Hacker News Reader

Comment by monochromatic | Hacker News Reader

equifaxsecurity2017.com sounds like such a scammy site too. It's exactly the kind of thing I'd expect a fake site to be named.

Why in the world wouldn't they just put it on their own domain?

View on HN

Probably because they wanted to farm it out to some agency with zero dependencies on their known-incompetent internal IT team?

You're right of course, but I'm betting that was the motivation.

They could always farm out the new site and point a subdomain to it.

Something like https://breach.equifax.com

That would require ssl certs to be shared to the agency.

Agreeing with everyone though, it's a wrong reason, but I can fathom why someone would do it.

No, the outside agency can obtain a new cert for just that subdomain. They can even use letsencrypt! (Although they really should use EV for this type of site.)

You'd think even the world's most incompetent IT team could manage to point a subdomain at a remote server, but apparently not.

I have contracted places where that would be a very formal request with tons of meetings and approval flows across purchasing, it security, website ops, the design/branding team, etc. Weeks of lead time required.

Basically, the request signals all the little fiefdoms that it's their chance to weigh in.

Not without sending every user's equifax.com cookies to that outside agency's servers.

Hmm, point. Of course, there are tons of ways to get around that problem.

Can you share the best?

The first one that comes to mind would be to invalidate all existing cookies so that the ones accessible to the other server aren't useful. I wouldn't call that the "best" since invalidating cookies can be annoying for users, but I'm sure there are other ways.

If a user has a cookie for example.com (your domain) and type in vendor.example.com in the web browser how would you invalidate these cookies before they are sent to the vendor? Or even after they are sent? I struggle a bit with seeing how this could be done in a secure manner.

Never underestimate how incompetent people can be. When I was waiting for my South African Visa application to go through, I had to check the status at a scammy-looking url. The form would reload if you pressed enter and pressing tab after the ID field would set the focus to the logo above it instead to the password field below.

My guess was that they wanted to reduce the chance of news leaking before they announced it. If they're like other large companies I've seen from the inside, changes to the main website involve lots of meetings and lots of people/stakeholders.

I don't get it either.

A few days ago, got a mail from PayPal about "changes in account". Go to my account was linked to https://www.secureserverpaypal.ssvahan.com/home. I've forwarded the mail to PayPal spoofing address, they replied it's legit. Why would a legit PayPal activity be linked to an arbitrary domain - I don't get it. It makes zero sense.

It sounds like your mailbox and/or client is compromised (that or someone is an idiot on paypal's end). I would assume you're totally compromised and start with a new computer that's installed with ISOs obtained from different computers/networks then change your passwords from there. There's probably guides you can follow online. But don't trust me, get the paypal phone number from the paypal site from somewhere like an Apple store or library and call them to ask about that URL yourself. The domain is not registered with the same provider and it's just super shady looking. Good luck.

Huh? How is receiving a phishing email an evidence of compromise?

It seems very unlikely that PayPal's spoof email would validate an obviously spoofed domain. It could be that PayPal is completely phoning it in at this point but that's really egregious. Not that I think they're some amazing company, I'd even say they're downright evil based on past experiences.

Forwarding it to Paypal and getting a response that it's legit is certainly interesting.

For the record, not overly happy with the response, I've sent this follow-up to spoof@paypal.com:

>Hi there. Thanks for the quick response. I do have a question. Why would PayPal refer me to a form not hosted under PayPal domain? How can I tell it's a legit PayPal communication?

Expectedly, never got a response.

Would it be possible for you to post the source (or even just the headers) with your email scrubbed from the message you received from them the first time? Depending on your email provider they could fake that too but it might be worth a look.

Paypal support is useless at spotting fakes. I got a real paypal email (the received: headers and all embedded links pointed directly to paypal.com) but the email was not in my preferred language, and the disclaimer at the bottom said you can spot fake paypal emails by checking if they are in your preferred language. When I pointed this out, at first they claimed the email was fake. When I questioned them again and pointed to the received headers, they claimed the email was not fake and the language chosen was a bug. If paypal support can’t tell fakes from legit emails, how can regular users stand a chance at all!

That is not a legitimate website.

As of 5 hours after writing your comment, I get NXDOMAIN here (Australia, FWIW).

I would be confident to say that it was actively killed. Neat. Which is either a clear indication that PayPal finally did internally report the domain, or that some other source of noise got it shut down.

Obviously they're planning for additional incidents in 2018 and 2019 as well.

what happens if they get hacked again in 2017?

equifaxsecurity2017_final.com followed by equifaxsecurity2017_final_final2.com

This is wonderful, thank you.

Underscores are not legit in host names.

heh :) reminiscent of something like equifaxsecurity2017.PROPER.REPACK

I had the same suspicious impression of the domain name too --- I wonder what factors cause that, because it's clearly something not everyone has, and probably gained after years of web browsing. I think the two biggest things that stand out are:

    - Has "security" in its name

    - Has the current year

I can't explain exactly why I think those factors make it suspicious, however.

> I can't explain exactly why I think those factors make it suspicious, however.

I think I have an idea of why, though I haven't been able to articulate it properly yet.

I've been thinking about it a lot recently because I co-work with a bunch of digital marketers, and some of them have affiliate marketing sites with domains that follow the pattern http://yourexactsearchterm.com.

The best I can come up with is the Uncanny Valley of SEO, where it feels like a website was made and over-optimized specifically for people making my exact search query. Maybe this is unfair or confirmation bias, but I feel like those websites are the most likely to be low quality content farms (e.g. paying content writers pennies to regurgitate content they have no experience with and/or don't understand). Either that, or they are outright scams.

Do any digital marketers here have opinions about this?

"Uncanny Valley of SEO" sounds like the best explanation --- and in my experience, sites with names like you describe have also tended to be content farms.

It's not just domain names, but the paths in URLs too --- an entry with your-exact-search-term.html almost subconsciously gets skipped over when scanning search results, unless the search term is extremely specific and somewhat obscure or I'm specifically looking for a file/path (e.g. spc4r37.pdf)

I think it's because it's smells like arbitrary-but-plausible sounding additions to a domain name, picked until they hit one domain that wasn't taken yet.

Even worse would have been if they had used dashes equifax-security-2017.com.

(plausible for those without the experience of "suspicious impression", of course)

Reply on news.ycombinator.com