0

I got an email where it says that Apple recently failed to validate my payment information and therefore they need to ask me to complete a short verification process in order to verify my account.

At the end of the email it says

Copyright © 2016 Apple Inc. Apple Inc., Infinite Loop, Cupertino, CA 95014 Company Registration number: 15719. .

The email finished in @mycloud.ssl.com and I actually clicked on the link that they gave me.

I got this in my browser:

enter image description here

I know it is in Spanish but I'm sure you know this screen. Did this screen avoided from attackers to take personal information?

Or is it already dangerous to have clicked the link?

  • Clicking random spam links is always dangerous. At the very least you should virustotal the link first. – AstroDan May 27 '16 at 12:40
  • 1
    Potentially just following the link, or even just opening the email, could have confirmed some information about your email address (although most major webmail providers have protections against this now). Anything in the body of the email can trivially be set by an attacker, so should be considered suspect. Some of the headers can be trusted, if you trust your mail server, but not all. The copyright notice means nothing. – Matthew May 27 '16 at 12:41
  • @Matthew I use the Mail app in iMac. – Pichi Wuana May 27 '16 at 12:42
  • What do you mean by "even just opening the email, could have confirmed some information about your email address"? – Pichi Wuana May 27 '16 at 12:43
  • 1
    He means that if the connection wasn't blocked by google safebrowsing you could have confirmed that the adress is in use for later, different another attack – Ladislav Louka May 27 '16 at 12:49
4

If the link visible in the location bar of the browser is the same link you've clicked on then probably nothing dangerous happened.

But, it might be that the link in the browser is different from the one you've clicked on and that there were redirections and reloads before you've actually reached the site blocked by Google Safebrowsing. In this case it might well be that the attackers got notice that you've clicked the link and concluded that you might be a gullible person and that they will try this email again later. It could even be that they've mounted a drive by download attack to infect you with malware.

| improve this answer | |
  • I clicked on Copy link and it's the same one. – Pichi Wuana May 27 '16 at 12:45
  • @PichiWuana: so you were probably lucky then this time. Be careful. – Steffen Ullrich May 27 '16 at 12:46
  • Can they take information from me without phishing? I.e., to take information from me just by clicking the link and nothing else? – Pichi Wuana May 27 '16 at 12:52
  • 1
    They can confirm your email address works, if there is an identifier in the URL. If they included your name, it would be a pretty good indicator that they got it right if you followed the link (if it had been wrong, you'd probably have considered it spam...) – Matthew May 27 '16 at 12:55
  • So, in other words, they can only know if I clicked the link or not? – Pichi Wuana May 27 '16 at 12:57
3

This is phishing no doubt.

I found a similar message on Google: http://niepodam.pl/wiadomosci/3455214 (Google cache)

The destination of the link "> Click here to validate your account information " in that email was "http ://cbi-id2.com/", which obviously is not apple. Whois data places that server in Panama...

The crooks have probably moved on to a different domain now, but as long as the link doesn't have https://(optional sub-domain).apple.com/ at the beginning, it shouldn't be trusted.

| improve this answer | |
2

Short answer:If you actually have chrome in spanish yeah it probably prevented the attack (its google blacklist for sites)

This seems to be the case of phishing so on the site they would ask you to log in with your Apple ID to "verify" your account, purchase or something like that.

Three basic steps to prevent this in future:

1) always check the senders adress, no reason for apple to contact you from elsewhere then ....@icloud.com or no_reply@email.apple.com or similiar (but its not 100% adress can be falsified easily) and apple especially has the adresses kinda complicated

2) check the link, if you hover over link it should show you in bottom corner where the link goes, check it actually goes to for example https://www.apple.com not http://www.phisher123.xyz

3) All good companies will have certificates and the whole sites on https to have all communication encrypted end-to-end, you should see green lock and their name in green box to the left of web adresses when you connect to them

EDIT: added a mention of company name for attacker using https in tip #3

| improve this answer | |
  • 1
    as for 3) - bad companies have certificates too. The certificate is only used to identify a site (URL matches certificate). At least DV certificates (simple green lock) should never be used to defer that the site is trusted. It is a bit different from EV certificates (green bar) because there the CA did actually some real checks for identity. But it is not foolproof either. – Steffen Ullrich May 27 '16 at 12:52
  • 1
    and as for 2) - this can be faked in a lot of situations, like with a Javascript onClick handler. In this case the value of the href attribute is shown but the real target is set from Javascript. – Steffen Ullrich May 27 '16 at 12:59
  • You are of course right i really just went by the simple quick tips. This and most general attacks like this can be prevented by this, but of course if you want to cover more, you would need to go much deeper – Ladislav Louka May 27 '16 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.