Slashdot Log In
Voice Phishing Hits PayPal
Posted by
CowboyNeal
on Sat Jul 08, 2006 12:26 PM
from the eight-six-seven-five-three-zero-nine dept.
from the eight-six-seven-five-three-zero-nine dept.
Chai Vanilla writes "The latest social engineering phishing attack is now using phones instead of fake web sites. Identity thieves have spammed fake PayPal account compromise warnings to lure users into dialing a phone number and giving up credit card information. Unlike normal phishing e-mails, there is no URL or response address. Instead, the e-mail urges the recipient to call a phone number and verify account details."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Tracability? (Score:5, Insightful)
Not in the VoIP era (Score:4, Interesting)
Parent
Oh, just to clarify (Score:2)
Re:Tracability? (Score:5, Informative)
Haha ! Welcome to the world of Phreaking [wikipedia.org]... You might not know it but the telephone network is as easily hackable, vulnerable and exploitable as the Internet is today. Good luck tracing the bad guy who impersonated your credit card company you supposedly called on 1-800-XXX-YYYY, when he might have penetrated voicemail systems, set up temporary forwarding, hacked telephone switches, etc...
Parent
Re:Tracability? (Score:5, Informative)
Parent
Re:Tracability? (Score:4, Informative)
The SS7 network is certainly not built with security in mind - once you've gained access to a system connected to the SS7 net you've got a pretty free reign. Pretty much any large VoIP gateway will have an SS7 connection on one side and an internet connection on the other so crack one of them and you're sorted. Not to mention all the SIGTRAN enabled equipment that some moron has decided to plug into an unfirewalled internet connection.
That said, I suspect the worst you'd be able to do is spoof a few calls, send a few SMS messages and add a few records to the billing systems.
Besides, there are much easier ways of getting an anonymous DDI - just use one of the many PSTN-%gt;SIP gateways.
Parent
Re:Tracability? (Score:3, Informative)
You think the phone company would just tell you who a line belonged to if you called them up?
Nope. Even if the other party is calling you and harrassing you repeatedly you would have to file a police report and get the information sopenaed. The telco doesn't want to be named in any lawsuit if someone goes vigilante after getting the info.
You can use reverse di
Re:Tracability? (Score:4, Insightful)
You've got to admit it *seems* reasonable. After all they handed over the information on every call made in the country to the government without even blinking. Why not tell a customer about one little number?
Parent
Re:Passwords (Score:3, Interesting)
One guy up here was convicted for "hacking" into the local police squad's voicemail system.
Everyone's password was (and I'm not making this up, and its NOT a Spaceballs reference) "1" "2" "3" "4" "5"
For months he listened into all sorts of messages for the detectives, including from informants, wives and girlfriends (nice to be able to blackmail a cop by threatening to tell his wife about his action on the side), etc.
You KNOW most systems have an easy password (or still have the default password).
C
Re:Tracability? (Score:3, Interesting)
You're confusing number with proportion. How many people EVER go to jail for phishing? Try reporting it to your local cop shop - you'll get the "we don't handle that here" bit. Then you're told to post your complaint to such-and-such a web site ... and nothing happens, because they're after the easy-to-bust ones - they guys running boiler-rooms going "You've just won a vacation, just send us the money for the taxes and duties."
They HAVE the tools to deal with that, so that's what they do. They DON'T hav
Easier to track? (Score:2, Redundant)
Got that yesterday... (Score:5, Interesting)
Where can one complain about such fraudulent 1-8xx numbers to get them shut down? Additionally, how much does calling a 1-805 cost in the US, and is any part of the cost passed to the operator?
Re:Got that yesterday... (Score:4, Informative)
Parent
Re:Got that yesterday... (Score:3, Informative)
From 411.com reverse lookup:
(805) 214-4801 is a land line based in Newbury Park, CA
The registered service provider is Pacific Bell**.
Detailed listing information is not available.
**Due to number portability, some numbers have been transferred to a new service provider
Re:So what duped you? (Score:3, Informative)
No, I wasn't scammed. Which part of my posting misled you into believing that I could possibly have entered my real credit card number?
not surprising (Score:5, Interesting)
There's a small degree of higher risk, but if you get a new disposable cell phone every three days and move around all day you'd be a hard mark to hit.
Too many people are now aware of the "don't click the link" aspect of phishing, but I'm sure there are still pleanty of suckers that assume if they have your phone number you must be legit. I would not be surprised if they find a way to do this through US Mail in a way that hides their identity.
It would be interesting if one day, to get such an online account set up, they make you pass a short test, where they give you ten examples of people asking for your account information in various ways, and you have to answer "give them the information" or "report the incident to phishing.ebay.com". Anyone that answers "give them the information" on any of the questions doesn't get an account.
I wager that alone would eliminate 80% of successful phishes.
In school, not when signing up... (Score:3, Insightful)
I would dearly love to have a high-school level course in computer usage, which would be required for anyone to connect to the Internet. Not going to happen, I know...
Maybe just make it a part of the general education requirements?
Most people think I'm a snobbish bastard, like every other Linux user. Which is true, to some extent. But I do believe we have a right to call people stupid when they do things li
Re:In school, not when signing up... (Score:5, Insightful)
Did you know that 85% of dead televisions just have a blown fuse? Did you know the $120 transmission fluid replacement at Jiffy Lube is a twelve dollar bottle of green grease, and the opening and closing of one valve? Did you know that almost everything a plumber ever actually does is run a drain snake and a plunger?
I mean, we have Sex education, we have Driver's education, I don't think it's unreasonable that we know the computer equivalent of wearing a condom, stopping at red lights, buckling your seatbelt...
Here's the difference: one costs people their lives, the other costs them an hour at the local computer shop. I don't think it's unreasonable that we know how to maintain appliances; nonetheless, nobody requires it, because that's batshit retarded.
Most people think I'm a snobbish bastard, like every other Linux user.
It's got nothing to do with your being a Linux user. It's because you're condescending and because you can't fathom that some people don't have the time or the desire to learn to maintain their computers. Believe it or not, some people have better things to do with their lives.
Next time you pull into a jiffy lube, call a repair person, go to a barber shop, buy art tools, purchase clothes or engage in any service activity whatsoever, please remember that that's something you could learn to do and then spend your life doing, just like a seventy year old woman could spend a year reading tech sites and manuals and getting up to speed on jargon.
Guess what? You don't want to either. You're just too dense to tell the difference.
Parent
why no phishing stings? (Score:2)
Paypal -- reachable by phone? Ha. (Score:4, Informative)
Use someone else (Score:2)
Perhaps losing customers might encourage companies to start signing official emails.
"Latest" attack? (Score:5, Informative)
[ring, ring]Hello? Hello, is this $TRUSTINGSENIORCITIZEN? I have wonderful news! Congratulations, you have just won a diamond ring in our marketing lottery! There are some shipping and insurance fees, so if you'll just give me your credit card number...".
Law enforcement and consumer groups said over and over not to give out sensitive information unless you placed the call yourself, which is really the same advice as "don't click on the link" if you think about it.
Woah, timely! (Score:4, Interesting)
(530) 204-6800 is a land line based in Davis, CA
The registered service provider is 01 Communications**.
Detailed listing information is not available.
I got one yesterday... (Score:3, Informative)
Regardless of the technicalities, because it didn't have the usual telltale signs it really made me wonder. I then checked into my account the usual way, noticed nothing was wrong and then forwarded the email to spoof@paypal.com, receiving a reply this morning that it was indeed a phishing attempt.
The thing is, on this site we always talk about how clueless people are, and I have participated myself on occasion. But after talking with my wife and in-laws yesterday I realize how *easy* it is to dupe 95% of the computer using population using these tactics. These are people that are educated, smart and generally not clueless in life... but when it comes to computers they are. I had to explain to my sister-in-law why my brother-in-law was receiving Cialis/Viagra emails shortly after posting their clean (well, it was) email address on petfinder.com. My point is, it may seem like there is a low percentage of willing responders to a phone phishing attempt, but I can say from my observation that this new technique should be more successful than ever!
I just wonder isn't it really easy to trace phone numbers?
Sample (Score:4, Informative)
PayPal
Account Verification
Dear $email_addres
You have received this email because we have strong reason to belive that your
PayPal account had been recently compromised. In order to prevent any fraudulent
activity from occurring we are required to open an investigation into this matter.
If your Credit/Debit Card on file is not updated within the next 48 hours, then will
assume this account is fraudulent and will be suspended. We apologise for this
inconvenience, but the purpose of this verification is to ensure that your PayPal
account has not fraudulently used and to combat fraud attempts.
To speed up the process, you are required to call us ($phone_number) to verify your
PayPal account.
We apologise in advance for any inconvenience this may cause you and we would like
to thank you for cooperation as we review this matter.
Regards,
PayPal Account Verification.
Copyright (c) 1999-2006 PayPal. All rights reserved.
--
Please do not reply to this e-mail. Mail sent to this address cannot be answered.