New Phishes and I’m moving!

Aug 13 2010 Published by jayras under Posts

Well, looks like the level of Phish activity wasn’t as frantic as it was last week, but I still did get a fair number of Phishes.

Including 2 new phishes!!

Suspicious Activity is a lovely little Phish where they are saying your payment has been canceled due to suspicious activity and you have to login to verify…wait…locked…logged in…AAAAHH!!

Automatic Recovery a really neat Phish.  This one claims they have a new website for recovering hacked accounts, which requires you to visit a site and wait for 2 days while they investigate.  And then…and this is the best part…if you don’t hear from them in 2 days, do it all over again!

Here are the counts of last weeks activity:

5 Beta

1 Account Change Confusion

1 Controversial Account Transaction

3 Selling Account

3 Account Invasion

On another note:  I feel I’ve reached the limits of patience with trying to do a Phish Library in WordPress.  It’s a great blogging tool, and I’ll still use WordPress for my blog.  But trying to keep a library of pages just doesn’t fit in WordPress’ feature set.

So, it inspired me to get a real domain!!!

Yes, that’s right

I’ve got an official domain for this wonderful site now:

Welcome to PhishWorld.com!

The world of Phishes, all for you at a low LOW price of just $19.95

…ok, maybe not

But ya, http://phishworld.com is up (Although not a lot is there…just my fish tank.) and the blog should be up in short order over at:

http://blog.phishworld.com

So, get ready to update your bookmarks and when I get the blog running I’ll post a notice.

For now, everything will stay the way it is and all content will still be in WordPress until I get the library all up and running the way I like, it’ll just be all on blog.phishworld.com

YEAH ME!!!

Comments are off for this post

Security Update at Blizzard, and new Phishes…

Jul 29 2010 Published by jayras under Posts

Posting a day early, this is just a notice about a specific change Blizzard made last week (That I missed..sorry for not mentioning it sooner.)

I had the unfortunate pleasure of getting locked out of my account.  Luckily it wasn’t a case of getting Hacked.  No, it was more stupid than that.

I got a new iPhone!!

Of course, I didn’t prep my account and I did format and turn in my old iPhone so I no longer had access to it.

When I got home, I soon realized my mistake when I went to login to Warcraft and when I launched my Authenticator it was giving me steps to register my NEW authenticator (WHOOPS)

So, next morning, I use my new iPhone and a headset and sat on Hold for 37 minutes (Yes, I counted…)

They drilled me, asking me question after question, making me PROVE to them that I am who I say I am (Good for you Blizzard!!)

In the end they pulled my old authenticator off, and sent me on my way to put the new one on.

During the process I noticed they added a step.

No longer can you just simply drop in a Serial number and wam BAM you have an authenticator (Which, unfortunately, hackers did all the time.)

No, now you put in the serial number, and then they send you an e-mail!

And from that e-mail you must click the link!

This is perfect…it means any hacker would be notifying themselves to you when they attempt to steal your account, and you are smart enough to scream HEY!! I didn’t do that, and NOT click the link!!

Here’s the new process:

  • Log onto Battle.net Account Management (http://www.battle.net/account/)
  • Click on Settings, then click Manage Security Options
  • Click on Add this authenticator
  • [new]—>Required confirmation link sent to your Battle.net account email address
  • You log onto your email account itself, look for an email titled Battle.net Account Authenticator Addition from noreply@blizzard.com with a link to loop back to Account Management. This contains a one-time use token.
  • Add a mobile or keychain authenticator
  • Now you have an authenticator

More information on the change can be found here:

Forum Post on the new change.

Now, for the bad news…

Blizzard broke one of their cardinal rules…the e-mail you get is not Personalized.

AND…I’ve already received a fishing attempt with this new e-mail (Its is a direct copy…with a new link….)

So, if you are adding an authenticator…make sure you are looking at a good e-mail and not a phish, scrutinize the header and make sure it isn’t from Hotmail, and it is from Blizzard.

Comments are off for this post

Busy Phishing Week: Cataclysm Beta is Live.

Jul 09 2010 Published by jayras under Posts

What a week.  Early this week the inital beta program for the Cataclysm expansion went live and the first wave of invites was sent out to the lucky players!

Of course that means we got a MASSIVE wave of Beta Phishing e-mails.

Fortunatly for the player the Phishers aren’t all that original…and the e-mails that went out are the same we’ve all seen telling us to make sure our opt in’s are up to date.

But some did mention downloading the client.

So…for all of you that are eagerly awaiting your chance to get into the Beta here is the lowdown on how the beta works and some safety tips.

  • Yes, you do have to opt-in for the beta.  If you didn’t opt in then you won’t get invited.  Login to your account and make sure you have your beta profile up to date. (Don’t click any links in any e-mails…just login to your battle net account and update your profile.)
  • There isn’t some special, fancy-shmancy domain for the Beta, you get all the information and the link to the downloader from your Battle net account.  Not from any other website.
  • If (and when) you are selected to participate in the Beta you will receive a notification.  It will probably look a lot like the phishes.  So, just don’t trust any of them.   Just login to your battle net account (NOT using any links) and if you are indeed accepted in the beta you will see the box graphic for Cataclysm alongside the box graphic you have now for WOW.

  • There is no other location to download the Cataclysm installer.
  • If you think you have a secondary, legitimate location to download the installer, you don’t.  Only get it by clicking the link from your battle net account.
  • There is not Beta Keys…with the battle net account system the need for Beta keys went the way of the Dodo.
  • There is no other form you need to fill out.
  • There is no other reason to type in another bit of information to get into the beta. (Provided you have your beta profile updated.)

So, there it is.

I’ve said it before and I’m going to say it again:

YOU are the prime target for these phishers.

They’re getting sneaky.

If you have ANY doubt, just don’t click any links at all.

There is no necessary reason to click the links.

Everything you need can be gotten by logging into your battle net account.

Here’s the rundown of the Phishes I got this past week:

  • 11 Beta
  • 3 Selling Account
  • 1 3rd party
  • 1 corrected IP
  • 2 In view of Recent…  (Haven’t seen this on in MONTHS and I get two right in a row…)
  • 1 Account Change Confusion

Comments are off for this post

Lots of Phishes and new twists

Jul 02 2010 Published by jayras under Posts

Over the past couple of days I’ve gotten 7 phishes.

Mainly the usual stuff with Account Changes, Beta sign ups, banned IP’s

But then there’s a new one.  Well, not really new…its very similar to “In view of recent…” but with a “Good Times” twist:

New Phish

My favorite part of the new one:

your account occurred in the number of illegal transactions in a very long period of time.

Ooooh…sends chills up your spine.  The legal speak of it is just flawless and is so ominous you just HAVE to act now and click the link.

OK, so I jest…its Engrish in its finest form and I don’t know WTF they are talking about.

————————————————————————————————————

New fashion in the Phishing word:  Incident or Case Numbers.

Lately, I’m getting a lot of “Issue #” or “Case #” or “Indicdent #” on the end of the subjects of the phishes.

I’m guessing this is an attempt to make them sound much more official.  Cause after all there is a number I can no reference if I need to talk to somebody about the issue.

And I’m sure when I call Blizzard and give them this number it’ll make sense to them…or NOT.

Domains being used by these Phishers are getting more creative:

  • batltle.net
  • www.worldefwaroraft.com
  • www.wow-identification.com

Then there’s this idiot:

www.worldofwarcraft-logins-blizzardaccounts.com:8088

Well, create a nice domain that could conceivably make someone think its legit.

Then hook up the website on port 8088

So, if you are behind any firewall or proxy at all there is a 94.325% chance you can’t even get to the website.

(For those of you that aren’t as geeky as I am…Web Traffic goes on port 80, and pretty much anything over 900 is blocked automatically by firewalls.  There used to be a convention used by some webmasters to put in dev websites up on port 8080, but port 8088 would be foreign to anyone.)

Oh well, one more chance someone mistakenly clicks a link won’t get hacked.

————————————————————————————————————–

Speaking of which, let me digress for a few minutes.

Apparently users (or maybe its the tech support) of  “My Space” seem to have the complete wrong definition of “getting phished”

Do a search on Twitter for “Phished” and you get a ton of posts by My Space users who have gotten hacked and people taking over their accounts but they always post something like “sheesh…I got phished again”

Either that, or they are getting phished and are just to light headed to stop clicking links in e-mails?

Comments are off for this post

They’re getting sneakier!

Jun 28 2010 Published by jayras under Posts

So, for those that asked (and care) my back is doing much better.

I managed to last 3 days+ of not sneezing, but then managed to sneeze 5 times on Saturday…all “normal” sneezes that just had a twinge on my already damaged back and nothing catastrophic again.

Over the past week I’ve received 10 phish e-mails. 4 Bad Beta Barrages, 2 Account Change crack ups. 1 Facebook funkiness Phish.

And then 3 strange ones…

First…

This one looks to be a new variant on the Corrected Hacker IP Phish, it uses the 3 IP Ranges, but at least this time the 3 IP ranges are all the same.

It’s the domain it links too that makes it stand out. It’s SNEAKY!!

The link displays in the e-mail as:

http://us.battle.net/login.xml?ref=https%3A%2F%2Fus.battle.net%2Faccount%2Fmanagement%2Findex.xml&app=bam

But the actual link is (Remember folks, don’t go to these addresses, they are purposely not set a links you can click!)

http://us.battle.net-https3asfdffaa2f3f5g-worldofwarcraft.com/

Now, if you remember from earlier lessens, work backwards to see who is the owner of the domain, based on periods (.)

So…break this one apart (working backwards) you get:

  • com – Standard, almost everything is a COM…we’re good so far.
  • net-https3asfdffaa2f3f5g-worldofwarcraft

Here is where it starts…

After the net is NOT a period, it’s a dash, so that’s not a domain separator so that’s not the end of the domain segment. its net-https3….which is basically some well crafted face rolling.

We’ve all seen links crop up, that are a lot like the displayed link…with %3A’s and %2F’s and the like.

These are called “escape codes” that are done to prevent invalidating a URL, %3A is actually a colon ( : ), %2F is actually a slash ( / )

But in the domain above they left out the %’s (Which aren’t allowed in domain names) and put in some gobbledy gook that’s similiar to trick you into thinking the net was the end of the domain and the rest is just part of the URL that we see everywhere.

Then the rest:

  • battle
  • us

So by lessons earlier…the domain is a COM domain (originally for commercial use, but turned into the “default” domain)

And the domain name is : net-https3asfdffaa2f3f5g-worldofwarcraft

Which looks like worldofwarcraft, but isn’t.

Like I said, SNEAKY!

Oh…and not Blizzard.

And then there’s more sneakiness…

I got 2 e-mails that made it look like my account and characters are being restored from a hack.

Not have been hacked, I know this is obviously a Phish. My guess is the phishers are attempting to blast out these e-mails to hit someone who is already hacked (Which doesn’t make ANY Sense at all…as the account is already hacked, or the user is hopefully a lot more skeptical on these things by now…)

Or they are trying to invoke the “Panic response” from people. The ones that aren’t currently logged in…catching up on their e-mails. See this e-mail and PANIC and scream “OMG what happened??!!!??” and click the link to find out and then BOON…GOT YA…Hook, line and sinker…

Content of the e-mail is fairly coherent, and I can believe its a copy from an actual e-mail one would receive when getting restored. (Can’t validate it 100% though.)

The e-mail has 3 links, 2 of them are “safe”, but one is not.

It’s fairly obvious too. The displayed link and where the link takes you are the same: wowarmybattle.com

So ya, not Blizzard.

The second e-mail is a list of items restored. All real items, but nothing any of my characters would be caught dead wearing (Diabolic Skiver and Scholomance Gear??)

Just one link in this one going to: blizzard-game-info-admin.com

Which is not Blizzard.

Comments are off for this post

Database of 210,000 WOW Accounts found.

May 27 2010 Published by jayras under Posts

Symantec, in pursuit of a lead of a key logger, ran into a sever with a DB that had 44 Million different login credentials of several games.  Out of that was 210,000 World of Warcraft Accounts.

There’s no way to tell if these are still valid credentials or not, nor is anyone sure the source of all these credentials (Probably from several different sources.)

However, along with this Symantec has discovered the owner of the DB was using a “Bot net” using a malware hack called “Trojan.Loginck” which receives information from this DB, attempts to perform logins to various games sites and sends back information if they are successful.

This would allow the owner of the DB to check and validate these 44 million credentials, otherwise going through this manually (Even with all his friends) would take years.  Especially if the gaming sites noticed a ton of login attempts from the same IP Address and decided to investigate and block the IPs.

Source:

http://www.symantec.com/connect/blogs/44-million-stolen-gaming-credentials-uncovered

Comments are off for this post

Ͼ http://www.pthkm.com/xpjylc/ http://www.pthkm.com/bgylc/ Ͼֳ http://www.pthkm.com/pjylc/ ewinֳ http://www.ybewv.com/ewinylc/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ Ŷij http://www.aojxq.com/amdcgl/ bet http://www.lpmwq.com/bet365ylc/ ȫѶ http://www.wfgpb.com/qxwgw/ 188 http://www.ywiql.com/jbb188gq/ bet http://www.nwiza.com/bet365ylc/ 365 http://www.rvodp.com/bet365tyzx/ Ͼ http://www.yjzhv.com/smxpjgw/ Ͼij http://www.utssx.com/ampjdc/ ˹˶ij http://www.bkrft.com/amwnsrdc/ Ͼij http://www.bkrft.com/pjdc/ ƶij http://www.bkrft.com/yddc/ Ŷij淨 http://www.bkrft.com/amdcwf/ ȫѶ http://www.bkrft.com/qxwzx/ ˹ά˹ij http://www.fldwd.com/lswjsdc/ ζij http://www.fldwd.com/lwdc/ ŶijЩ http://www.fldwd.com/amdcynx/ ij http://www.fldwd.com/mddc/ ˹˶ij http://www.fldwd.com/wnsrdc/ Ͼij http://www.yuwew.com/amxpjdc/ ĥij http://www.yuwew.com/mddc/ ijϷ http://www.yuwew.com/dcyx/ ĥƽij http://www.yuwew.com/mdhjdc/ ĥij http://www.hgvnk.com/lwmddc/ Űټ http://www.hgvnk.com/ambjl/ ټϷ http://www.hgvnk.com/bjlyx/ ˰ټ http://www.hgvnk.com/zrbjl/ http://www.dnczv.com/bcw/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/amdc/ ֳ http://www.yjzhv.com/ozylc/ Ŷij http://www.luyouren.com/aomenduchan/ bet http://www.lsylnj.com/bet365/ Ŷij http://www.lsylnj.com/amdc/ ټ http://www.lsylnj.com/bjl/ http://www.lsylnj.com/bcw/ ˹ http://www.lsylnj.com/wnsrylc/ Ͼ http://www.lsylnj.com/xpjylc/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinyulechen/ bet http://www.luyouren.com/bet365/ ټ http://www.luyouren.com/bjl/ Ŷij http://www.luyouren.com/amdc/ Ŷij http://www.luyouren.com/amduchan/ Ŷij http://www.luyouren.com/aomendc/ Ŷij http://www.luyouren.com/aomenduchan/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinylc/ ewinֳ http://www.luyouren.com/ewinylchen/ ewinֳ http://www.luyouren.com/ewinylec/ ewinֳ http://www.luyouren.com/ewinyulc/ ewinֳ http://www.luyouren.com/ewinyulechen/ http://www.dnczv.com/bcw/ ټ http://www.dnczv.com/bjl/ bet http://www.dnczv.com/bet365/ ˹ http://www.pthkm.com/wnsrylc/