5 ms·
equifaxsecurity2017.com sounds like such a scammy site too. It's exactly the kind of thing I'd expect a fake site to be named. Why in the world wouldn't they j
by monochromatic 9y ago
equifaxsecurity2017.com sounds like such a scammy site too. It's exactly the kind of thing I'd expect a fake site to be named.
Why in the world wouldn't they just put it on their own domain?
- tyingq 9y agoProbably because they wanted to farm it out to some agency with zero dependencies on their known-incompetent internal IT team? You're right of course, but I'm betting that was the motivation.
- mjcl 9y agoMy guess was that they wanted to reduce the chance of news leaking before they announced it. If they're like other large companies I've seen from the inside, changes to the main website involve lots of meetings and lots of people/stakeholders.
- Kluny 9y agoYou'd think even the world's most incompetent IT team could manage to point a subdomain at a remote server, but apparently not.
- mdavidn 9y agoNot without sending every user's equifax.com cookies to that outside agency's servers.
- Kluny 9y agoHmm, point. Of course, there are tons of ways to get around that problem.
- wutwutwutwut 9y agoCan you share the best?
- Kluny 9y agoThe first one that comes to mind would be to invalidate all existing cookies so that the ones accessible to the other server aren't useful. I wouldn't call that the "best" since invalidating cookies can be annoying for users, but I'm sure there are other ways.
- wutwutwutwut 9y agoIf a user has a cookie for example.com (your domain) and type in vendor.example.com in the web browser how would you invalidate these cookies before they are sent to the vendor? Or even after they are sent? I struggle a bit with seeing how this could be done in a secure manner.
- tyingq 9y agoI have contracted places where that would be a very formal request with tons of meetings and approval flows across purchasing, it security, website ops, the design/branding team, etc. Weeks of lead time required. Basically, the request signals all the little fiefdoms that it's their chance to weigh in.
- Semaphor 9y agoNever underestimate how incompetent people can be. When I was waiting for my South African Visa application to go through, I had to check the status at a scammy-looking url. The form would reload if you pressed enter and pressing tab after the ID field would set the focus to the logo above it instead to the password field below.
- deleted 9y ago[deleted]
- panarky 9y agoThey could always farm out the new site and point a subdomain to it. Something like https://breach.equifax.com https://breach.equifax.com
- phamilton 9y agoThat would require ssl certs to be shared to the agency. Agreeing with everyone though, it's a wrong reason, but I can fathom why someone would do it.
- tonyztan 9y agoNo, the outside agency can obtain a new cert for just that subdomain. They can even use letsencrypt! (Although they really should use EV for this type of site.)
- avip 9y agoI don't get it either. <tangent> A few days ago, got a mail from PayPal about "changes in account". Go to my account was linked to https://www.secureserverpaypal.ssvahan.com/home https://www.secureserverpaypal.ssvahan.com/home. I've forwarded the mail to PayPal spoofing address, they replied it's legit. Why would a legit PayPal activity be linked to an arbitrary domain - I don't get it. It makes zero sense.
- brazzledazzle 9y agoIt sounds like your mailbox and/or client is compromised (that or someone is an idiot on paypal's end). I would assume you're totally compromised and start with a new computer that's installed with ISOs obtained from different computers/networks then change your passwords from there. There's probably guides you can follow online. But don't trust me, get the paypal phone number from the paypal site from somewhere like an Apple store or library and call them to ask about that URL yourself. The domain is not registered with the same provider and it's just super shady looking. Good luck.
- jwilk 9y agoHuh? How is receiving a phishing email an evidence of compromise?
- monochromatic 9y agoForwarding it to Paypal and getting a response that it's legit is certainly interesting.
- avip 9y agoFor the record, not overly happy with the response, I've sent this follow-up to spoof@paypal.com: >Hi there. Thanks for the quick response. I do have a question. Why would PayPal refer me to a form not hosted under PayPal domain? How can I tell it's a legit PayPal communication? Expectedly, never got a response.
- jschwartzi 9y agoObviously they're planning for additional incidents in 2018 and 2019 as well.
- alunchbox 9y agowhat happens if they get hacked again in 2017?
- deleted 9y ago[deleted]
- userbinator 9y agoI had the same suspicious impression of the domain name too --- I wonder what factors cause that, because it's clearly something not everyone has, and probably gained after years of web browsing. I think the two biggest things that stand out are: - Has "security" in its name - Has the current year I can't explain exactly why I think those factors make it suspicious, however.
- patrick_haply 9y ago> I can't explain exactly why I think those factors make it suspicious, however. I think I have an idea of why, though I haven't been able to articulate it properly yet. I've been thinking about it a lot recently because I co-work with a bunch of digital marketers, and some of them have affiliate marketing sites with domains that follow the pattern http://yourexactsearchterm.com http://yourexactsearchterm.com. The best I can come up with is the Uncanny Valley of SEO, where it feels like a website was made and over-optimized specifically for people making my exact search query. Maybe this is unfair or confirmation bias, but I feel like those websites are the most likely to be low quality content farms (e.g. paying content writers pennies to regurgitate content they have no experience with and/or don't understand). Either that, or they are outright scams. Do any digital marketers here have opinions about this?
- userbinator 9y ago"Uncanny Valley of SEO" sounds like the best explanation --- and in my experience, sites with names like you describe have also tended to be content farms. It's not just domain names, but the paths in URLs too --- an entry with your-exact-search-term.html almost subconsciously gets skipped over when scanning search results, unless the search term is extremely specific and somewhat obscure or I'm specifically looking for a file/path (e.g. spc4r37.pdf)
- tripzilch 9y agoI think it's because it's smells like arbitrary-but-plausible sounding additions to a domain name, picked until they hit one domain that wasn't taken yet. Even worse would have been if they had used dashes equifax-security-2017.com. (plausible for those without the experience of "suspicious impression", of course)