importance and severity of the task ahead, I decided to break my procrastinating habits and do it right away. I had your suggestions, which I could completely follow (why not?), and internet access to all my accounts. What else did I need? Nothing! So I merrily went on my way, updating all my passwords My only personal contribution was to use the nicknames I have for the financial institutions instead of the real name, which usually goes on the address bar, therefore making it easy to guess. Also, for some account types I used 3 letters for the month and for some others the complete month name. Guess one, guess all, you know! I felt immediately gratified and proud of myself.
Hackers getting to my accounts? Not now, not ever, no way, Jose!
A couple of days later I realized that I also decided not to make any more payments online, so I had a few checks to mail (you can't pay in person here, you know). No problem: checks, envelopes and postage stamps. All set! Like I used to do in prehistoric times, I mailed the checks on Wednesday, knowing they would not reach its destination and post at least until Friday, when my paycheck posts to my account via direct deposit (should I stop that too? Hmmm!). Well, the post office seems to be more efficient now, and some vendors hungrier for money. One of my checks hit my account too early, on Thursday, and bounced for lack of funds. I used to have overdraft protection from my savings account, but I stopped that as a safety precaution. So, there I was, with a delinquent electricity bill and a $30 fee for the bounce. That's okay, I thought, I learned my lesson: don't wait until the deadline, and don't mail ahead of time, you sneaky * woman of dubious reputation *!
Then came the time to make my mortgage payment. To me, it's the most important one, it's the roof over your head. I checked my bank account, and there was enough money there to cover the payment, so I mailed it.
Only to find out that it bounced anyway. Why? Because a couple of the previously sent checks had not posted to my account by the time I checked, therefore inflating my available balance. Thank goodness, the mortgage company didn't really bounce it, they called me. I explained the situation to them, and they waited until Friday (good that I didn't cancel my direct deposit!). Life is good!
Then I went on vacation for a week, to a beautiful ranch in the middle of the desert, but with all the amenities of a 5 star hotel. I had a wonderful time, disconnected from every day routine activities, Oh, if it only lasted longer than a week! When I came back, I went online to check my finances. But I found a little problem there, did I call Bank of America BofA? Yes, I think I did. Well, it was really 6Of4 (I also
replaced all b's with 6). Now . what the hell was the rest of the password? Did I create it in m4rCh or aPri1? I tried them both, but none of them worked, probably I used something other than 6Of4. Tried 64nKoF4MeRiC4, but that didn't work either. Maybe I used the complete month name? After 3 wrong attempts, the bank blocked my account, so I had to wait until the next day to try it again, but at that point
clicking on 'forgot my password'. They sent it to me via email.
Another little problem I had was with one of the credit cards. Some crook opened my payment envelope and made a copy of the check before processing it. So, he had my checking account number, my credit card number (memo area of the check, as they instruct you to write it there), and my signature. I had to close that account because of fraudulent charges. The money was returned to my account after a while, but the headache was there.
Oh. My God! What a * performing of sexual intercourse * nightmare! I was so relieved when I woke up and realized it was just that, a very bad dream! Right there and then I made up my mind: stay with the good-old kiss principle that never failed me so far. I believe that people somehow manage to attract to them the things that happen in their lives. For instance, if you worry too much about losing your job, you're asking for it to happen. Makes sense?
Maybe not, but my experience shows me it's true. As far as security, many web sites require more and more intricate passwords, more digits, combinations of characters, etc. Hackers are aware of it, and they will probably try complex combinations instead of a simple and stupid one.
I'll keep my simple and stupid
Thank you for all your valuable advice. Seriously, I mean it. From now on, I will always look at the address bar.

Making money on the Internet

The "payment officer" scam is a huge success lately. At least I think it is because everyone is doing it. A couple months ago I was getting one of this once in a while, now I get a couple everyday.

In case you've missed it, the scam work like this:
You're offered a job as payment officer (or any other name), your duty is to receive payment from customers and send the money to your boss at headquarters. You get to keep a percentage of every transaction (usually 10%). So far so good, it really sounds like a sweet deal, maybe too sweet. But "entertain no fear my friend" (as nigerians always say), the reason why the company is doing it is because of 9/11, patriot act, laundering controls, etc that makes too complicated for our customers to pay from USA to foreign countries (exactly what you're supossed to do).
How this "job" really works? You get bad checks, forged or stolen. The bank usually let you get the money before the check goes all the way round. By the time the check bounces, you've already sent the money to your boss and the bank wants it back. The reason why the bank gives you the money in advance is because you're good for it, they don't care about the check (as far as I know this system applies only to the USA). The scammers knows is and that's why they'll push you to send the money as soon as possible, they know that the time frame is limited before the whole thing blows up.

The inside of the "company" it's a band with access to the real stuff and freelance "bosses" recruiting marks over the net. Once your boss gets you on the hook, you're presented to the company as a prospect. If they like what they see (your name, address, ID, job position, etc) they'll contact you as "customers" and start the transactions.

Now there's an extra twist to this scam. Instead of a check they make a transfer straight into your account. I'm still wondering about this, because it means that somehow they have control over an account with enough money or credit to do it. I suspect that nigerians scammers are into the phishing business too. If they get hold of a user/password combination for a bank account, they wait for the opportunity to make a transfer to a payment officer's account. If they time the operation properly, the payment officer will send the money before the victim of the phishing finds out. From that point, it's someone's else problem.

It's hard to believe how easy it is, but it is.

I took many of this jobs. My idea was to make them send the checks to someone who cares and can do something about it, law enforcers I mean. But I'm still trying to find one who does. In the meantime, I made them send the checks to dead ends where they got lost. I don't want to give much details about it in case they read this blog. The good thing is that each check that they send to me is a check that won't hurt someone else. So far, only this year, I catched almost half a million dollars. And this is only those I could get some kind of confirmation.
Some of the checks were sent through regular mail and I had no way to confirm them, maybe they were not sent at all. Others were sent by courier, Fedex or UPS, and I verified that using the tracking number. For some, I also received a copy of the original waybill. This is great because it gave me information about how it was sent, from where, how it was paid, etc. The bad news is that they're all dead ends. Paid in cash at the counter (no real name or return address) or charged to a hijacked account (real name and return address but it's just another victim).

Transfers are hard to handle for me. A couple times I sent bogus account numbers, some worked (no complains from my boss) some didn't (a lot of complains). I can't tell what happened. It's obvious that if you do a transfer from the bank's web page and the destination number is wrong, the system should warn you about it. But why some seemed to work? Maybe they didn't, the "company" called my bluff and decided to cut my "boss" out of the loop. The chances of typing a good number randomly are incredible low.

It's a real problem because transfers is becoming the most popular way to scam. One reason could be that it's a lot more easy for the mark. Most people is reluctant to get checks from strangers, but the transfer is money already in your account. You have to do nothing, sign nothing. It really feels like you're not taking responsibility for it, it's just in there waiting for you. The other reason could be that phishing is working and they have control over many bank accounts. Forged and stolen checks require hard work and are limited, accounts taken by phishing require less work and are coming fresh daily. If I'm right and there's a connection, it's a scary scenario.

And probably is. The transfer scam is being used in connection with the advanced fee frauds. If you don't pay the fees for your lottery prize, your inheritance papers or your contract certificates, they will offer you to deal with a financier who's willing to pay for it. But, because the financier is inside the lottery/court/government, he can pay by himself. The payment has to be done from you personally. So the money is sent to you first, then you have to resend it to wherever it is that it has to be sent. And how it's going to be sent to you? A bank transfer.

As you can see, it's always about creating a missing link in the money chain. They may have access to the money but if they use it directly or send it to their own accounts, the chain goes to them. When you send the money to them through Western Union or Moneygram (to a fake name somewhere in Africa where they can get it without an ID), the chain is broken and you're the last link.

The bank on top of the phishing ranking (at least in my mail accounts) is the Bank of America. I don't think is something about the security level of their online system, it has to be something about the way money can be transferred from their accounts. I've sent them a message with details about it. I think that they should try to catch some of this jobs and make the scammers do the transfers to controlled accounts. The scammers have control over some of their customers accounts and there's no way to find out which ones. Besides, the mark is going to be one of their customers too. If they do it, the hijacked accounts can be secured as soon as they're identified, the customer informed about the situation. I'd like to know that my bank is doing things like this to protect me, the publicity will improve the image of the bank and bring awareness to the general public about the phishing problem. The cost is minimal, I can do it on my free time. A lot more can be done from an organized group working full time. But, so far, no answer.

Law enforcers are not interested, neither is your bank. You have to take care of yourself kids. I won't be here watching your backs forever :oP