Blue Mountain
Resident Skeptical Hobbit
Posted By: Darat
This morning I received an email purporting to be a communication from the Canada Revenue Agency. It turned out to be scam trying to gather credit card information. But it took a rather roundabout way of getting there ...
Stage 1: The email message
A red flag here: the greeting line uses the mail address. Actual correspondence from the CRA would use either “Cher Blue” or “Monsieur, Madame”. The URL is also subtly wrong; for the French version of the CRA the URL is www.canada.ca/fr/ ...
Partial translation:
Stage 2: The PDF
The URL above actually pointed to https://t.co/ec0UVVXwZQ. It served up a PDF that required a password to open, said password being 031187. The text of the PDF was as follows:
Translation:
This is a huge red flag. The CRA doesn't need anyone to fill out a “tax refund form.” It automatically sends refunds once the return has been processed, via direct deposit if it has information on file, or by mailing a cheque to the address specified on the taxpayer's return.
Stage 3: The redirect
The link at “JE CONSULTE LES DÉMARCHES A SUIVRE” went to https://www.washtogo.ae/wp-content/DE.html.
That, in turn, consisted only of a <meta> tag:
Code:
<meta http-equiv="refresh" content="0;URL=https://pdf.name/canada/MyCra/">Stage 4: The remarkably simple CAPTCHA
The page above redirected to https://pdf.name/canada/MyCra/confirmation.php, which asked for a CAPTCHA that was remarkably easy to read, and consisted of the text 031187 (the same as the password on the PDF.) The same number appeared regardless of the nummber of times the page was reloaded. At least it verified the input; entering anything other than 031187 returned an error.
Stage 5: The fake login page
It then redirected to the following URL:
Trying with a differnt browser showed a different customer_LoginCMD but an identical session number. Playing around with those numbers didn’t seem to break anything.
Chromium recognized the page was in French and asked if I wanted it translated. Because I can puzzle out only about 30% of any given French text, I chose English. The page read:
The three links at the bottom (Legal, Terms and Conditions, Privacy) all returned me to the above page. Not very sophisticated.
Needless to say, no matter what I used for an email address (aragorn@minas-tirith.gondor.me) or password (valaquenta) I was let in.
Stage 6: Credit card information
The login redirected to (spaces added for readability):
Like the page in stage 5, I got the same page back regardless of any changes to the CGI values:
The page accepted without question any set of random numbers I put in for the credit card number, such as 4504 0000 0000 0000. That indicates the programmers didn’t attempt to validate the check digit, which is the final digit of the card number and is computationally dervied from the other 15. Nor did it catch the fact I entered an expiry date from last year.
Stage 7: The frustrating 3D Secure confirmation page
The credit card information page redirected to https://pdf.name/canada/MyCra/v1/D_information.php, with CGI parameters &name=, &email=, &card number=, &phone=, &bank= (the programming was advanced enough to, sometimes, figure out the name of the issuing bank from the card number.)
It displayed a facsimile of a 3D Secure verification page:
Of course, no matter the content entered for the Verification Code, the page always returned:
Error: The verification code you entered does not match our records. Please try again.
As a test, I gave a little-used email address I have at ProtonMail to see if the site was sophisticated enough to actually send a validation code, but never received a message.
Analysis: pretty good, but there are holes
The most glaring thing I saw the page that gathers credit card information performed only the most rudimentary checks on the entered information. It did check for empty fields, letters where there should have been numbers, and the length of the credit card number. But it didn't validate the check digit on the credit card, nor did it catch an expired card.
As of the time I created this thread all the links are still working. I encourage as many of you as possible to play with this and give them a boat load of bad information.
Last edited by a moderator:
