2

I received a phishing text message that pretended to be my bank. It had a link that went to a site that redirect to the following script:

<html><script language="javascript">var page = "Login.php?sslchannel=true&sessionid=XXX”; top.location = page; </script></html>

When I did a wget on that page with the rest of the full url it ran the following script:

<script>
    window.googleJavaScriptRedirect = 1
</script>
<script>
    var n = {
        navigateTo: function(b, a, d) {
            if (b != a && b.google) {
                if (b.google.r) {
                    b.google.r = 0;
                    b.location.href = d;
                    a.location.replace("about:blank");
                }
            } else {
                a.location.replace(d);
            }
        }
    };
    n.navigateTo(window.parent, window, "https://www.banksite.com/");
</script><noscript><META http-equiv="refresh" content="0;URL='https://www.banksite.com/'"></noscript>

From a technical perspective, I'm trying to figure out what this phishing text could have done in the worst case scenario.

4
  • And www.banksite.com is the Fake URL?
    – user689443
    May 17, 2017 at 16:27
  • No, banksite is an actual banks site
    – mergesort
    May 17, 2017 at 16:28
  • 1
    Perhaps you simply received a beta version that actually doesn't work yet.
    – TTT
    May 17, 2017 at 18:10
  • This definitely wasn't legit. It was sent through a bitly link to thousands of people. I also called my bank and they told me it was fake. Just don't understand how it worked.
    – mergesort
    May 17, 2017 at 20:46

2 Answers 2

2

To investigate what a booby trapped web server might try to do on your system, you will have to pretend to be one of the leading targeted browser: Internet Explorer.

With wget and curl this attack reverse engineering can be conducted with the use of the argument --user-agent. Here is a typical example:

wget --user-agent "Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"

Here is one of the easy reference web where you could get other valid user-agent to test in this attack reverse engineering:

User agent string

As a basic protection rule, I advise you to run these tests in a dedicated user environment which won't risk anything at your system level and at your network level. For this create an ad hoc new user which isn't priviledged and which isn't known on any of your directory servers (LDAP or AD) so as to avoid any lateral attack by creating a large access user on other systems.

0

The point is the missing URL in "var page = "/Login.php?sslchannel=true&" - for a sample see this security reporting site: https://www.phishtank.com/phish_detail.php?phish_id=5002343

This fake or phishing URL will pretend to be a real bank site or apple cloud login or paypal. After you type in your credentials, it will pretend an error and redirect you to your real bank or what else.

One another point is, that this website is able to give you different answers depending of your referrer and your user agent (e.g. if you use wget you will get another result if you use an internet explorer). The script you downloaded seems ok so far (just the usual google-rewriting to track your searches).

Worst case scenario is losing your bank credentials and your money or get an trojaner via an browser exploit and the trojaner steals your password and wreck your whole digital life (fotos, documents, logins, shopping)...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .