I've recently been victim to a scam. I was signed up to an internet gaming 'club' despite never knowingly having visited their site, read their T&C's nor clicked an agreement.

Under UK regulation such services are required to send you a text message to tell you about your membership. I ignored this as was not aware of my 'sign-up', believing it to be phishing/spam. This natural psychological reaction helps aid the scammer. I ignored it to my cost as several months later I noticed the additional anonymous charges on my mobile account.

To my amazement I looked back at my browsing history months later and discovered that I had in fact accessed their website, twice, in quick succession, but without my knowledge and without seeing any content. The first click had the description of the site I had knowingly visited (some blog page), but the address of somewhere completely different.

Even more incredibly, about 2 weeks later, my browsing history on iCloud showed an access to one of their online javascript game pages that again I NEVER KNOWINGLY VISITED!

Now I can imagine how I might have clicked on a banner or pop-up who's true purpose was disguised, but how have I unknowingly accessed their web pages THREE times with such a large space of time between the last two visits?

Clearly these guys also had access to my mobile phone number, presumably 'kindly' exposed by my mobile ISP (thanks guys!), along with who my ISP was. This gave them UNFETTERED ACCESS TO CHARGE ME VIA PREMIUM SERVICES! (and thus exposing the carrier to accusations of money laundering ...)

Any idea how they might have pulled this off?

How did the attacker piggyback on the 3rd party blog site? How might they be distributing their attack?

What can the 3rd party site do to protect themselves and how can the browser be improved to block such an attack?

(PS phone is an iPhone, as you might imagine, and browser is Safari) (PPS judging by the mobile ISP's user forums, this technique has netted victims over at least 3 years, costing the ISP goodness knows how much in customer service complaints etc., there's a real economic impact to this one!)

  • 2
    Have a look at clickjacking. – Arminius May 1 '17 at 17:12
  • thanks, will do ... but how did they pull off the third one two weeks later?? – merefield May 1 '17 at 17:13
  • 1
    Clickjacking only explains the part where you click on a seemingly innocent site but actually perform a sign-up in the background. – Arminius May 1 '17 at 17:15
  • Thanks, looking at your link is this possibly a vulnerability of the blog site I visited - could they do something to help prevent this? Perhaps I visited the same site two weeks later and they took advantage ... – merefield May 1 '17 at 17:17
  • 1
    Absolutely sure, no children yet! :) – merefield May 1 '17 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.