4 ms·

Tell HN: Thailand pass applicants receive malicious code via email

25 points by MoSattler 5y ago

Me and my girlfriend are planning to go to Thailand. Today we got another email from the Thailand pass people (needed for entry): There is a problem related to the request, please download the attachment and update the information. Please prepare your documents for submission at the check-in desk and relevant agencies Passport with visa (if required) Thailand pass QR code (on mobile device or hard copy) Download Document https://bit.ly/XXXXXXXXXXX important note. You must open the document from a PC and not from the phone The link is leading to an HTML file hosted on discord, which is prompting the user to download some malicious VBS code. It's easy to detect for technically apt people, but it almost fooled my girlfriend.

decrypt 5y ago
What address did the email come from, and what do the headers show? Anything to indicate it's a spoofed email?
throwaway290 5y ago
> It's easy to detect for technically apt people, but it almost fooled my girlfriend. When you open the official Thailand Pass registration page, the scam email warning is literally the first thing you see. It is a popup that obscures the rest of the page. Read and heed that warning, it's not for nothing. And don't ask me why they just don't plug the leak if they know it happens, I don't work there. Maybe an old system in a different government branch or department leaks it, no idea.
- rosndo 5y ago
  Maybe they should just not leak application data instead of warning people about phishing emails?
  - throwaway290 5y ago
    If they leaked application data, that scam email would not ask people for passport number and so on. Clearly they leak emails only.
deleted 5y ago
[deleted]
throwaway182197 5y ago
Throwaway - this happened to me. For anybody curious, my guess is somebody hacked the server or figured out some URI enumeration vulnerability and at minimum gets your email when you submit the application. You then get an email from "Thailand Pass <support@consulatelteamthailand.com>" (hacker I guess) saying there was a problem with your application and requesting your name, DOB and last 4 of passport. When you reply you get another email with the bitly link the OP shared, which then eventually (in a roundabout way, involving having you download a copy of a mock version of the real site) gets you to download a zipped vb script file. IMO the sad part of this and what made it actually believable to me is that the Thai government is so disorganized generally, and does things in such an ad-hoc way that if you've been living here awhile it actually seems plausible that this is somehow real...
zachberger 5y ago
I received this but never saw it until I read articles about this. It was automatically sent to the spam box on gmail.
digianarchist 5y ago
https://thethaiger.com/hot-news/tourism/warning-thailand-pass-spoof-email-with-malicious-links https://thethaiger.com/hot-news/tourism/warning-thailand-pas...
niij 5y ago
Wouldn't have happened if they'd get rid of this useless scheme all together.

25 points by MoSattler 5y ago

decrypt 5y ago

What address did the email come from, and what do the headers show? Anything to indicate it's a spoofed email?

throwaway290 5y ago

> It's easy to detect for technically apt people, but it almost fooled my girlfriend. When you open the official Thailand Pass registration page, the scam email warning is literally the first thing you see. It is a popup that obscures the rest of the page. Read and heed that warning, it's not for nothing. And don't ask me why they just don't plug the leak if they know it happens, I don't work there. Maybe an old system in a different government branch or department leaks it, no idea.

rosndo 5y ago
Maybe they should just not leak application data instead of warning people about phishing emails?
- throwaway290 5y ago
  If they leaked application data, that scam email would not ask people for passport number and so on. Clearly they leak emails only.

deleted 5y ago

[deleted]

throwaway182197 5y ago

Throwaway - this happened to me. For anybody curious, my guess is somebody hacked the server or figured out some URI enumeration vulnerability and at minimum gets your email when you submit the application. You then get an email from "Thailand Pass <support@consulatelteamthailand.com>" (hacker I guess) saying there was a problem with your application and requesting your name, DOB and last 4 of passport. When you reply you get another email with the bitly link the OP shared, which then eventually (in a roundabout way, involving having you download a copy of a mock version of the real site) gets you to download a zipped vb script file. IMO the sad part of this and what made it actually believable to me is that the Thai government is so disorganized generally, and does things in such an ad-hoc way that if you've been living here awhile it actually seems plausible that this is somehow real...

zachberger 5y ago

I received this but never saw it until I read articles about this. It was automatically sent to the spam box on gmail.

digianarchist 5y ago

https://thethaiger.com/hot-news/tourism/warning-thailand-pass-spoof-email-with-malicious-links https://thethaiger.com/hot-news/tourism/warning-thailand-pas...

niij 5y ago

Wouldn't have happened if they'd get rid of this useless scheme all together.