We received a phishing email a few days back, and I figured it might be good to go through the general process I went through to identify the email as a scam and research it a bit.
So, I received an email message to the D-kriptik support account purporting to be from Paypal. I was using Thunderbird as my mail client, and it was configured to display email messages as plaintext. As such, the email message was displayed as blank, but the From: field was “service@email.paypal.com” <update@paypal.com> and the Reply-To: field was “account@paypal.com” <service@email.paypal.com>.
Now, I already knew this message was a scam. We have email addresses dedicated to various purposes, including specific addresses used as email contacts for specific accounts, such as Paypal accounts. The D-kriptik support address listed on our main web site has never been associated with any Paypal accounts, so this message was obviously a fraud. Not to mention, the message displayed as blank and the Paypal email addresses just looked off. So, I could have just deleted the message at this point, but I was curious.
(Important note: The use of “xxx” is an edit made by me to slightly mask IP addresses, and it is used throughout this post and referenced files.)
So, I pulled up the raw message using View->Message Source (CTRL-U) in Thunderbird, and the header contained the following. (I have posted the raw message here.)
Return-path: <service@email.paypal.com>
Envelope-to: support@d-kriptik.com
Delivery-date: Mon, 21 Nov 2005 11:07:14 -0500
Received: from [213.146.116.xxx] (helo=213.146.116.xxx)
by cwpro1.crosswinds.net with smtp (Exim 4.52 (FreeBSD))
id 1EeEBr-0009SZ-0T
for support@d-kriptik.com; Mon, 21 Nov 2005 11:07:14 -0500
Received: from 189.144.176.xxx by ; Mon, 21 Nov 2005 10:01:28 -0600
Message-ID: <UKFDKVGIILJMJPLEEIZLIG@verizon.net>
From: “service@email.paypal.com” >update@paypal.com<
Reply-To: “account@paypal.com” >service@email.paypal.com<
To: support@d-kriptik.com
Subject: Security Notification
Date: Mon, 21 Nov 2005 13:03:28 -0300
X-Mailer: Microsoft Outlook Express 5.00.2615.200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=”–14555300788773238150″
X-Priority: 1
X-MSMail-Priority: High
(The use of “213.146.116.xxx” is an example of the “important note” above.)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=”–14555300788773238150″
X-Priority: 1
X-MSMail-Priority: High
—-14555300788773238150
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable
Well, now we can see why the message was displayed as blank. The message was composed solely of a single MIME encoded HTML content. Since my mail client was not configured to display such content, it displayed a blank message. This is also strange as most companies take the time to at least contain a token plaintext message in the email bodies just for the purpose of covering customers that only display email as plaintext.
Message-ID: <UKFDKVGIILJMJPLEEIZLIG@verizon.net>
Strange, I’d expect this to contain something along the lines of “paypal.com”, not “verizon.net”.
X-Mailer: Microsoft Outlook Express 5.00.2615.200
Strange, it does not fit that Paypal would be using Outlook Express for any customer interaction purposes, especially automated security notifications.
Received: from [213.146.116.xxx] (helo=213.146.116.xxx)
by cwpro1.crosswinds.net with smtp (Exim 4.52 (FreeBSD))
id 1EeEBr-0009SZ-0T
for support@d-kriptik.com; Mon, 21 Nov 2005 11:07:14 -0500
Received: from 189.144.176.xxx by ; Mon, 21 Nov 2005 10:01:28 -0600
Strange, this message was received by cwpro1.crosswinds.net (Crosswinds is our hosting provider) from 213.146.116.xxx instead of a mail server associated with and/or identifying itself as paypal.com. (The second (i.e., prior) Receive field I can basically ignore here as that was likely fully under the control of the malicious sender.)
$ nslookup 213.146.116.xxx
Server: 192.168.xxx.1
Address: 192.168.xxx.1#53
Non-authoritative answer:
xxx.116.146.213.in-addr.arpa name = reverse-213-146-116-xxx.cust.kamp-dsl.de.
Authoritative answers can be found from:
116.146.213.in-addr.arpa nameserver = ns.kamp.net.
116.146.213.in-addr.arpa nameserver = ns2.kamp.net.
ns.kamp.net internet address = 195.62.97.2
ns2.kamp.net internet address = 195.62.97.18
Hmm, this message looks to have originated from a DSL subscriber in DenmarkGermany. That is weird.
$ whois 213.146.116.xxx
OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
ReferralServer: whois://whois.ripe.net:43
NetRange: 213.0.0.0 – 213.255.255.255
CIDR: 213.0.0.0/8
NetName: RIPE-213
NetHandle: NET-213-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: NS3.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: NS-EXT.ISC.ORG
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate:
Updated: 2005-07-27
# ARIN WHOIS database, last updated 2005-11-22 19:10
# Enter ? for additional hints on searching ARIN’s WHOIS database.
% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Note: the default output of the RIPE Whois server
% is changed. Your tools may need to be adjusted. See
% http://www.ripe.net/db/news/abuse-proposal-20050331.html
% for more details.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html
% Note: This output has been filtered.
% To receive output for a database update, use the “-B” flag
% Information related to ‘213.146.112.0 – 213.146.127.255′
inetnum: 213.146.112.0 – 213.146.127.255
netname: KAMP-DSL-NET
descr: KAMP Netzwerkdienste GmbH
descr: DSL-Pool fixed IPs
country: DE
admin-c: KAMP-RIPE
tech-c: KAMP-RIPE
status: ASSIGNED PA
remarks: INFRA-AW
remarks: ***************************************
remarks: * please report spam/abuse/scans/etc. *
remarks: * to: abuse@kamp.de *
remarks: ***************************************
mnt-by: KAMP-P-MNT
source: RIPE # Filtered
role: KAMP NOC
address: KAMP Netzwerkdienste GmbH
address: Vestische Str. 89-91
address: 46117 Oberhausen
address: DE
phone: +49 1805 24289905
fax-no: +49 1805 24289999
e-mail: noc@kamp.de
admin-c: HL47-RIPE
tech-c: RI7-RIPE
tech-c: TS1792-RIPE
tech-c: ME1587-RIPE
nic-hdl: KAMP-RIPE
mnt-by: KAMP-MNT
source: RIPE # Filtered
% Information related to ‘213.146.96.0/19AS8648′
route: 213.146.96.0/19
descr: KAMP Netzwerkdienste
origin: AS8648
mnt-by: KAMP-P-MNT
source: RIPE # Filtered
I note the following and record abuse@kamp.de for notification of this phishing message.
remarks: ***************************************
remarks: * please report spam/abuse/scans/etc. *
remarks: * to: abuse@kamp.de *
remarks: ***************************************
Ok, I fire up Firefox and and visit www.kamp.de.
It looks like KAMP is an ISP in DenmarkGermany.
At this point, if I did not know already, I have found enough information to label this message as a fraud. Paypal is not going to be sending messages from DSL subscriber accounts in DenmarkGermany.
Looking at the HTML source of the message, I see that it links in many images from the paypal.com web site. But, embedded in here, I also see the following.
<A href=3D”http://210.98.146.xxx/.confirm/index.php?MfcISAPICommand=3D=
SignInFPP”
>
So, I am being asked to connect to a web site identified only by a numeric IP address over a plaintext (i.e. clear – HTTP) connection. If this was a legitimate message from paypal.com, I would expect the sign in to be located at paypal.com and use https.
$ nslookup 210.98.146.xxx
Server: 192.168.xxx.1
Address: 192.168.xxx.1#53
** server can’t find xxx.146.98.210.in-addr.arpa: NXDOMAIN
$
Hmm.
$ whois 210.98.146.xxx
OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU
ReferralServer: whois://whois.apnic.net
NetRange: 210.0.0.0 – 211.255.255.255
CIDR: 210.0.0.0/7
NetName: APNIC-CIDR-BLK2
NetHandle: NET-210-0-0-0-1
Parent:
NetType: Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS4.APNIC.NET
NameServer: NS-SEC.RIPE.NET
NameServer: TINNIE.ARIN.NET
NameServer: DNS1.TELSTRA.NET
Comment: This IP address range is not registered in the ARIN database.
Comment: For details, refer to the APNIC Whois Database via
Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment: for the Asia Pacific region. APNIC does not operate networks
Comment: using this IP address range and is not able to investigate
Comment: spam or abuse reports relating to these addresses. For more
Comment: help, refer to http://www.apnic.net/info/faq/abuse
Comment:
RegDate: 1996-07-01
Updated: 2005-05-20
OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3100
OrgTechEmail: search-apnic-not-arin@apnic.net
# ARIN WHOIS database, last updated 2005-11-22 19:10
# Enter ? for additional hints on searching ARIN’s WHOIS database.
% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 210.98.128.0 – 210.98.191.255
netname: BORANET-NET-210-98-128
descr: DACOM Corp.
descr: Facility-based Telecommunication Service Provider
descr: providing Internet leased-ine, on-line service, BLL etc.
country: KR
admin-c: DB50-AP
tech-c: DB50-AP
mnt-by: APNIC-HM
mnt-lower: MNT-KRNIC-AP
changed: hm-changed@apnic.net 20021025
status: ALLOCATED PORTABLE
source: APNIC
role: DACOM BORANET
address: DACOM Bldg., 706-1, Yoeksam-dong, Kangnam-ku, Seoul
country: KR
phone: +82-2-2089-7755
fax-no: +82-2-2089-0706
e-mail: ipadm@nic.bora.net
e-mail: abuse@bora.net
e-mail: security@bora.net
admin-c: EC115-AP
tech-c: SIJ1-AP
nic-hdl: DB50-AP
mnt-by: MNT-KRNIC-AP
remarks: IP address administrator group of NIC team, DACOM Corp.
remarks: If related with spam, send mail to abuse@bora.net
remarks: If related with security, send mail to security@bora.net
remarks: Only for whois information correction, send mail to ipadm@nic.bora.net
changed: jeonsi@bora.net 20041105
source: APNIC
I note the following and record abuse@bora.net for notification of this phishing message.
remarks: IP address administrator group of NIC team, DACOM Corp.
remarks: If related with spam, send mail to abuse@bora.net
remarks: If related with security, send mail to security@bora.net
Ok, I fire up Firefox and and visit www.bora.net, and then I follow the link to the English version of the site.
It looks like bora.net is an ISP in the Asia-Pacific region, so I am being ask to sign in to my Paypal account through a rogue web site hosted in the Asian-Pacific region. Yeah, sure, that makes sense.
Looking at the message source, the HTML looks clean enough. So, lets see how this message renders in Thunderbird when I turn on displaying HTML messages.
(Heh. When displayed in HTML format, Thunderbird labels the message as “Thunderbird thinks this message might be an email scam.” Nicely done.)
Begin Skip Doing This Content—>
Everything up until this point was just investigation to determine the message was a scam and figure out the proper abuse contacts. But now, lets check out 210.98.146.xxx. I recommend that everyone NOT do this, as we are attempting to connect to a potentially malicious entity.
$ ping 210.98.146.xxx
PING 210.98.146.xxx (210.98.146.xxx): 56 data bytes
^C
— 210.98.146.xxx ping statistics —
17 packets transmitted, 0 packets received, 100% packet loss
$ telnet 210.98.146.xxx 80
Trying 210.98.146.xxx…
^C$
The web site linked to in the phishing message looks to be down. Ok, what about 213.146.116.xxx, the IP address from which we received this message? Once again, I recommend that everyone NOT do this, as we are attempting to connect to a potentially malicious entity.
$ ping 213.146.116.xxx
PING 213.146.116.xxx (213.146.116.xxx): 56 data bytes
64 bytes from 213.146.116.xxx: icmp_seq=0 ttl=113 time=191.754 ms
64 bytes from 213.146.116.xxx: icmp_seq=1 ttl=113 time=190.349 ms
^C
— 213.146.116.xxx ping statistics —
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 190.349/191.051/191.754/0.703 ms
$ telnet 213.146.116.xxx 25
Trying 213.146.116.xxx…
^C
$ telnet 213.146.116.xxx 80
Trying 213.146.116.xxx…
Connected to reverse-213-146-116-xxx.cust.kamp-dsl.de.
Escape character is ‘^]’.
GET / HTTP/1.1
Host: 213.146.116.xxx
Connection: close
User-Agent: Manual
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Wed, 23 Nov 2005 06:30:23 GMT
Connection: close
Content-Length: 1283
Content-Type: text/html
Set-Cookie: ASPSESSIONIDCQRCQBQC=OJDBMBFBKMOMFBFIEBABEGMP; path=/
Cache-control: private
<!–
WARNING!
Please do not alter this file. It may be replaced if you upgrade your web server
If you want to use it as a template, we recommend renaming it, and modifying the new file.
Thanks.
–>
[HTML removed - it can be found here]
Connection closed by foreign host.
$
The HTML looks clean and generic, so lets render it in Firefox.
(Since I am rendering this on a local copy of the HTML, I do not have the image referenced in the HTML – thus, the broken image indicator.)
This may or may not be the machine that sent the message to the crosswinds mail server. For example, the IPs may be dynamically allocated by this ISP to its DSL subscribers, and the IP may now be assigned to a different subscriber. Of course, I could now switch to covert exploration and probe this system in more detail, but that is not my role here and I walk away.
<— End Skip Doing This Content
So, what tools have we used here? I used no special toolkits or really security tools of any kind here.
- Thunderbird, which allowed display of email messages in plaintext only and viewing of the raw message source. It also was able to identify the message as a scam and could render the HTML content of the messages.
- Firefox, which rendered the HTML pages for me.
- nslookup, which allowed me to perform a DNS reverse lookup on the IP addresses I noticed. (Note this.)
- whois, which allows me to query information on the owners of the IP address blocks I noticed and find abuse contacts.
- telnet, which allowed me to connect to remote machines and interact with services on them manually.
The Firefox and Thunderbird applications in the screenshots were running on a Windows XP system. nslookup, whois, and telnet were running on a FreeBSD 6 system. Both nslookup and telnet are also available as part of a standard Windows XP installation, and there are many resources for performing whois lookups through the web. (Also, Cygwin brings a whole suite of GNU/Linux and Unix tools to Windows. Another tool for Windows is SamSpade, which I believe is designed for researching rogue email messages.)
And, what techniques did we employ?
- Wariness – Email should not be trusted by default. Examine email messages closely, especially if they request sensitive information, contain attachments, or provide links, and be sure to establish trust before performing any actions requested by the messages. This is just how I think, and it helps in avoiding scams.
- Research – When in doubt, do some research. (An easy way to do this for messages claiming to be from a company or person you deal with is just call the company or person.) By looking at the raw message, I could see weird characteristics in the headers and the message body that indicated this was a fraud. I then used information taken from the headers and message body to identify proper abuse contacts at the relevant ISPs.
And the easiest one…
- Multiple email accounts with dedicated purposes – By having specialized email accounts that are used only for certain purposes, many scam messages can be quickly identified just by being out of place. (You can also track the dissemination of your email addresses quite well by doing this.) That is how I knew this message was a scam before I even read it its contents.
Anyway, now all that is left to do is notify abuse@bora.net and abuse@kamp.de about this message. We forwarded the original message with its full headers intact. (In Thunderbird, this can be easily accomplished by forwarding the message as an attachment (Message->Forward As->Attachment). We chose to copy and paste the message’s source inline rather than treat it as an attachment.)
From – Wed Nov 23 17:21:20 2005
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00800000
Message-ID: <4384EB3B.6060709@d-kriptik.com>
Date: Wed, 23 Nov 2005 17:20:43 -0500
From: “D-kriptik Support (Andrew Donofrio)” <support@d-kriptik.com>
User-Agent: Thunderbird 1.5
MIME-Version: 1.0
To: abuse@bora.net, abuse@kamp.de
Subject: Malicious email – [Fwd: Security Notification]
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
To Whom It May Concern,
We received a malicious email message (phishing) that was sent via a
user of Kamp and pointed to a web site hosted by a user of bora.net.
We can see from the headers that the message was sent from
213.146.116.xxx, which belongs to KAMP.
> Received: from [213.146.116.xxx] (helo=213.146.116.xxx)
> by cwpro1.crosswinds.net with smtp (Exim 4.52 (FreeBSD))
> id 1EeEBr-0009SZ-0T
> for support@d-kriptik.com; Mon, 21 Nov 2005 11:07:14 -0500
We can see from the message body that the malicious web site is hosted
by 210.98.146.xxx, which belongs to Bora.
> <TD class=3Dpp_sansserif align=3Dmiddle><A
> href=3D”http://210.98.146.xxx/.confirm/index.php?MfcISAPICommand=3D
> SignInF=
> PP”
>
>
>
> >Click here to verify your
> account</A></TD>
The complete message along with all of its headers is included below.
Thanks for your time.
-Andrew
—- Forwarded message —-
[Snip original message]
)
