Identifying (spoofed) Web sites (IE)

Printable View

January 29th, 2004, 02:25 AM
ShagDevil

Identifying (spoofed) Web sites (IE)

I noticed that fake links and website spoofing are on the rise lately. These types of threats are in my opinion, the most dangerous as these attacks tend to retrieve the most amount of personal information possible in one easy attack. Usually the standard is some kind of 'your account will be closed immediately if you don't fill out this form...." yadda yadda. I feel bad for people who are just trying to do the right thing and 3 months later get a credit card statement in the mail accusing them of purchasing 12 round trip tickets to the North Pole. In any event, I found this link on M$ database that provides some javascript in order to test validity of the web site's address. There are other helpful things on this site as well. Check it out, let me know what you think.

http://support.microsoft.com/default...#91;ln];833786

Note - I believe this is only designed to be used in conjunction with Internet Explorer.
January 29th, 2004, 02:31 AM
MrLinus

Quote:

I believe this is only designed to be used in conjunction with Internet Explorer.

Yup. That's because MSIE is the browser that is affected by it the most. URL Obfuscation is what the term is and what we're seeing a rise on is "phishing" using that obfuscation. Making URLs "neat" and "clean" isn't always the best.

In addition, MS needs to have an option to remove HTML from incoming (not just outbound) emails and have it set as default rather than having HTML emails set as default.

Interesting in that link I found another article and it stated the following:

Quote:

To turn on the Read all standard mail in plain text option, follow these steps:

1. Start Outlook 2003.
2. On the Tools menu, click Options.
3. On the Preferences tab, in the E-mail area, click E-mail Options.
4. In the Message handling area, click to select the Read all standard mail in plain text check box.

Note By default, the Read all standard mail in plain text option is turned off.

This is, of course, for Outlook 2003 ONLY. Although IIRC the default of HTML email is turn on for all Outlooks.
January 29th, 2004, 02:35 AM
576869746568617

That's the way the new breed phish. It's genius (evil genus, but genius nonetheless)
January 29th, 2004, 02:41 AM
moxnix

Actually this info works with Mozilla Firebird also. Good find.
January 29th, 2004, 02:59 AM
jenjen

yes.. and opera will give you a warning .. if you use that browser..

heh.. one of ms's fixes is to type in the url.. ok.. uh huh..

it's a pain to do this, but what I'd suggest for folks who might suspect a link is..

right click, copy shortcut, paste into new browser url window.. you'll be able to see the odd characters inbetween the two addresses..

edit 2: I put up a small site the other day and I'm trying to get Ted to help me with it.
If I can convince him that it's worth the effort, that is.. :rolleyes:

it's not complete (only two pages so far).. and it's really my first serious venture into creating a site to help out newbies to the net.. If you want to check it out and pm me comments/suggestions.. (or if you think you want to help by putting in content...)

it's here.. http://www.freepgs.com/jen_ted/

heh.. it's best viewed in IE.. LOL.. I have a neat little clock on page two but it won't show up in either opera or mozilla for me.. but these two browsers haven't been updated by me, so maybe it does work.. let me know if it does or doesn't, thanks..