IC3 Issues Alert on HTTPS Phishing

ronjor · Jun 10, 2019

Original release date: June 10, 2019

The Internet Crime Complaint Center (IC3) has released an alert on Hypertext Transfer Protocol Secure (HTTPS) phishing—a scheme which lures email recipients into visiting malicious websites that look legitimate and secure.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the IC3 Alert and the CISA Tip on Avoiding Social Engineering and Phishing Attacks. If you believe you are a victim of cybercrime, file a complaint with IC3 at www.ic3.gov.
Click to expand...

guest · Jun 25, 2019

FBI Warns Users Against Phishing Campaigns That Leverage HTTPS Websites
June 25, 2019
https://dzone.com/articles/fbi-warns-users-about-phishing-campaigns-that-leve

The FBI’s announcement might make HTTPS phishing sound like a new attack technique. But it’s not. Venafi senior threat intelligence researcher Jing Xie explains:

"[...] All these malicious pages used a trusted TLS certificate in order to be compliant with browser standards to appear safe and trustworthy. This tactic effectively encourages online shoppers who could unknowingly provide sensitive account information and payment data.”
Attackers get these TLS certificates from a variety of sources. Some obtain original TLS certificates for lookalike or typo-squatting domains designed to impersonate legitimate web services. But others have relied on stolen and abused SSL/TLS certificates.

This latter tactic makes sense to Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, given a recent scan of underground Internet marketplaces:

“We found definitive evidence of TLS certificates for sale on the dark web. While personal data like Social Security numbers can sell for as little as $1 on the dark web, SSL/TLS certificates that deliver high levels of trust routinely sell over a thousand dollars. [...]"
Click to expand...

Log in or Sign up

IC3 Issues Alert on HTTPS Phishing

ronjor Global Moderator

guest Guest

Log in or Sign up

IC3 Issues Alert on HTTPS Phishing

ronjor Global Moderator

guest Guest

Useful Searches