Gone (Almost) Phishin'
ma.tt
ma.tt
That advice is fine for the technically savvy but doesn't work for a lot of normal people who don't have the knowledge to mentally parse urls.
https://getsupport.apple.com/customer?cvid=8c11bcc71f684b6ab405d4fa1e86c146
https://getsupport.apple.com.phish.xyz/customer?cvid=8c11bcc71f684b6ab405d4fa1e86c146
I work with senior citizens and tried to explain how to parse the domain in the URL by looking for the first forward "/" after the "https://" and then scan backwards but they find that mental algorithm confusing and those instructions don't stick. (This is actually an area where some AI on phones/desktops could assist people decipher urls or mark them as suspicious.)
The other problem with that advice is people can't "whitelist" the legitimate domains to look for because they don't know ahead-of-time what they are. E.g.:
- An Amazon verification email will be sent from "account-update@amazon.com". It's intuitive to predict something coming from "@amazon.com" so a mental whitelist filter works in that case.
- However, State Farm Insurance legitimate login verification codes are actually sent from "noreply@sfauthentication.com" instead of the expected "@statefarm.com"
OneDrive email attachments link to, I kid you not, 1drv.ms, or maybe it was 1drv.com…
Not to mention, they use .ms as if it’s their personal TLD, but obviously anyone can register a .ms domain. It’s like they want people to get phished.
In fact, here we have the ma.tt website, where the ".tt" is Trinidad and Tobago. Is Matt Mullenweg from Trinidad? No!
And that's before we get into the really weird not-a-proper-country ones like .im or .pn.
At the time it did not break the rules. It's breaking the rules now because by the original rules it should have been phased out. What makes it survive is a special arrangement.
We can teach people as much as we want about security against phishing. It won't matter because people have to break these rules constantly. Companies actively train people to fall for phishing by doing everything in their power to be indistinguishable from phishing themselves.
Why would you want end users, senior citizens or not, to mentally parse URLs?
The rule is: If the bank, or paypal, or your landlord, or anyone else really emails you that you have to complete some information to your account or pay the latest bill or whatever, you GO TO THEIR WEBSITE and login normally. If it is important they will have the same information there.
The same rule also applied to unsolicited phonecalls, but it might be harder to follow: If your bank, or the police, or some other important person calls you and asks for information or for you to do something that feels the least bit off or hurried, you take their contact information, you look up whatever it is they want you to do and you CALL THEM BACK at the official telephone number of the bank or the police. You probably already have the number and if you don't it's on their web site. Do not call back on any other number.
People working the phone generally have much worse protocols than people working over email, so they may be less prepared for you to do this, but I have never heard of anything important that was emailed that wasn't also easily available when logged in to the website.
The only time it is appropriate to click a link in an email is when you are verifying your email address with them. Not for any other reason.
Yes, that is a "best practice" and good internet hygiene is to never click on email and text message urls but the reason they like clicking on legitimate email urls is convenience and usability. A helpful email link directly lands them on the relevant website page to do whatever they need to do. That's because the email url has a long string query parameters (id, etc) that automatically navigates to the correct webpage.
On the other hand, to do it the "best practice" way, it requires clicking around a confusing website menus and drilling several layers deep to find whatever issue the email is talking about.
A helpful email url link bypasses the hassle of learning whatever flavor-of-the-month confusing UI the website designer happened to to use.
Hang around old people and watch over the shoulder how they use computers and you become sympathetic to how the make it work for them.
E.g. An order status email has a URL link of a UPS tracking number to monitor shipping status. But don't click on that! Instead, copy the 1Z... number to the buffer. Then open a web browser and type in the ups.com url. Then paste the number into the text box. Those copy&paste mechanics not too difficult on desktop (Ctrl+C Ctrl-V) but it is much more difficult on mobile phones (double taps or long press and hold).
That was a simple example. The more complicated one is email from health and medical companies with confusing websites. They'd rather just click on the email url.
Are those things important? Well, never life-or-death important, for sure. Is getting 20% off your next order worth the risk of getting your account stolen? Probably not, but I suspect the majority of the population would still act as if it were.
Have you tried some analogy which will be personal to them? Like describing the URL as a family tree: “com is the oldest ancestor, like you Mr Johnson. Then apple is your son Bill, and getsupport is your grandchild Cody. If you saw ml instead of getsupport, that would be a different grandchild, but still in your family. However, when you see phish and xyz before apple and com you can think ‘I don’t know those people, they aren’t my father and grandfather’”.
The idea is imperfect but I literally just thought of it. We could certainly come up with something better that might eventually work.
Thank you for working to keep vulnerable people safe from phishing.
“You ever watch MASH? Remember the main guy, Benjamin Franklin Pierce? He’s not the same guy as Benjamin Franklin, is he? You can tell because you don’t stop after the first part of the name you recognize. You have to go all the way to the end and look at the whole name.
Well, same here!”
I notice that a lot of scam texts use domains that start with a TLD followed by a hyphen, like:
https://wa.gov-phish.fit/dol
https://seattle.gov-phish.cc/dmv
In some ways, it's a more convincing fake URL, since even if you're used to reading the domain right-to-left, your brain wants to start from the hyphen since it's a different character following a familiar TLD. But that type of domain also seems a lot easier for spam detection rules to catch.
This is how the scam page in OPs article is formatted, and I think it could easily fool a technical person who's tired. Precisely for the reason you touched on that when you're used to working with reverse DNS notation your eye is drawn to the last period. But hyphen and period are both used as "separators" in different contexts, so you have to be vigilant enough to override the natural instinct to chunk based on any separator.
Privacy issues aside, white-labeling the service and infrastructure behind *.irs.gov should be a mandatory requirement.
Might try explaining it this way?
It works the same way as a postal address. The first part before `/` is the envelope: by analogy it runs streetaddress.city.country.
You can give a name to your house, or add an apartment to the front - but that doesn't change the most significant part.
Yep, and there's even things like irs.gov which tells you how to know a site is official (https, and .gov), and then links you to id.me to login. (not sure what was wrong with login.gov, which SSA lets you use)
It's been a while, so I cannot name and shame X...
Meanwhile: “Microsoft support uses the following domains to send emails:
microsoft.com
microsoftsupport.com
mail.support.microsoft.com
office365support.com
techsupport.microsoft.com” [1]
[1] https://learn.microsoft.com/en-us/troubleshoot/azure/general...
The first time I got those I couldn't believe these were legitimate. Thank you Microsoft for teaching your customers how to fall for scams!
"Sign up for Uber Eats and win 50,000 MXN of credit https://bit.ly/1234"
What's funny is that they also send these over the same channel:
"Warning: Telcel will never call you nor ask you for your personal info!"
Gee, maybe stop priming your whole customer base to click on messages identical to spam?
Another fun one is facebook, they use facebookmail.com or whatever else for serious security stuff
Or aka.ms
And then, this is important, look up the number for the customer service hotline online.
I feel like this is a simple solution that works 100% of the time.
I told him, next time call the number on the back of your card.
Luckily my parents are appropriately cynical and have not fallen for anything like that, but I know a couple of people of my generation who have (in the worst case losing 5K+ in savings, back when there was no onus on UK banks to take any responsibility for such fraud through their systems so it was properly lost to them).
If my family are anything to go by, they definitely target the elderly more than even one generation down (so it isn't just due to those of the younger generations often only having mobile phones and landlines are more targeted) because they know those tend to be more susceptible to the con and more likely to have some savings worth pillaging.
Also in DayJob, some of our C*s and others associated with them (PAs, office managers) have seen some pretty sophisticated phishing attempts, both targeting the business's dealings and their personal accounts. I get the impression that these are reducing in number ATM (or the filtering of them is improving) but that those coming in are making an increasing effort to be convincing.
But regarding scammers, asking "is your mother proud that she raised a thief?" really annoys them.
One of them threatened to come over and rape my sister.
I don't have a sister.
I don’t think they can pass DMARC, though.
My wife was almost scammed, a few years ago. What tipped her off, was how extremely good the “tech support” was. Real tech support is generally someone on a scratchy line, with a heavy accent, following an inappropriate script.
Even after she backed away, they sent a few followup snail mails, looking somewhat legit (cheap printer).
Sure, I may be missing out on some opportunities. But the peace of mind is far greater.
Besides that, people should sign up with random email aliases just as much as they sign up with random passwords.
Here is a free crossplatform workflow: New, free Proton Mail[1]-->Free Bitwarden[2] account with single master password memorized[3]-->duck.com[4] alias pointing at Proton Mail-->Extract[5] duck.com api key to generate random duck.com alias for each site in Bitwarden-->Sign up for new service using new random email+password in seconds and never have to remember it and no spam.
Here is a simple crossplatform workflow: Paid proton suite[6]-->Single memorized master password[3]-->Generate random email alias and password for new services using proton pass.
If you use iCloud+ you can generate email aliases using a Raycast[7] extension or a browser extension[8] or inside of safari natively. There is also iCloud+ settings, but that is a pain to get to.
[2] https://bitwarden.com/go/start-free
[4] https://duckduckgo.com/email
[5] https://bitwarden.com/blog/how-to-use-the-bitwarden-forwarde...
[6] https://proton.me/mail/pricing
[7] https://www.raycast.com/svenhofman/hidemyemail
[8] https://chromewebstore.google.com/detail/icloud-hide-my-emai...
https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/201...
a policy that's been talked about for more than 10 years and that the industry is almost catching up to.
Seems easily digestible and approachable for a specific target audience.
I personally use bitwarden on my chrome profile across Windows Mac Linux and android and think it's great. Highly recommended.
Of course I tell this to family and friends and no one does it so I dunno...
"Thanks for the concern, I will call you right back"
If your bank calls you, you turn off the call and call them. Don't take suggestions for contact address. You look them up, and you call them. Don't elaborate. The scammer is either and idiot and will try to call you telling to stop, or smart and fuck off. And if it was the bank, they'll at best, pick right back from where you left it, and at worst, learn better from the event.
Why do I need to go to Settings? I get these occasionally and ignore them; what harm is there in that?
FWIW these were real bad for a while, but Apple seems to have gotten better at canning the spam. Maybe 1-2 per year?
For my parents in their 70s, even more so. No amount of reminding them to read URLs first is going to help.
So my question is: what are best practices to limit the blast radius when I (or they) inevitably click the wrong link?
I know that after a phone has been stolen, attackers want to gain access to an Apple account to remove the activation lock. But in this case, no devices had been stolen yet. The most they could do would be to… remotely mark the devices as stolen? Then ask the victim to pay to unlock them?
Disgusting to me that even the most basic of logic for what would be someone stealing an account: has the account been used in years, would this person we have location data for ever be in India setting up a new computer, with a computer type ID we know is compromised to hackintoshes (iMac Pro) wasn't enough of a red flag to send me an email confirmation first.
Luckily the account was so old iCloud barely stored anything back then but still shocking to me.
Both times, they asked me to go to a BS "apple-support" website and enter a six digit number they'd read out to me, where I'd see a transcript of this very phone call so I could then have full assurance that they were legit and working for Apple.
Uh huh.
And both times, when I asked them to just send me a quick email from their address at Apple (any address, even a generic inbox or support address) to assure me they worked for Apple ... pause ... [click]. Yeah.