9 ms·

Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

144 points by rexbee 2y ago

petesergeant 2y ago
I'm disappointed by how little protection we're getting against phishing campaigns. Google's SafeSearch takes forever to process stuff, where presumably very quick response times are much more effective, Fastmail, despite being great in general, is _terrible_ at detecting phishing, Booking.com met my report of a phishing campaign over their site (hotel got hacked) with a "it happens, we might talk to the hotel about it one day" shrug, and banks and other institutions continue to send legitimate messages that look like phishing.
- deleted 2y ago
  [deleted]
- infotainment 2y ago
  > Booking.com met my report of a phishing campaign over their site (hotel got hacked) with a "it happens, we might talk to the hotel about it one day" shrug This is my problem with almost every "report spam/fraud/etc" flow. It's always a digital shrug, and then nothing happens. Only one site I know of ever had it right: Instagram, up to about 2021. When you reported an account or post, you would actually be notified when they took action, which would usually take about a week and be something like "the account was removed". It was so satisfying to see a spam account get taken down after a report. But, they removed that in favor of the "hey thanks for the report we've tossed it right in the trash lol" user flow that every other site uses. Unfortunate.
  - Dalewyn 2y ago
    Generally, I find the effectiveness of feedback is inversely proportional to the ease of submitting it.
  - bluGill 2y ago
    The problem with the feedback is scammers can abuse it - they report a few of their own scams and then use feedback to check on those and thus see what happened an in turn they better know when they are blocked and have a better idea how to create new accounts that are hard to block.
- Plasmoid 2y ago
  > banks and other institutions continue to send legitimate messages that look like phishing. The Canada Revenue Agency (tax collectors) once called me up about something. They literally said "To verify your identity, please give me your social insurance number". It's hard to blame people when actual government agencies are training people to be phished.
  - effluvium 2y ago
    Do business with business that have local offices. That way anytime something needs verification or seems off, go into the businesses building.
    - Scoundreller 2y ago
      When a Canadian gov agency calls, a good reverse verification method is to test their French. « Êtes-vous une pamplemousse? »
    - jplrssn 2y ago
      If you live in Canada you can't really opt out of doing business with the CRA.
  - Terr_ 2y ago
    I ranted about something similar when it came how the US Internal Revenue Service was implementing authentication for their free-filing service. They're training taxpayers to put in large amounts of extremely sensitive personal information into a third-party domain called "id.me". Even if you trust the private company, I think it's insane they didn't at least whitelabel the process through a *.irs.gov domain! (For those curious, the .me TLD is run by the country of Montenegro. Control over DNS has some security implications for phishing and man in the middle attacks.)
  - CodeWriter23 2y ago
    Just curious, how did you confirm it was The Canada Revenue Agency and not scammers?
- MattGaiser 2y ago
  Is detecting phishing all that straightforward? As banks, travel agents, and even governments, are all terrible at avoiding the signalling of phishing. Equifax had its entire response to its breach on a different domain, the kind of thing we tell people to watch out for. https://www.equifaxsecurity2017.com/ https://www.equifaxsecurity2017.com/ This looks like phishing. But it is legitimate.
  - bartvk 2y ago
    Vattenfall (a big Swedish energy company) had the same for a while. Their marketing created a website where you could log in as a user, on a completely different domain. Most have been fixed but my current pet peeve is receiving email newsletters from these companies with tracking links. I get it, you're trying to measure something. But they're genuinly sending you links like sx4pv.mjt.lu/lnk/EEEAAAA-3434-asdfasdfasdf
  - ecosystem 2y ago
    Indeed. They haven't learned their lesson. AT&T finally copped to enormous breach this month. In their notification to individuals (sorry, sign up for identity protection, etc), they made sure to let you know official email always comes from: att@message.att-mail.com ...an email address and subdomain that have never contacted me before on a sketchy sounding domain that doesn't match the service (hosted at https://att.com https://att.com). The email links to experianidworks.com which asks for email, address, and SSN upon clicking the CTA.
  - sureglymop 2y ago
    Even tech companies do this wrong. Github had it's upcoming/beta features on githubnext.com and even sent out auth related e-mails from there. I wanted to test their new features but when I got the email I lost my faith in them and opted not to.
  - heipei 2y ago
    It is not straightforward, and it is complicated by a number of factors. The first would be bad "brand hygiene": If a company has dozens of legitimate domains across different TLDs, different providers and different geographical locations then it's already more complicated than just one canonical .com domain. If teams within the company are permitted to spin up their own domains (e.g. marketing campaigns, branch offices) then it gets 10x worse. Lastly if a legitimate brand frequently changes its appearance, it will be harder to pin down the true brand identity. But even if you follow all of these best practices there are still powerful attack vectors. A threat actor could host their phishing page on an unrelated (compromised) domain with good domain reputation, in that case you wouldn't even know about that site until the first email or SMS hits your customers. Or the threat actor could use one of the many file-hosting or website services to create their site and host it on a shared third-party domain with perfect domain reputation (e.g. amazonaws.com). And then there's incentive: It's no the companies that suffer financial losses, it is their customers. If you were talking about their employees being phished that would be a different story. Same thing for Google Safe Browsing: Their incentive is to protect against most of the obvious phishing, without any false positives, ever. If they are slow to detect something they won't suffer any losses. If they generate a False Positive their Chrome browser might suffer significant reputational damage if a popular legitimate domain is blocked.
miyuru 2y ago
Its not just in US, it happens in every country. SMS is the main way these links are distributed. So much so that in Sri Lanka, gov planned to add a centralized SMS firewall. https://economynext.com/sri-lanka-to-study-infobip-centralized-sms-firewall-proposal-145888/ https://economynext.com/sri-lanka-to-study-infobip-centraliz... Google messages have a good spam filter than can filter in real time them, but I have seen some get though for a small period of time.
- jajko 2y ago
  I dont get sms but amount of spam in gmail inbox about Swiss post (I live here but not native) is staggering. Luckily they still look so lame its trivial to spot them, and gmail is doing a fine service filtering them right into spam.
- Scoundreller 2y ago
  About 7-8 years ago in France you’d get regular phone calls from actual humans running the same scam about a DHL or whatever packaging requiring duties to be paid. Plus the same SMS scams. Americans are lucky in they usually don’t have to buy from abroad and when they do, rarely is tax/duty payment required from the recipient (unlike many other parts of the world).
  - FinnKuhn 2y ago
    In Germany we get those phishing SMS too, but I think the US is probably worse off, as they get way more phishing calls (which I think are more effective) as scammers in Nigeria or India usually don't speak German or French...
    - Scoundreller 2y ago
      Plenty of low-income Francophones in the world.
- lynx23 2y ago
  In 2019, when I landed in Hamburg, I got a scam SMS before the "Welcome to germany"-SMS. IOW, the scammers managed to consume the "new arrival" event somehow, and send out their own scam. Tells a lot about how much the telcos actually care / are a part of these scams.
ChrisArchitect 2y ago
Related from earlier this month: USPS jumps to first place as most imitated brand in phishing attacks https://news.ycombinator.com/item?id=39969527 https://news.ycombinator.com/item?id=39969527
InCityDreams 2y ago
I get no spam, until I send something...then it's an avalanch for a few weeks then they dry up until next time I need DHL (or, indeed, any other carrier - €40 to send a registered letter, DHL priced themselves out of my budget).
bombcar 2y ago
USPS.gov redirecting to USPS.com certainly doesn't help matters. Things like this should use one of the few TLDs that actually has policies and procedures in place; then it's a simple "if it's not .gov, it's not real."
- cozzyd 2y ago
  I wonder if the .com TLD is part of the GOP campaign to kill the USPS
  - qsymmachus 2y ago
    USPS purchased the usps.com domain a long time ago specifically so they could control it and prevent phishing. The decision to replace usps.gov with the .com domain came later, with the tenure of Trump appointee Louis DeJoy. Right wingers believe that USPS should operate as a business, not a public service, so "rebranding" their website to be .com is definitely a part of that narrative.
    - toomuchtodo 2y ago
      So the ask should be to have .gov be canonical, and usps.com directing to .gov it sounds like?
      - qsymmachus 2y ago
        Yep, but for ideological reasons they reversed it.
        compuguy 2y ago
        No, as I and others have commented, this wasn't changed by the current Postmaster DeJoy (not ignoring all the other wonderful stuff he's changed). They've been using the dot com domain for decades at least?
    - ciabattabread 2y ago
tylervigen 2y ago
> We have found that the USPS is under attack from text scams The core challenge of phishing attacks is that USPS is not, in fact, the primary victim of these attacks. The victims are distributed citizens who fall for the scam. USPS doesn't have very many levers available to them to address the attacks (besides a warning on their site, which they have), but also doesn't 'feel' the impact so would have a hard time justifying substantial investment in addressing it. Ultimately the solution needs to come from regulatory regimes that target fraud, particularly SMS message spam.
- gowld 2y ago
  The USPS is empowered with a law enforcement branch to defend against attacks on the mail system. The problem is usually that domestic law enforcement is powerless against international crime, which gets laundered by international utilities like DNA and IP routing/peering.
habosa 2y ago
It might not change anything, but I think the criminal penalties for scams need to be significantly raised. The idea of reaching out to someone you don't know at all and attempting to steal their money by lying and betraying their confidence is morally disgusting. The type of people who can do this hundreds or thousands of times a day are criminals of the worst and least redeemable kind, yet if caught they would likely face a smaller penalty than someone who steals a single piece of jewelry from a store. We are slowly losing our ability to trust each other because of the prevalence of scams which adds massive transaction costs to every legitimate exchange. These costs are unseen but they make almost everything we buy slower and more expensive.
- Eisenstein 2y ago
  Increasing penalties has much less effect on crime than increasing the likelihood of them getting caught. If there is a slim chance of them getting caught it doesn't matter what the penalty is because they will do it anyway.
- renk 2y ago
  Indeed. Moral depravedness is supposedly modeled by law. There is an uncanny overlap of scammers and normal economic activity though. That needs to change.
wslh 2y ago
Try posting on a relatively popular cryptocurrency Telegram group and will be receive a lot of messages and calls within 30'
squirrel 2y ago
Reminds me of the fake police station in Do Androids Dream of Electric Sheep [1]. In order to keep up the pretense for three years, the androids have to take crime reports, do paperwork, and arrest perpetrators. In other words, they have to run an actual real police station. So perhaps the fake USPS sites should just start delivering the post! [1] https://en.wikipedia.org/wiki/Do_Androids_Dream_of_Electric_Sheep%3F https://en.wikipedia.org/wiki/Do_Androids_Dream_of_Electric_...
gowld 2y ago
Why don't DNS providers offer anti-malicious-URL protection?
- kevincox 2y ago
  They do. https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-families https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-fa... https://nextdns.io/ https://nextdns.io/

144 points by rexbee 2y ago

I'm disappointed by how little protection we're getting against phishing campaigns. Google's SafeSearch takes forever to process stuff, where presumably very quick response times are much more effective, Fastmail, despite being great in general, is _terrible_ at detecting phishing, Booking.com met my report of a phishing campaign over their site (hotel got hacked) with a "it happens, we might talk to the hotel about it one day" shrug, and banks and other institutions continue to send legitimate messages that look like phishing.

deleted 2y ago
[deleted]
infotainment 2y ago
> Booking.com met my report of a phishing campaign over their site (hotel got hacked) with a "it happens, we might talk to the hotel about it one day" shrug This is my problem with almost every "report spam/fraud/etc" flow. It's always a digital shrug, and then nothing happens. Only one site I know of ever had it right: Instagram, up to about 2021. When you reported an account or post, you would actually be notified when they took action, which would usually take about a week and be something like "the account was removed". It was so satisfying to see a spam account get taken down after a report. But, they removed that in favor of the "hey thanks for the report we've tossed it right in the trash lol" user flow that every other site uses. Unfortunate.
- Dalewyn 2y ago
  Generally, I find the effectiveness of feedback is inversely proportional to the ease of submitting it.
- bluGill 2y ago
  The problem with the feedback is scammers can abuse it - they report a few of their own scams and then use feedback to check on those and thus see what happened an in turn they better know when they are blocked and have a better idea how to create new accounts that are hard to block.
Plasmoid 2y ago
> banks and other institutions continue to send legitimate messages that look like phishing. The Canada Revenue Agency (tax collectors) once called me up about something. They literally said "To verify your identity, please give me your social insurance number". It's hard to blame people when actual government agencies are training people to be phished.
- effluvium 2y ago
  Do business with business that have local offices. That way anytime something needs verification or seems off, go into the businesses building.
  - Scoundreller 2y ago
    When a Canadian gov agency calls, a good reverse verification method is to test their French. « Êtes-vous une pamplemousse? »
  - jplrssn 2y ago
    If you live in Canada you can't really opt out of doing business with the CRA.
- Terr_ 2y ago
  I ranted about something similar when it came how the US Internal Revenue Service was implementing authentication for their free-filing service. They're training taxpayers to put in large amounts of extremely sensitive personal information into a third-party domain called "id.me". Even if you trust the private company, I think it's insane they didn't at least whitelabel the process through a *.irs.gov domain! (For those curious, the .me TLD is run by the country of Montenegro. Control over DNS has some security implications for phishing and man in the middle attacks.)
- CodeWriter23 2y ago
  Just curious, how did you confirm it was The Canada Revenue Agency and not scammers?
MattGaiser 2y ago
Is detecting phishing all that straightforward? As banks, travel agents, and even governments, are all terrible at avoiding the signalling of phishing. Equifax had its entire response to its breach on a different domain, the kind of thing we tell people to watch out for. https://www.equifaxsecurity2017.com/ https://www.equifaxsecurity2017.com/ This looks like phishing. But it is legitimate.
- bartvk 2y ago
  Vattenfall (a big Swedish energy company) had the same for a while. Their marketing created a website where you could log in as a user, on a completely different domain. Most have been fixed but my current pet peeve is receiving email newsletters from these companies with tracking links. I get it, you're trying to measure something. But they're genuinly sending you links like sx4pv.mjt.lu/lnk/EEEAAAA-3434-asdfasdfasdf
- ecosystem 2y ago
  Indeed. They haven't learned their lesson. AT&T finally copped to enormous breach this month. In their notification to individuals (sorry, sign up for identity protection, etc), they made sure to let you know official email always comes from: att@message.att-mail.com ...an email address and subdomain that have never contacted me before on a sketchy sounding domain that doesn't match the service (hosted at https://att.com https://att.com). The email links to experianidworks.com which asks for email, address, and SSN upon clicking the CTA.
- sureglymop 2y ago
  Even tech companies do this wrong. Github had it's upcoming/beta features on githubnext.com and even sent out auth related e-mails from there. I wanted to test their new features but when I got the email I lost my faith in them and opted not to.
- heipei 2y ago
  It is not straightforward, and it is complicated by a number of factors. The first would be bad "brand hygiene": If a company has dozens of legitimate domains across different TLDs, different providers and different geographical locations then it's already more complicated than just one canonical .com domain. If teams within the company are permitted to spin up their own domains (e.g. marketing campaigns, branch offices) then it gets 10x worse. Lastly if a legitimate brand frequently changes its appearance, it will be harder to pin down the true brand identity. But even if you follow all of these best practices there are still powerful attack vectors. A threat actor could host their phishing page on an unrelated (compromised) domain with good domain reputation, in that case you wouldn't even know about that site until the first email or SMS hits your customers. Or the threat actor could use one of the many file-hosting or website services to create their site and host it on a shared third-party domain with perfect domain reputation (e.g. amazonaws.com). And then there's incentive: It's no the companies that suffer financial losses, it is their customers. If you were talking about their employees being phished that would be a different story. Same thing for Google Safe Browsing: Their incentive is to protect against most of the obvious phishing, without any false positives, ever. If they are slow to detect something they won't suffer any losses. If they generate a False Positive their Chrome browser might suffer significant reputational damage if a popular legitimate domain is blocked.

miyuru 2y ago

Its not just in US, it happens in every country. SMS is the main way these links are distributed. So much so that in Sri Lanka, gov planned to add a centralized SMS firewall. https://economynext.com/sri-lanka-to-study-infobip-centralized-sms-firewall-proposal-145888/ https://economynext.com/sri-lanka-to-study-infobip-centraliz... Google messages have a good spam filter than can filter in real time them, but I have seen some get though for a small period of time.

jajko 2y ago
I dont get sms but amount of spam in gmail inbox about Swiss post (I live here but not native) is staggering. Luckily they still look so lame its trivial to spot them, and gmail is doing a fine service filtering them right into spam.
Scoundreller 2y ago
About 7-8 years ago in France you’d get regular phone calls from actual humans running the same scam about a DHL or whatever packaging requiring duties to be paid. Plus the same SMS scams. Americans are lucky in they usually don’t have to buy from abroad and when they do, rarely is tax/duty payment required from the recipient (unlike many other parts of the world).
- FinnKuhn 2y ago
  In Germany we get those phishing SMS too, but I think the US is probably worse off, as they get way more phishing calls (which I think are more effective) as scammers in Nigeria or India usually don't speak German or French...
  - Scoundreller 2y ago
    Plenty of low-income Francophones in the world.
lynx23 2y ago
In 2019, when I landed in Hamburg, I got a scam SMS before the "Welcome to germany"-SMS. IOW, the scammers managed to consume the "new arrival" event somehow, and send out their own scam. Tells a lot about how much the telcos actually care / are a part of these scams.

ChrisArchitect 2y ago

Related from earlier this month: USPS jumps to first place as most imitated brand in phishing attacks https://news.ycombinator.com/item?id=39969527 https://news.ycombinator.com/item?id=39969527

InCityDreams 2y ago

I get no spam, until I send something...then it's an avalanch for a few weeks then they dry up until next time I need DHL (or, indeed, any other carrier - €40 to send a registered letter, DHL priced themselves out of my budget).

bombcar 2y ago

USPS.gov redirecting to USPS.com certainly doesn't help matters. Things like this should use one of the few TLDs that actually has policies and procedures in place; then it's a simple "if it's not .gov, it's not real."

cozzyd 2y ago
I wonder if the .com TLD is part of the GOP campaign to kill the USPS
- qsymmachus 2y ago
  USPS purchased the usps.com domain a long time ago specifically so they could control it and prevent phishing. The decision to replace usps.gov with the .com domain came later, with the tenure of Trump appointee Louis DeJoy. Right wingers believe that USPS should operate as a business, not a public service, so "rebranding" their website to be .com is definitely a part of that narrative.
  - toomuchtodo 2y ago
    So the ask should be to have .gov be canonical, and usps.com directing to .gov it sounds like?
    - qsymmachus 2y ago
      Yep, but for ideological reasons they reversed it.
      - compuguy 2y ago
        No, as I and others have commented, this wasn't changed by the current Postmaster DeJoy (not ignoring all the other wonderful stuff he's changed). They've been using the dot com domain for decades at least?
  - ciabattabread 2y ago

tylervigen 2y ago

> We have found that the USPS is under attack from text scams The core challenge of phishing attacks is that USPS is not, in fact, the primary victim of these attacks. The victims are distributed citizens who fall for the scam. USPS doesn't have very many levers available to them to address the attacks (besides a warning on their site, which they have), but also doesn't 'feel' the impact so would have a hard time justifying substantial investment in addressing it. Ultimately the solution needs to come from regulatory regimes that target fraud, particularly SMS message spam.

gowld 2y ago
The USPS is empowered with a law enforcement branch to defend against attacks on the mail system. The problem is usually that domestic law enforcement is powerless against international crime, which gets laundered by international utilities like DNA and IP routing/peering.

habosa 2y ago

It might not change anything, but I think the criminal penalties for scams need to be significantly raised. The idea of reaching out to someone you don't know at all and attempting to steal their money by lying and betraying their confidence is morally disgusting. The type of people who can do this hundreds or thousands of times a day are criminals of the worst and least redeemable kind, yet if caught they would likely face a smaller penalty than someone who steals a single piece of jewelry from a store. We are slowly losing our ability to trust each other because of the prevalence of scams which adds massive transaction costs to every legitimate exchange. These costs are unseen but they make almost everything we buy slower and more expensive.

Eisenstein 2y ago
Increasing penalties has much less effect on crime than increasing the likelihood of them getting caught. If there is a slim chance of them getting caught it doesn't matter what the penalty is because they will do it anyway.
renk 2y ago
Indeed. Moral depravedness is supposedly modeled by law. There is an uncanny overlap of scammers and normal economic activity though. That needs to change.

wslh 2y ago

Try posting on a relatively popular cryptocurrency Telegram group and will be receive a lot of messages and calls within 30'

squirrel 2y ago

Reminds me of the fake police station in Do Androids Dream of Electric Sheep [1]. In order to keep up the pretense for three years, the androids have to take crime reports, do paperwork, and arrest perpetrators. In other words, they have to run an actual real police station. So perhaps the fake USPS sites should just start delivering the post! [1] https://en.wikipedia.org/wiki/Do_Androids_Dream_of_Electric_Sheep%3F https://en.wikipedia.org/wiki/Do_Androids_Dream_of_Electric_...

gowld 2y ago

Why don't DNS providers offer anti-malicious-URL protection?

kevincox 2y ago
They do. https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-families https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-fa... https://nextdns.io/ https://nextdns.io/