Phishing attacks are the most common form of attack received today. Our communication methods have moved away from voice to on-line, and with more online interactions with companies comes the bigger risk of these messages not always being what they seem.

Phishing e-mails are often branded the same as legitimate messages. They will either talk about financial issues (confirm this payment you have made, you are due a refund etc), or will ask you to confirm your identity or reset your passwords.

It’s easy to get tricked by these e-mails, and if the link you clicked takes you to what looks like the companies website, what could possibly go wrong ?

I recently received a number of e-mails and text messages from “Apple”. The communication stated that they had spotted some suspicious activity on my account and asked me to click a link to validate their ID so that I could continue using my iTunes accounts.

Upon clicking the link, I was presented with this website:

It looks exactly like the Apple website, which is because it has been copied from their legitimate website. HOWEVER, if you look at the address bar, the site isn’t Apple.com, but is on a server called mtc-travel.com.

MTC Travel run a webserver that is missing security patches, and the bad guys have been able to gain access to the server and setup their own website alongside MTC’s. MTC Travel probably don’t even know they are now hosting a second website.

Anything we now enter onto this fake Apple website will be stored on the server for the bad guys to come and collect later on.

So, page 1, and they are asking for our Apple ID and our Password. This gives them access onto your iTunes Store account, where you will probably have a stored payment card to buy songs, apps etc from the Apple Store.

After entering our Apple ID and Password, we click next, and are shown the following:

To confirm who we are, we are being asked for our full postal address, date of birth, phone number and our credit card details, including the CV2 Numbers.

CV2 is the 3 digits on the back of a credit/debit card. Organisations are not allowed to store CV2 numbers, so if being asked for all of this personal data didn’t raises suspicion, being asked for a CV2 to validate who you are should set alarm bells ringing !

When we click confirm, the Verified by Visa screen is displayed.

We are used to seeing this screen when making online purchases. The page is asking for the full Verified by Visa Password. When the legitimate Verified By Visa screen is presented during an on-line purchase, you are only ever asked for 2 characters from your password, not the full password.

At this point we have given the criminals our AppleID logon and Password (a password we probably use elsewhere), our address, date of birth, credit card details, CV2 number and Verified by Visa password. They have everything they need to carry out online fraud, identity theft, card cloning etc – all because the site LOOKED legitimate.

When we hit confirm, the  site displays a message to confirm all of your details are correct and you have been successfully validate (violated?) and our account is active once more.

Once you click ok, you will be taken back to the Apple homepage, but look at the website address this time…

You are now on Apple.com, the legitimate website. All of the previous pages were on MTC-Travel. By returning you to the legitimate website you won’t realise you have just been phished and your data stolen.

Some phising attacks are just after your logon name and password, as we tend to re-use those across multiple sites. These are usually branded with Gmail, Paypal, Amazon, O2, Netflix etc.

These will ask for your logon and password, as the Apple one started with, but once you have entered them they will then transfer you to the legitimate logon screen to re-enter your details. They realise that we will think we have put in a wrong password once without getting suspicious, so when they direct you to the legitimate site and your logon then works, we don’t think anything bad has happened. That first logon, on the compromised website has now given the criminals your logon id and password and you’re none the wiser, until they start to use it.