Phishing attacks aiming for multiple logins

Rows
cso online

By Steve Ragan

Fundamental security insight to help you minimize risk and protect your organization

Close

Thank you

Your message has been sent.

Close

Sorry

There was an error emailing this page.

Scammers are attempting to harvest more than one set of credentials

CSO
|May 13, 2014 6:30 AM

‘);//–“;
var adDivString = “”;
placementDiff = applyInsert($(this), adDivString);
if (debug) {
console.log(“Just placed an ad and the placementDiff is: ” + placementDiff);
}
placementTarget = cumulativeHeight + placementDiff + interModuleHeight + adHeightBuffer;
}
else {
var moduleDivString = “”;
var elementId = “drr-mod-“+moduleCounter;
moduleDivString = “”;
modules.push(elementId);

placementDiff = applyInsert($(this), moduleDivString);
if (debug) {
console.log(“Just placed a module and the placementDiff is: ” + placementDiff);
}
placementTarget = cumulativeHeight + placementDiff + interModuleHeight + moduleHeightBuffer;
moduleCounter++;
}
loopCounter++;
}
// Avoid placing elements too soon due to non-large figures inflating the cumulative height
if ($(this).is(“figure”) !$(this).is(“figure.large”)) {
cumulativeHeight += grafHeight;
}
else {
cumulativeHeight += $(this).height() + grafHeight;
}
}
});

// clone Related Stories module m-15 to come in after 2nd para in article body for mobile breakpoint display
var $relatedStories = $(‘.related-promo-wrapper’);
if ($relatedStories.length) {
var $relatedStoriesClone = $relatedStories.clone();
$relatedStoriesClone.insertAfter( “#drr-container p:eq(1)”);
}

var $insiderPromo = $(‘.insider-promo-wrapper’);
if ($insiderPromo.length) {
var $insiderPromoClone = $insiderPromo.clone();
$insiderPromoClone.insertAfter( “#drr-container p:eq(1)”);
}

//place left side element
cumulativeHeight = 0;
var leftPlacementTarget = tagHeight = leftPlacementTarget) {
if (debug) {
console.log(“congratulations… we’ve passed the initial start point”);
}
if (leftPlacementIndex == null) {
//it’s not good enough to not be a left avoid – it also shouldn’t be a

with an immediately preceding small or medium image left avoid.
if (!isLeftAvoid($(this)) noPrevFigures($(this)) ) {
leftPlacementIndex = $(this).index();
$leftPlacementElement = $(this);
leftPlacementLookaheadStart = cumulativeHeight;
if (debug) {
console.log(“is not a left avoid and no prev figures. ########## set placementIndex (“+leftPlacementIndex+”) and lookaheadStart (“+leftPlacementLookaheadStart+”) ##########”);
}
} else {
if (debug) {
console.log(“is a left avoid or has previous figures. continue”);
}
}
} else {
if (debug) {
console.log(“#### leftPlacementIndex already set to “+leftPlacementIndex+”. looking ahead…”);
}
//not null; has been set
if ((cumulativeHeight – leftPlacementLookaheadStart) leftIntervalHeight) {
if (debug) {
console.log(“###### THRESHOLD REACHED. LOOKAHEAD COMPLETE. END ###### (cumulativeHeight – leftPlacementLookaheadStart) (“+(cumulativeHeight-leftPlacementLookaheadStart)+”) leftIntervalHeight (“+leftIntervalHeight+”).”);
}
return false;
} else {
if (debug) {
console.log(“threshold not reached: (cumulativeHeight – leftPlacementLookaheadStart) (“+(cumulativeHeight-leftPlacementLookaheadStart)+”) tags
if (!(isLeftAvoid($(this)) ($(this).hasClass(‘small’) || $(this).hasClass(‘inline-small’) || $(this).hasClass(‘medium’) || $(this).hasClass(‘inline-medium’) || $(this).hasClass(‘apart’) ))) {
cumulativeHeight += $(this).height() + grafHeight;
}
if (debug) {
console.log(“——————– set cumulativeHeight(“+cumulativeHeight+”) —————“);
console.log(“”);
}
}
});
}

if (leftPlacementIndex != null elementNotNearEnd($leftPlacementElement, leftPixelWindow)) {
if (debug) {
console.log(” insert into index “+leftPlacementIndex);
}
$(“#drr-container”).children().eq(leftPlacementIndex).before(“

“);
}

IDG.GPT.trackOmniture();

// Add Right rail module content
for (var i=0; i=0) {
epoType = “article”;
referrerValue = getReferrerArticle(“”, previousUrl);
if (_article!=null) {
originalCategories = _article.categories;
}
else {
epoType=”home”;
}
}
else if (document.referrer.indexOf(“google”) = 0 || document.referrer.indexOf(“yahoo”) = 0 || document.referrer.indexOf(“bing”) = 0) {
epoType = “search”;
}
else if (pageComesFromSocial(document.referrer)){
epoType = “social”;
}
else {
epoType = “home”;
}

console.log(“Epo TYpe is ” + epoType);
var brandAbbreviation = “cso”;
// Define params for epo based on brand
if (epoType != “none”) {
var epoParams = “module.epo”;
switch(brandAbbreviation) {
case ‘jvw’:
console.log(“Case JVW”);
// FOR JAVAWORLD
if (epoType == “home”) {
epoParams += “typeId=4”; // How-To articles
}
else if (epoType == “search”) {
var categories = [3302, 3305, 3332];
var primaryCatId = 3204; // Default to ‘Core Java’
if (categories instanceof Array categories.length 0) {
primaryCatId = categories[0];
}
epoParams += “catId=” + primaryCatId;
}
else if (epoType==’article’) {
var categories = originalCategories;
var primaryCatId = 3204; // Default to ‘Core Java’
if (categories instanceof Array categories.length 0) {
primaryCatId = categories[0];
}
epoParams += “catId=” + primaryCatId;
}
break;
case ‘cit’:
console.log(“Case CIT”);
if (epoType == “home”) {
epoParams += “typeId=6”; // Feature
}
else if (epoType == “search”) {
var categories = [3302, 3305, 3332];
var primaryCatId = 3336; // Default to ‘Consumerization’
if (categories instanceof Array categories.length 0) {
primaryCatId = categories[0];
}
epoParams += “catId=” + primaryCatId;
}
if (epoType==’article’) {
var categories = originalCategories;
var primaryCatId = 3336; // Default to ‘Consumerization’
if (categories instanceof Array categories.length 0) {
primaryCatId = categories[0];
}
epoParams += “catId=” + primaryCatId;
}
break;
break;
case ‘cso’:
console.log(“Case CSO”);
if (epoType == “home”) {
epoParams += “typeId=6”; // Feature
}
else if (epoType == “search”) {
var categories = [3302, 3305, 3332];
var primaryCatId = 3294; // Default to ‘Data Protection’
if (categories instanceof Array categories.length 0) {
primaryCatId = categories[0];
}
epoParams += “catId=” + primaryCatId;
}
if (epoType==’article’) {
var categories = originalCategories;
var primaryCatId = 3294; // Default to Data protection
if (categories instanceof Array categories.length 0) {
primaryCatId = categories[0];
}
epoParams += “catId=” + primaryCatId;
}
break;
}
return epoParams;
}
return null;
}

/**
* @param jqo Original jquery object target
* @param divString The div to be inserted.
* @return Difference in height between original placement target and final target.
* Checks first 6 elements for an allowable placement (600 pixel window).
* If none, check nearby for elements that are not right avoids.
* If none, place element before current target.
*/
function applyInsert(jqo, divString) {
if (debug) {
console.log(“applyInsert at top and jqo index is: ” + jqo.index());
}

for (var i=0; i 0) {
children = $(“#drr-container”).children().slice(jqo.index(), allowElement.index() );
}
else {
children = $(“#drr-container”).children().slice(allowElement.index(), jqo.index());

}
if (children != null) {
children.each(function(i) {
if (debug) {
console.log(“About to add this element’s height to heigh diff offset”);
console.log($(this));
}
height += $(this).height();
});
}
if (offset 300) {
if (debug) {
console.log(“isRightAvoid: found pre. return true”);
}
return true;
}
if (jqo.is(“figure”) jqo.hasClass(‘large’)) {
if (debug) {
console.log(“isRightAvoid: found figure.large return true”);
}
return true;
}
if (jqo.is(“figure”) jqo.hasClass(‘medium’) jqo.hasClass(‘inline’)) {
if (debug) {
console.log(“isRightAvoid: found figure has class medium and inline.”);
}
return true;
}

if (jqo.hasClass(‘download-asset’)) {
if (debug) {
console.log(“isRightAvoid: found class download-asset return true”);
}
return true;
}
if (jqo.is(“aside”) jqo.hasClass(‘tableLarge’)) {
if (debug) {
console.log(“isRightAvoid: found class download-asset return true”);
}
return true;
}

}
return false;
}

// Returns true if height of all elements after this one is more than 500; false otherwise
function elementNotNearEnd(element, pixelWindow) {
if (pixelWindow == null) {
pixelWindow = 500;
}
if (element == null) {
return false;
}
var remainingHeight = 0;
var children = $(“#drr-container”).children().slice(element.index());
if (children == null) {
return false;
}
children.each(function(i){
remainingHeight += $(this).height();
});
if ( remainingHeight pixelWindow) {
return true;
}
else {
if (debug) {
console.log(“Element too close to end. Remaining height is: ” + remainingHeight + ” and window is ” + pixelWindow);
}
return false;
}
}

/**
* Return true if need to avoid this element when placing left module.
*/
function isLeftAvoid(jqo) {
if (jqo.is(“figure”)) {
if (debug) {
console.log(“isLeftAvoid: found figure. return true”);
}
return true;
}
if (jqo.is(“aside.pullquote”)) {
if (debug) {
console.log(“isLeftAvoid: found pullquote. return true”);
}
return true;
}
if (jqo.is(“pre”)) {
if (debug) {
console.log(“isLeftAvoid: found pre. return true”);
}
return true;
}
if (jqo.is(“div.gist”)) {
if (debug) {
console.log(“isLeftAvoid: found github code block. return true”);
}
return true;
}
if (jqo.hasClass(“statsTable”)) {
if (debug) {
console.log(“isLeftAvoid: found class statsTable. return true”);
}
return true;
}
return false;
}

/**
* return true if there are no figures before the target placement that might bleed down into placement element
*/
function noPrevFigures($originalTarget) {
var targetIndex = $originalTarget.index();
var numElementsLookBack = 5;
var figureIndex = null;
var figureHeight = null;
var startIndex = targetIndex – numElementsLookBack

In what looks to be an attempt at getting more for less, scammers behind a number of recent Phishing attacks are attempting to harvest more than one set of credentials from a single source.

Examining a set of shortened URLs, which were pointed at hosted Phishing websites, researchers from Trend Micro discovered that the person(s) behind the scheme were allowing the victim to enter credentials from various sources.

In one example, the website allows the victim to select between Yahoo, AOL, Windows Live, Gmail, or – if they wish – any other account via an option labeled “Other emails.”

The credentials are requested in order to access the Phishing lure. In this case, the lure is a website designed to mimic Facebook, Google Docs (despite the fact the service is now called Google Drive), Microsoft’s OneDrive, or various property pages.

“It’s interesting to note that the pages accept any words or even gibberish typed in – a sure sign that the pages are more concerned with collecting data,” the Trend Micro blog explained.

“After signing in, users may encounter a ‘loading’ or ‘server error’ notification before they are led to the actual site. For example, users who visit the ‘Google Docs’ site are led to a shared document about intentions for prayers.”

The point that the attack actually redirects the victim to the actual website shows that the criminals are hoping to keep the attack alive as long as possible. However, given that the forms accept any input, clearly all they’re after is the credentials.

As far as awareness goes, it’s a good idea to remind users that shortened URLs shouldn’t be trusted unless they’ve come from a known / valid source. However, it’s rare to see them in legitimate work-related messages, and most personal correspondence avoids them as well.

If someone does follow a maliciously shortened link, traditional anti-Phishing training should still come into play, as the URLs in this particular attack – and others like it – are easily identified by examining the address bar.

previous Previous Post

Word vulnerability used for targeted attacks in Taiwan

Next Post next

Ajax Security Team: Are they Iran’s latest threat?

• What is social engineering? What are the most common and current tactics? A guide on how to stop…

• From passwords on sticky notes to sensitive contracts left in a pile by the printer, many office…

Beware bold promises from a multibillion-dollar industry that can’t prevent your IT systems from being

Sign up for our CSO Update newsletter

System administrators rushing to fix the highly publicized Heartbleed vulnerability may have introduced

Microsoft’s latest report that found a big increase in Windows computers infected with malware signals

Social media pranks and viral videos have nothing on these truly historical technical hoaxes

It is early in the morning here just outside Toronto here in fortress suburbia. I’m reading through the

Overwhelmned by security data

All of the security updates address remote code execution vulnerabilities

<!–

Share this:

• Facebook
• X
• LinkedIn
• WhatsApp

Related