Phishing email + URL redirection attack

Mr.X · Dec 15, 2016

I have a question about the mechanism of an email to deliver a phishing and URL redirection attack.
Note: the following links/urls are reported by me so they are nonfunctional anymore to be safe.

1. Today I received an email from "my bank" informing I had my account blocked.

2. There's a link embedded in the text of the message like this:

Code:

http://www.banorte.com/portal/personas/home.web

3. When I hover the mouse over the link, I can see down below in the browser the real url:

Code:

http://www.uniformesbordados.com.mx/karen/Logos%20Vida%20Nocturna%20200x200/03bhy.html

4. Next, if I click on the link it redirects to:

Code:

http://baainoirtee-14121.gotdns.ch

Question:
Does the uniformesbordados.com.mx domain is compromised?
If so, the Hosting service, in this case Servnet Mexico, SA de CV, has already a compromised infrastructure or something?

http://whois.domaintools.com/uniformesbordados.com.mx

Actually www.uniformesbordados.com.mx is a working domain and legit owned by a company in Mexico.

DardiM · Dec 15, 2016

http ://www .uniformesbordados.com.mx/karen/Logos%20Vida%20Nocturna%20200x200/03bhy.html

Redirection with :
<html>
<META HTTP-EQUIV="REFRESH" CONTENT="0;URL=http ://baainoirtee-14121.gotdns.ch/">
</html>

So yes there is a problem, maybe a hacker that has successfully put this part there (if there is a hole in the protection of the website)

Mr.X · Dec 15, 2016

And I supposed it is Servnet Mexico, SA de CV (hosting) responsibility to eradicate at least mitigate and set countermeasures in-place, to ensure security to its customers. Right?

Mr.X · Dec 15, 2016

Mr.X said:
And I supposed it is Servnet Mexico, SA de CV (hosting) responsibility to eradicate at least mitigate and set countermeasures in-place, to ensure security to its customers. Right?

I mean the link
http://www.uniformesbordados.com.mx/karen/Logos Vida Nocturna 200x200/03bhy.html
is still redirecting to the now defunct malicious domain http://baainoirtee-14121.gotdns.ch

In my pov, Servnet Mexico is being negligent on this issue.

DardiM · Dec 15, 2016

Mr.X said:
And I supposed it is Servnet Mexico, SA de CV (hosting) responsibility to eradicate at least mitigate and set countermeasures in-place, to ensure security to its customers. Right?

Not specifically.
If a hacker can successfully (different possibilities) have a remote access to the hosted website , and play with the permissions (read, write,create, delete), then he can change (add, modify, remove) some files.
Or, for example, if an admin of the website can log as admin and modify the structure remotely (I mean using the website interface, to manage the website, add products, etc), and its account has been hacked (credentials stolen on its computer by a malware,etc)
=> It is then linked with the person that manages the website.

Mr.X · Dec 15, 2016

DardiM said:
Not specifically.
If a hacker can successfully (different possibilities) have a remote access to the hosted website , and play with the permissions (read, write,create, delete), then he can change (add, modify, remove) some files.
Or, for example, if an admin of the website can log as admin and modify the structure remotely (I mean using the website interface, to manage the website, add products, etc), and its account has been hacked (credentials stolen on its computer by a malware,etc)
=> It is then linked with the person that manages the website.

Got the picture. But let me make you to know that yesterday I reported to Servnet Mexico the situation (note that I got nothing to do with all parties, I was just reporting for the sake of acquiring knowledge) so I think Servnet should already solved this redirection somehow.

DardiM · Dec 15, 2016

Mr.X said:
Got the picture. But let me make you to know that yesterday I reported to Servnet Mexico the situation (note that I got nothing to do with all parties, I was just reporting for the sake of acquiring knowledge) so I think Servnet should already solved this redirection somehow.

The redirection is easy to be removed : only need to delete the webpage that only contains what I have written in previous post. After, they have to resolve the security pb.
If it is a security issue on their side, they are concerned to improve it.
If it is by stealing credential from the users / admin of the website : they can warn them and change (ask them to change) the login / pw.
But I wonder how many other "bad" webpage have been put on their website to do the same stuff

tim one · Dec 15, 2016

It seems strange, but often these actions on web sites is made by a BOT software running continuous and systematic scans of the internet, looking for sites that are easy to violate in “automatic” mode, without human intervention.

A site always has some vulnerability, for example in plugins or themes.
It can happen that a plugin has a vulnerability that can be distributed and exploited.

But one of the most widespread techniques concerns the password to access the site: a BOT tries to log in on the site, trying random passwords, chosen from a library of millions of common passwords through brute force attacks.

DardiM · Dec 15, 2016

tim one said:
But one of the most widespread techniques concerns the password to access the site: a BOT tries to log in on the site, trying random passwords, chosen from a library of millions of common passwords through brute force attacks.

Yes, one of the possibilities, and I think, the most used.

Mr.X · Dec 16, 2016

tim one said:
It seems strange, but often these actions on web sites is made by a BOT software running continuous and systematic scans of the internet, looking for sites that are easy to violate in “automatic” mode, without human intervention.

Can you give some links to learn a bit more about this class of bots?

tim one · Dec 16, 2016

Mr.X said:
Can you give some links to learn a bit more about this class of bots?

These info are a part of my study course of these years but sure, you can find generic posts by googling

Mr.X · Dec 16, 2016

tim one said:
These info are a part of my study course of these years but sure, you can find generic posts by googling

How to phrase it? I mean the search query. Don't know what to type in lol

tim one · Dec 16, 2016

Mr.X said:
How to phrase it? I mean the search query. Don't know what to type in lol

"bot hack sites" can be good

Mr.X · Dec 16, 2016

tim one said:
"bot hack sites" can be good

I think this is a good start for anyone interested.

How to Block Bots Bad Bots and Drive-by Hacks Explained

Search

Phishing email + URL redirection attack

Mr.X

Level 8

DardiM

Level 26

Mr.X

Level 8

Mr.X

Level 8

DardiM

Level 26

Mr.X

Level 8

DardiM

Level 26

tim one

Level 21

DardiM

Level 26

Mr.X

Level 8

tim one

Level 21

Mr.X

Level 8

tim one

Level 21

Mr.X

Level 8

Similar threads