Sophos News

Facebook 2FA phish arrives just 28 minutes after scam domain created

  • Paul Ducklin

    • We’ll tell this story primarily through the medium of images, because a picture is worth 1024 words.

    This cybercrime is a visual reminder of three things:

    It was 19 minutes past…

    At 19 minutes after 3 o’clock UK time today [2022-07-01T14:19:00.00Z], the criminals behind this scam registered a generic and unexceptionable domain name of the form contact-XXXXX.com, where XXXXX was a random-looking string of digits, looking like a sequence number or a server ID:

    28 minutes later, at 15:47 UK time, we received an email, linking to a server called facebook.contact-XXXXX.com, telling us that there might be a problem with one of the Facebook Pages we look after:

    As you can see, the link in the email, highlighted in blue by our Oulook email client, appears to go directly and correctly to the facebook.com domain.

    But that email isn’t a plaintext email, and that link isn’t a plaintext string that directly represents a URL.

    Instead, it’s an HTML email containing an HTML link where the text of the link looks like a URL, but where the actual link (known as an href, short for hypertext reference) goes off to the crook’s imposter page:

    As a result, clicking on a link that looked like a Facebook URL took us to the scammer’s bogus site instead:

    Apart from the incorrect URL, which is disguised by the fact that it starts with the text facebook.contact, so it might pass muster if you’re in a hurry, there aren’t any obvious spelling or grammatical errors here.

    Facebook’s experience and attention to detail means that the company probably wouldn’t have left out the space before the words “If you think”, and wouldn’t have used the unusual text ex to abbreviate the word “example”.

    But we’re willing to bet that some of you might not have noticed those glitches anyway, if we hadn’t mentioned them here.

    If you were to scroll down (or had more space than we did for the screenshots), you might have spotted a typo further along, in the content that the crooks added to try to make the page look helpful.

    Or you might not – we highlighted the spelling mistake to help you find it:

    Next, the crooks asked for our password, which wouldn’t usually be part of this sort of website workflow, but asking us to authenticate isn’t totally unreasonable:

    We’ve highlighted the error message “Password incorrect”, which comes up whatever you type in, followed by a repeat of the password page, which then accepts whatever you type in.

    This is a common trick used these days, and we assume it’s because there’s a tired old piece of cybersecurity advice still knocking around that says, “Deliberately put in the wrong password first time, which will instantly expose scam sites because they don’t know your real password and therefore they’ll be forced to accept the fake one.”

    To be clear, this has NEVER been good advice, not least when you’re in a hurry, because it’s easy to type in a “wrong” password that is needlessly similar to your real one, such as replacing pa55word! with a string such as pa55pass! instead of thinking up some unrelated stuff such as 2dqRRpe9b.

    Also, as this simple trick makes clear, if your “precaution” involves watching out for apparent failure followed by apparent success, the crooks have just trivially lulled you into into a false sense of security.

    We also highlighted that the crooks also deliberately added a slightly annoying consent checkbox, just to give the experience a veneer of official formality.

    Now you’ve handed the crooks your account name and password…

    …they immediately ask for the 2FA code displayed by your authenticator app, which theoretically gives the criminals anywhere between 30 seconds and a few minutes to use the one-time code in a fraudulent Facebook login attempt of their own:

    Even if you don’t use an authenticator app, but prefer to receive 2FA codes via text messages, the crooks can provoke an SMS to your phone simply by starting to login with your password and then clicking the button to send you a code.

    Finally, in another common trick these days, the criminals soften the dismount, as it were, by casually redirecting you to a legitimate Faceook page at the end.

    This gives the impression that the process finished without any problems to worry about:

    What to do?

    Don’t fall for scams like this.

    Remember that phishing crooks move really fast these days in order to milk new domain names as quickly as they can.

    Fight back against their haste by taking your time.

    Remember those two handy sayings: Stop. Think. Connect.

    And after you’ve stopped and thought: If in doubt, don’t give it out.