Tag Archives: cyberspace

Phishing attack leveraging SMS ban

 

Today morning was just about going as usual till I noticed an email. It seemed to originate from AXIS bank and it had an HTML attachment and it was an important announcement.

The contents of the email looked valid considering Government of India had placed a ban on sending of bulk SMS till 29th. Now I am not sure if such ban holds good for financial institutions. But some smart bloke seems to have capitalized on this ban. The email stated that:

“In view of the Govt. of India directive to mobile operators, all the corporate sms messaging services have been blocked for the next 72 hours. This period may increase. In view of this exigency, Axis Bank Net Secure Code and transaction alerts delivery has been effected. Therefore, till the Govt. of India permits restoration of the system. 

Axis Bank customers may not be able to conduct Internet Banking transactions that use SMS for delivering the NetSecure code. This is a regulation by Govt. of India and beyond Axis Bank’s control.

We have attached a form to this email. Please DOWNLOAD the form attached to this email so that you can fill and submit it Online to us , so that we can verify your account , After the Govt. of India permits restoration of the system. .
NOTE: The form needs to be opened in a modern browser which has javascript enabled ( Internet Explorer 7, Firefox 3, Safari 3, Opera 9)”

Now unlike the other phishing emails that I have encountered this one seemed different and the content (read grammar) also looks more in line from a professional agency and in tandem with the events that are happening in India.

This is the snapshot of the email:

 

Phishing Email targetting Axisbank

 

I opened the HTML attachment, after a customary scan from AV. Now although this looks authentic, but is a bit suspicious because it is asking for too many private details that should evoke second thoughts from anybody. Generally any phishing attack would ask for username, password, cvv details at the max. But this one is prompting for ATM PIN,Transaction password, Secure Code/Verified by Visa, Email details. And unlike others where you enter the details on a site, it is sending an attachment to be filled and submitted. Modus Operandi is slightly different.

I bet someone who is familiar with Axis bank’s online transaction mechanism has set this up because Axis bank requires transaction password in addition to the details mentioned above for a online transaction. Now, the form is a html attachment and when you open everything looks authentic just take a look below.

 

 

 

Phishing HTML attachment targetting Axis bank

This is it, but once you look at the page source carefully you will realize the bait. Using the POST method, all details would go to the URL specified instead of Axis bank:

 

Phishing URL targetting Axis bank

 

A Whois lookup for the domain above lists that is based out of Poland. All I can do is just notify Axis bank of this. It would have been better if the Government of India or the financial institutions have had made it clear if their services would continue to operate or be impeded due to this SMS ban.

Take care and please spread a word to ensure people do not fall for this

UPDATE:

I would have thought that the content in their email was written by a smart bloke, but it’s actually flicked from Axis Bank’s login page!

11 October

Received another Phishing email with the similar modus operandi , this time targeting ICICI Bank and hosted at:

 

Phishing email targeting ICICI customers


17th October

Another day, another Phishing email. The phishers are just not leaving any stone unturned as they target every bank with an online presence, this time targeting customers of HDFC Bank and hosted at:

 

 

Phishing email targeting HDFC Bank customers

Here is the Phished URL:

 

 

Phishing email targeting HDFC Bank customers

Oh Wait..I think I just saw a similar email targeting Punjab National Banks’s customers land in my inbox!….

 

Slinging with Slingbox and Tweeting withTweetdeck

Slingbox is a Place Shifting device from SlingMedia that lets you watch your Audio-Video content from anywhere in the world, be it Desktop, Laptop, PDA or even Smartphones using SlingPlayer App. All you need is an internet connection at your base location which is your home, where you would have connected the slingbox to the broadband router along with AV inputs. You can then fire up the SlingPlayer app on your mobile or ur laptop and watch your favorite programs…doesn’t matter if you are in LA or in Timbuktu 🙂

The best experience with the slingbox is made possible by the superior AV streaming quality generated from their proprietary algorithm called Slingstream (was codenamed Lebowski)…no surprises that it killed Sony’s Location free TV. Believe me its not the usual streaming that you see on the internet…All the Cable companies were freaked out after it became a huge rage and has cult following across the world..

Slingbox and tweede

I took the snap while I was watching Champions League football match between Arsenal vs Celtic and at the same time also tweeting on Twitter using Tweetdeck…