In a series of breaches infused with a strong scent of irony, a group of hackers has repeatedly targeted American Express clients in an elaborate and well-planned phishing scheme designed to steal large swaths of their personal information.
Why irony? Because the American Express program that’s being dangled as the phishing bait for the hack is called SafeKey – which adds an additional layer of online security to your normal username and password to help prevent…wait for it…phishing scams and identity theft.
SafeKey isn’t new, it’s Amex’s name for 3-D Secure technology, which is an XML-based added layer of security for payment cards designed to reduce online fraud, which has been adopted by Visa and MasterCard as well. It’s a solid program, and this should in no way be construed as a knock on the program itself. In fact, it’s likely no accident that SafeKey was used to lure victims.
What’s clever about the scam is that it plays upon deep-seated identity theft concerns to actually perpetrate large scale identity theft. Another notable aspect is the amount of care and design that the hackers employed to make it look, feel and seem as legitimate as possible, starting with logos, fonts and color schemes, and going deep into URL addresses, etc. In this way, the scam is representative of a trend towards increasingly realistic, well-designed, highly sophisticated and deeply-researched schemes that are harder and harder to spot with the naked eye.
The Amex SafeKey scheme was first discovered this past March and then has ‘flared up’ again over the summer and again most recently this last week, with a new ‘outbreak’ discovered by Comodo Threat Research Labs (CTRL).
According to Fatih Orhan, Director of Technology for Comodo Threat Research Labs, the labs discovered the most recent “outbreak” of the scam via specific IP and URL analysis as well as by monitoring the data from Comodo’s Antispam Gateway solutions. “As a company, we work diligently in creating innovative technology solutions that stay a step ahead of cyber criminals, and keep enterprises and IT environments safe,” he said.
And though Amex has notified customers about the scam in the past, all that’s needed is a few tweaks to the IP address and a small investment in a new domain name. In other words, the hard work has already been done in the painstaking design and implementation of the scam. And it doesn’t cost the hackers much to power up the scam again and grab a few thousand more unwitting new victims.
In each case, the hackers send Amex customers an email that seems to be coming from a legitimate Amex domain (“welcome.aexp.com”), but in reality the IP address that’s actually sending the email is not a bonafide Amex property. The email includes a letter from what seems to be the Amex SafeKey program director (whose name is Dave Barry, for all of you humor fans), along with legitimate-looking typography and email address, high quality imagery, etc. In other words, if you have no previous knowledge about the scam, no alarm bells are going off. Now granted, the official program is spelled SafeKey whereas in the bogus emails it’s Safe Key, but again, unless you’re a layout person, you’re probably not going to notice this.
When the recipient clicks on the “Create your PSK” button, they’re then redirected to “http://amexcloudcervice.com/login/.” If you look carefully, and you’re a good speller, and you’ve had your coffee already, and you’re on the lookout for phishing scams, it’ll be relatively easy to see that this is actually a spoofing website. Unfortunately, most casual observers will miss the fact that “service” is spelled “cervice” here and will willingly click on the link.
And when we take a closer look at this domain’s details by checking on its “who.is” records we get the following:
We can see that the referral URL’s top level domain originates in Hong Kong. This, in itself, doesn’t give away too much information. There are, obviously, any number of legitimate corporations doing business in Hong Kong. However, a big red flag is that the domain was registered on the same day that this latest version of the phishing attack – let’s call it the Fall ‘16 Amex SafeKey Phishing Campaign – seems to have started.
As you can see the next page – again, despite the bogus URL – is quite well designed and official looking:
And when you fall for the trap and fill in the required information and click on the “Log In” button, it will direct you to another page even if you’ve entered incorrect information.
This is where a lot of the serious data theft happens. There are three more phases to the attack, believe it or not. The “Step 1” page asks customers to set up a SafeKey password and, in the process, to provide some juicy personal data – name, Social Security number, date of birth, mother’s maiden name and her date of birth (!), a security key, and even a security question.
Step 1
Step 2 provides some other “tells,”. One is the outdated Amex card design, as this one feels very 1980’s, and why use blue when the basic Amex card is so clearly defined as green? The other is that it’s highly unlikely that Amex would ever ask you to fill in your entire card number (as, one would imagine, they already have it!) but would instead perhaps ask only for the last four digits, or just the four-digit card ID above the account number, or simply the expiration date.
Step 2
But no, they need it all and so they’re trying to get you to give it all to them, just like that.
Then “Step 3” seals the deal by asking you to provide your card’s expiration date and the three-digit code on the back of the card (again, both of which the actual Amex would obviously have already).
Step 3
After giving away the farm (data-wise), and clicking the “FINISH” button, (which would usually be “SUBMIT” or something similar), the page then redirects you back to www.americanexpress.com to make you think that you’ve been in secure, friendly website waters this whole time.
Sadly, by this stage, you’ve given away enough information for the hackers – or the people buying their trove of info from them – to basically create a whole new bogus online identity from your information, and that’s most likely exactly what’s going on as we speak to those unfortunate enough to be duped by this scam.
Perhaps the lesson here is to think twice when prompted to give too much information to a company that should already have that information. And pay attention to where emails are coming from and where they’re directing you. And if something is misspelled or seems ‘weird,’ get out of there quickly, before you hit enter and simply hand over your digital identity!
Comodo Threat Research Labs (CTRL) is made up of more than 140 IT security professionals, computer scientists and engineers, all full-time Comodo employees, analyzing and filtering spam, phishing and malware from across the globe. With R&D centers in the U.S., Turkey, Ukraine, the Philippines and India, the CTRL team analyzes more than 10 million potential pieces of malware, phishing, spam or other malicious/unwanted files per day, using their insights and findings to help protect and secure Comodo’s entire Internet community.
