A large collection of fraudulent web stores

https://chair6.net/a-large-collection-of-fraudulent-web-stores.html

by finnigja • 4 years ago

153 70 4 years ago

napsterbr• 4 years ago

Off-topic, but something seems dangerously off with urlscan.io (a service I had never heard of before).

If I go to urlscan.io and look at the recently scanned sites (which are live-updated), every now and then I can find links with potentially sensitive information.

I found OneDrive and SharePoint links. I was unable to actually access the documents in them (it asked me to login), but I could see their content (or metadata) with UrlScan's "live screenshot" feature.

At one point, it scanned a "reset password" link with the authentication token in the query string (!). I was able to access that link and I would likely be able to reset the password for that specific user. I won't share the underlying website so others don't go ahead looking for it, but it was for a non-US government service.

The impression I have is that some email provider (or perhaps some antivirus software?) is automatically scanning user emails and the links are being shared publicly, alongside a "live screenshot".

I might be missing something, but this is weird.

chair6• 4 years ago

Nope, not missing something.. it has been a problem for GitHub (https://news.ycombinator.com/item?id=30348980) and others (https://portswigger.net/daily-swig/urlscan-io-api-unwittingl...).

freitasm• 4 years ago

You are not the only one. This was posted/discussed earlier today: https://news.ycombinator.com/item?id=33435002

quickthrower24• 4 years ago

Makes me question if URL-as-all-factors is a secure way to authenticate someone/thing. Even with SSL encrypting the path , there is the risk of someone sharing that URL since it is a familiar thing to do to share links.

NavinF2• 4 years ago

With third party cookies going away, URL parameters are the only way to do SSO across domains. Not much you can do about it.

zinckiwi• 4 years ago

An Amazon?

BLKNSLVR• 4 years ago

"The Internet"?

bashcoder• 4 years ago

A burgle.

quickthrower24• 4 years ago

A phish

dane-pgp• 4 years ago

If homophones are the pattern to follow, then (since a large collection of legitimate stores can be thought of as a "mall") perhaps the new word should be "a maul" or "a mawl" (suggestive of being something that swallows your money, and doesn't give you anything of value in return).

quickthrower24• 4 years ago

Maybe I should have said a phishbowl then!

GauntletWizard• 4 years ago

A Trey of phishing sites.

deafpolygon• 4 years ago

Yo!

10g1k• 4 years ago

Alibaba.

mamborambo• 4 years ago

The consumer's dependence on "legit-sounding domain name", a green SSL key, and recognizable corporate logos and website layout as the "proof" of authenticity is passe.

In this era of online ubiquity there should be another layer of opt-in validation, ring of trust, p2p feedback and rating, that can all be plugged into the consumer web experience.

Krisjohn• 4 years ago

That’s kind of what antivirus web plugins do

NavinF2• 4 years ago

In practice consumers just go straight to Amazon because they're afraid of the wider internet and depend on the return policy to save them when they get scammed. Doubt any "opt-in validation, ring of trust, p2p feedback and rating" will change that in the next decade.

leveraction• 4 years ago

This and the fact that they have your cc and shipping already on file, which makes things a lot easier. More than once I have found a product on some site and then purchased it from Amazon just because it is so much easier.

jesterson• 4 years ago

As weird as it sounds, it is still the best.

If we have centralised "licensing" solution it is abused by large capital to wash off smaller - there is plenty of examples.

If we have decentralised solution (which is basically what review is) - it is immediately abused by "marketers".

There is no simple and easy solution to the problem.

BobbyJo• 4 years ago

IMO, the best solution to the problem is friction. Criminals are criminals because it's easy. If opening a fraudulent store is 90% as difficult as opening a legit one, no one is going to bother.

FortiDude5• 4 years ago

To me it's very simple: nation states should have their own layer that uses the national registry for companies to verify a domain.

When you register a business you also provide your official domains and so the validity of the website is checked against the validity of the business.

prox• 4 years ago

That would be a great idea.

stevewatson301• 4 years ago

The path to an China-esque ICP recordal system.

moooo994• 4 years ago

In Germany we have an approach with a somewhat similar effect.

For any site with an commercial intent (which is pretty loosely defined) it is mandatory to have an Imprint with the person representing the company, the address of the HQ as well as the companies registration number and court location. It makes it somewhat more transparent what company is behind the site and gives you information you can lookup in public registries.

I hate it from a privacy perspective but it’s okay for for consumer protection.

TobbenTM• 4 years ago

Some countries do _kinda_ have this, for registering `.no` domains you need to be a Norwegian citizen or do it through a Norwegian company. Not sure how much that actually helps tho?

steve_taylor2• 4 years ago

To register a .com.au or .net.au domain, you have to provide your ABN (Australian Business Number). The problem with that, however, is you don't have to prove you have the authority to do so. You can enter any business's ABN.

null_object• 4 years ago

To me it's very simple: nation states should have their own layer that uses the national registry for companies to verify a domain.

I think this can just add layers of bureaucracy that don't address the problem anyway.

In the early days of widespread internet use in Sweden it was quite difficult to register a .se web-address: not only were company documents needed, but the authority that granted use of the address also split your right to it geographically within Sweden, so that if you wanted the address to stretch across the whole country you needed to make multiple applications (using a subdomain system).

This process just made it almost impossible for a small personal startup to own a Swedish domain, and it was completely impossible to register a domain on a 'try-it' basis, to see if a nascent business idea would take-off.

In other words it just entrenched the dominant position of incumbents.

What happened instead, was that Swedes registered .com addresses, or .nu ('now' in Swedish), or other variations. And the same sort of thing would happen now: the international fraudulent sites would still be possible - just legitimate registrations would become much harder.

A little like what happens with pirating, where people using pirated software often have to jump through fewer hoops than legitimate users, who've paid for their installs, but need to constantly dial-up to be allowed to keep using the tools they've bought.

tldr; more bureaucracy for legitimate businesses, but doesn't address the core problem for end-users.

crote2• 4 years ago

The thing is, we tried this already. Twice.

First with domain names. The domain "nissan.com" is not owned by the well-known car company but by a completely unrelated computer company. As "Nissan Motors v. Nissan Computer" settled, this is totally fine and Nissan Computer still owns the domain.

Besides exact matches there are also similar-looking names. For example, a student named Mike Rowe started a small webdesign company called MikeRoweSoft, which drew the attention of Microsoft, leading to "Microsoft v. MikeRoweSoft" - which was settled out of court and resulted in the domain being transferred to Microsoft.

Second are Extended Validation domains - which used to show the company name in the URL bar. As Ian Carroll demonstrated[0] this isn't really worth a lot, and browsers no longer bother showing it at all[1].

Company names also often overlap when they are active in different areas, such as Apple Corp (record label founded by The Beatles) and Apple Inc. (tech multinational) - which over the years have shifted towards a rather impressive market overlap! Some companies are split with both sides keeping the original name, such as Motorola Inc.'s split into Motorola Solutions and Motorola Mobility. Sometimes products are sold under a completely different brand name, such as HMD selling Nokia-branded smartphones, or TP Vision selling Philips-branded televisions while MMD sells Philips-branded gaming monitors!

The thing is, reality is just too complicated for a "very simple" register. How are you supposed to fit in all of the scenarios listed above while still keeping it usable?

[0] https://arstechnica.com/information-technology/2017/12/nope-... [1]: https://www.troyhunt.com/extended-validation-certificates-ar...

mellavora• 4 years ago

Even better, let's get rid of names as identifiers. We all know names are problematic.

We could use government-issued tokens, maybe on a government-run blockchain.

And we could use the same for our personal (corporate) selves, such that all of our economic interactions were moderated through a government-run identity blockchain.

I want the mark on my forehead please, not the wrist, so I can pay by bowing my head to the money-god instead of just laying my wrist on the sensor.

What could possibly go wrong?

steve_taylor2• 4 years ago

Isn't this something that Extended Validation certificates were designed to address?

sofixa2• 4 years ago

Yes, but they were expensive and didn't really work - https://arstechnica.com/information-technology/2017/12/nope-...

dspillett• 4 years ago

Ish. But there are two significant flaws for ecommerce:

1. Knowing that the company using the certificate is who they say they are, doesn't necessarily mean you can trust them not to be fraudulent traders.

2. Control of the domain names and associated certificates can change hands after the fact, officially through buyouts/merges or via more nefarious means, just like any other certificate.

and of course the other key question to address which is:

3. How do you trust those validating the certificate. The average user is not going to know/care that a rogue CA exists and it might take some time for their actions to be noticed and for appropriate revocations to happen.

However they were intended to be used, HTTPS and certificates for it are used to protect data in transit and not really for identity assurance.

----

There is also the more cynical view that the main thing EV certs addressed was the desire for CAs to bring in some revenue, especially as standard certs became more and more a commodity item (now effectively free) with low or zero margins.

langsoul-com• 4 years ago

I wonder if the best bet would be to hash the main site and its images. Then retroactively scan sites with similar HTML hash and flag them?

Fairly sure you could do a HTML search with Google, 7 stores having extremely similar HTML and images seems rather unlikely.

Effectively, it's virus total but for copycat sites.

justusthane• 4 years ago

But there's no such thing as a "similar" hash - change one character in the HTML, and the hash would be completely different.

asdadsdad• 4 years ago

Does anyone care? I've seen this reported many times, and it never gets the same attention as phish

aww_dang• 4 years ago

Were they billing the cards or just reselling the data? The second option seems more probable.

lovingCranberry• 4 years ago

Curious question: Why are all these sites behind Cloudflare and why is Cloudflare not acting?

These sites are literally made to steal my grandma's money when she's buying presents for Christmas and what not.

mfonda• 4 years ago

Thanks for investigating this and ultimately getting the fraudulent store taken down. I saw the same social media post regarding the fraudulent store and was surprised that a small local store was targeted with this kind of attack. A good mix of small stores and major corporations in the list. I wonder if they target the small stores because SEO is easier?

It's inspiring to see you follow up like this and help out a wonderful mountain shop. A great reminder and inspiration to be more involved in my community.

A large collection of fraudulent web stores

Related Stories