Phishers mimic OpenID to steal credentials
Posted on 07 May 2012.
New spam email campaigns are taking advantage of the users' vague familiarity with the OpenID authentication method to phish their login credentials for a number of different and popular online services, warn Barracuda Labs researchers.

The emails in question currently take the form of an offer from a real estate company to check out "new beautiful and cheap properties for sale around your area", or of a bogus UPS tracking alert.

After following the offered link, users are presented with a fake login page hosted on a compromised site.

The page itself does not mention OpenID, but the logos of large and popular websites that use and provide the option of OpenID authentication (Google, AOL, Yahoo!, etc.) can fool users into thinking that the page is legitimate.


Whichever email provide the user selects, a pop-up window requesting the login credentials appears.

"This is not how OpenID authentication works," the researchers point out. With genuine OpenID authentication we would be directed to a secure Yahoo web page which would ask for credentials."

In this case, the inputed credentials are simply forwarded in plain text to a remote server operated by the phishers, and the user is redirected to the real estate agency's or UPS' legitimate website.






Spotlight

Whitepaper: Zero Trust approach to network security

Posted on 20 November 2014.  |  Zero Trust is an alternative security model that addresses the shortcomings of failing perimeter-centric strategies by removing the assumption of trust.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Nov 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //