CERT Warning

Quote:

---

My source said he copied it directly from here:

https://us-cert.esportals.net/membe...mpartmentP=2135

Now I am not a member so I can't log-in to verify.

Cheers:

---

The uri above points to a page connected to these people: http://www.espgroup.net/ns_4x/index.htm

Does cert not host there own web pages?

I think the key being missed in most of the discussion here is that fact that the page is not accessible to the general public. You must have a login to the site to *properly* access the information. So despite whatever US-CERT/DHS does behind the scenes to gather information and track trends, this is not an official alert or anything of the sort. Keep that in mind when looking through this thread. This is something that was forwarded and posted here...NOT a public announcement.

Hmmmmmm,

The site referred to has now vanished

::hide-beh

I guess it was getting too many hits?

The site is still up. The quoted link tends to shrink down with extra ellipses. You can access it here.

You know, perhaps for future reference (and I'm surprised no one asked) but check the header info to verify the source of the email?

Additionally, has anyone notified CERT as a potential attempt to phish for the accounts of those going to the real version of this site?

Interestingly, there is also this site.

Seems to me that the US gov't wouldn't do this and if these were legit (which I question if they are) there'd be a link from here

Well esportals, espgroup and this lot:

http://www.semperfiglobal.com/main.htm

Seem a bit too complex for a phishing attack. There is a demo of the esportals service about half way down the semperfi site.

Cybercops is another outfit that uses them.

Is this not typical of a hoax?...............they usually quote Microsoft, or IBM or Symantec or some other "reliable" source.....................this is a bit more subtle...........a secure security related site, that you cannot check out.

Quote:

---

Seems to me that the US gov't wouldn't do this

---

I am not so sure, there does seem to be a tendency for them to outsource/subcontract all sorts these days, and as this seems to relate to interfaces with the public sector, it would provide a sort of cordon sanitaire?

EDIT here is some more info about the secure portal:

http://64.233.183.104/search?q=cache...sportals&hl=en

This is an interesting overview of how the portal is secured:

http://www.securitymanagement.com/library/001627.html

Quote:

---

Originally posted here by MsMittens
[B]The site is still up.

You know, perhaps for future reference (and I'm surprised no one asked) but check the header info to verify the source of the email?

Additionally, has anyone notified CERT as a potential attempt to phish for the accounts of those going to the real version of this site?

---

The e-mail was sent to me from an employee of our company (header records confirmed), this employee say's he has access to that site and the information in the e-mail was a cut and paste from the site. Now before you ask, I can't go see the employee to verify (he's about 3000 miles from me) and he doesn't want to pass on his id and password to me. (I trained him well :D )

I have sent an e-mail to CERT, but as yet, I have had no reply.

Cheers: