If your reader doesn’t show this content, you’ll have to view it on my site directly.

You make a phone call to some customer service center. You navigate their tree of options and end up being put on hold while waiting in line for a person to pick up. They then start playing something hideous while you wait. Personally, I think this is designed to encourage people to hang up, reducing their call volume. But: you have a secret weapon… you’re calling with a smart phone equipped with Personal Hold Music™®.

So, here’s what you’d do: you’d take the phone from your ear and on the screen, there’d be a convenient button to play your music. What would this do? Well, once playing your music with an active phone call, your smart phone would pay attention to the line… since you won’t be able to hear it (cause you’re listening to your sweet, rockin’ beats). If the sound from the phone call changes to voice communication (versus music), your music will be paused and what the person on other end said will be replayed. That’s the tricky part— making the phone recognize when to switch back to the active call. I suppose it would need to do so even for periodic “there are n people waiting ahead of you” prompts, but I could live with that.

This is an idea whose time has come.

But, what gets me is this bit of her post (and echoed in the official press release). It reads, and I kid you not: “We promise not to screw it up.”

That’s in there because Yahoo! has a poor record of not screwing up things. GeoCities, for one. Flickr was on life support until only recently (I think Instagram and the Facebook buyout of that service for $2 billion had something to do with it). Upcoming.org was another victim of their embrace, languish and shutdown strategy. The Archive Team folks are still backing up that service. Maybe Archive Team should get a head start on Tumblr. Just in case.

But the worst part about that particular sentence is there’s no way for them to live up to it. No way. Cause, let’s face it, “screw it up” is a pretty subjective measure. And the folks measuring it have a very fine measuring stick:

• one advertisement, anywhere on Tumblr… even a whiff: they screwed it up.
• a Yahoo! logo brandishing the site… even in the footer: they screwed it up.
• switching authentication from Tumblr login to Yahoo! login: they screwed it up.
• changing terms of service in any way that materially benefits Yahoo! or restricts users: they screwed it up.
• repurposing content without permission on another Yahoo! property: they screwed it up.
• removing user content for newly adopted content policy: they screwed it up.
• one additional promotional email for Tumblr users: they screwed it up.
• adding features that promote other Yahoo! services (even if beneficial): they screwed it up.
• adding any sort of posting/upload limit for free users: they screwed it up.
• introducing any paid level of service while reducing features for free users: they screwed it up.
• changing the period at the end of the “tumblr.” logo to an exclamation mark: they screwed it up.

So basically, they can’t touch it at all without breaking that promise.

Literally, she said “we promise.”

(if you’re viewing this through a news reader, the Storify content may not come through; if not, you’ll have to visit my site to see it)

The Onion is a satirical news web site that looks like a legitimate news company. They make their living at spoofing the real news. So, they should be keenly aware of the fact that things aren’t always as they seem.

Well, recently, their Twitter account was hacked. Compromised by the “Syrian Electronic Army”. And now you can read about how they did it. The Onion’s tech team published an article about it: How the Syrian Electronic Army Hacked The Onion. Go read that now to get some context for what follows.

In short, it was a targeted attack. An email that was baiting the writers at The Onion to come and see an article about their organization. And look— it’s on The Washington Post! How exciting. The text of the link was an address that pointed to “http://washingtonpost.com/…”, but the link itself pointed to another site entirely. I’ve come to call that kind of link a “forged link”; a fraudulent and deceptive hyperlink. The phrase also works in the sense that such a link is deliberately crafted to deceive.

How Forged Links Work

Stepping back a bit, for those that don’t understand how that works. An email message can be like a web page, where most anything in the email can be linked to a web site. Could be text, could be an image, or even white space. So, an address to something, like my own web site would be like this:

http://bradchoate.com/

But see how it isn’t linked? It looks like an address, and it is, but unless it’s written this way, it won’t be usable:

<a href="http://bradchoate.com/">http://bradchoate.com/</a>

This is the HTML representation of a link, and this is how they’re written, but the bits in-between the < and > symbols are hidden from view when reading a web site or email message, since those are instructions to the computer; not really something for a human to read. But that was me being honest. What if I wrote this instead?

<a href="http://reallybadwebsite.com/">http://bradchoate.com/</a>

and remember, you don’t get to see it that way in the actual email message. You’d see it like this:

http://bradchoate.com/

Now then— the link to my site is still shown, and now it’s underlined, which means you can click on it. But, where you go when you click on it is somewhere altogether different. That’s how the forged link works. The link that the unsuspecting recipient at The Onion clicked on did not take them to “washingtonpost.com”, but instead, to a different web site that looked very much like a Google.com account login page. When that happened, it should have sent off alarms in the mind of the user— “why did that happen?”. But instead… at least for one or two that got this far… they entered their Google credentials and unknowingly sent them to their attacker. And, after sending the login information, they were simply passed over to their actual Gmail account, which probably displayed their email since they were likely still logged into Google.

Okay, Blame the User, Right?

The tech guys at The Onion give some advice on how to protect yourself from this kind of attack. But these recommendations put all the onus on the end-users:

• “Make sure your users are educated…” Right off the bat— “the user was wrong, so teach them not to do that!”. Well, good luck with teaching everybody.
• “The email addresses for your Twitter accounts should be on a system that is isolated…” Okay, so if we can’t avoid these attacks, might as well put their target a little further out of reach.
• “All Twitter activity should go through an app of some kind…” Sure, cause nobody would ever attempt to obtain your HootSuite credentials.
• “If possible, have a way to reach out to all of your users outside of their organizational email.” Not really anything preventative here, just disaster recovery planning.

Well, I prefer to place more blame on everyone else.

Antispam/Antiphishing Filters Failed

The fact that this email included a forged link like this and was not flagged in some way is frustrating. Computers are great at spotting a discrepancy like this— especially for pure-text links— and they should be helping us to be safe.

Of course, it could have been an image of a link to washingtonpost.com that was linked the bad web site. In that case, it may be necessary to use text recognition on images that are linked to see if they’re misdirecting.

The User’s Email Client (Gmail, Apple Mail, Outlook, etc.) Failed

If the message did reach the inbox, it should be flagged in a way to identify the forged link, and the fact that this is coming from a stranger (someone that has no correspondence history) and as such, links clicked on should be programatically and visually verified.

A programmatic verification would check the domain of the link against a database of known risky web sites.

A visual verification would involve (at a minimum) showing the user the actual link they’re about to visit. But it could also display a screenshot of the web page so they can see where they are about to go in a safe way before they actually visit the site.

Currently, some email apps offer some visual verification in the sense that if you put your mouse pointer on top of a link and hold there for a second or two, it will reveal the link address in a “tip” window. That’s cute, but not good enough.

The User’s Web Browser Failed

The user’s web browser allowed them to enter sensitive information (data into a password field) on a site they’ve never done that on before. The user should be warned— even before the keypress registers in the password field— that they are about to do something potentially risky. Something akin to this, but generalized for any untrusted web site asking for a login (and doesn’t call you an idiot, ideally).

And again, the web browser could check the domain against a database of risky sites (including all of these free web hosting services, God bless ‘em). A stronger warning should be given if the user is trying to enter sensitive information on a web site without a secure connection. These types of attacks rarely ever use a secure web site, since that requires money and creates a paper trail that can be followed.

We Can Do Better Than This

To sum up, there are many gaps to be filled in here. As software developers, we have to stop telling people that they are to blame for falling for these tricks. Let’s at least give them some better tools to arm themselves against the “Syrian Electronic Army” and other hackers out there.

From: Mom
To: Brad Choate
Subject: Fwd: unauthorized access

I think you will tell me to ignore this. Right?


————— Forwarded message —————
From: Strife, C Frederic (FRED STRIFE MD) <Frederic.Strife@cchmc.org>
Date: Thu, May 2, 2013 at 4:31 AM
Subject: unauthorized access

Dear Valued Staff,

We suspect an unauthorized access on your account. To ensure that your account was not compromised, please click HERE     http://updates.a.nf/     to confirm your identity and update your account.

(c) 2013 Webmaster Inc

Now, my Mom is not new to computers. She’s been using them since the ’80s. But she is susceptible to social engineering, because prior to the Internet, she wasn’t trying to be conned all the time. So, every now and then, she forwards an email like this to me, asking if it is legitimate or not. I typically just give a short “Nope; just delete that.” kind of reply, but this time, I decided to give her more to learn from. Here’s my reply:

To: Mom
From: Brad Choate
Subject: Re: unauthorized access

Yes, you can ignore an email like this. There are too many warning signs to even consider this is valid at all:

• Who is “Frederic C Strife” and why is he emailing me about my account?
• What is “Webmaster Inc.” (from the message)?
• Why does this Frederic person think I’m part of his staff (from the message)?
• What account is this in reference to in the first place?
• What is the “cchmc.org” domain (from their email address)? You’ve probably not seen that address before.
• What is the “updates.a.nf” domain (from the link they want you to use)? “nf” is the domain for Norfolk Island, which is a small island near Australia. What would that have to do with any of my accounts?
• Why is this email so short on information if it involves something so serious as unauthorized access to my account?

The email subject alone is enough to give me pause: “unauthorized access” — all lowercase, and a phrase that is purely meant to scare you and lure you into this trap.

At best, it was sent to you by mistake. At worst, it’s a link that will take you to a web site where it will attempt to install software on your computer than could contain a virus. But in this case, it is sending you to a web page that looks like this:



There’s nothing here that tells you you’re on a Google property. It isn’t explaining the situation further at all. It’s simply asking you to hand over your email address and password. They will then take it and attempt to use it to access your email. Why? To sift through it to obtain information about you, or useful things like information about other accounts. They could also change your password to lock you out of it. An email address is often used as a way to verify access to other accounts. They could request a new password for a bank account or your Amazon.com account (which could be discovered from your email history), which would send information to your (now compromised) email address for how to reset that password.

So, thanks for asking, but this is just a poor attempt to gain your email account credentials, pure and simple. Don’t fall for these.

More information on how to spot these right away:

http://www.microsoft.com/security/online-privacy/phishing-symptoms.aspx
http://idtheft.about.com/od/preventionpractices/ss/phishing_scams.htm

-Brad

This spammer was pretty lazy, actually. This is one of the more obvious ones. Some will mimic an email notification from a legitimate service like Gmail, or Yahoo! Mail. And the website itself is also pretty basic and not an attempt to appear to be any website you might recognize. Even the link in the email is unobscured. My guess is that they don’t really have to try. There are enough people that will simply click on that link and fill in a form like that without thinking much about it. (I did find it funny that they’re putting a captcha here… is this form being spammed?)

Be on your guard. As I explained to my Mom, obtaining your email account can open you up to other problems, including accessing other accounts that may be tied to your email address. At the very least, your email account could be used to propagate more spam and phishing attacks like this one.

Additional resources to educate yourself about phishing:

• OnGuardOnline.gov - Phishing

Here at Say, I’ve had opportunity to work on a wide variety of products and services with Python/Django, NodeJS, Objective-C and yes, Perl too. We’re developing modern publishing tools as well as ad delivery tools (for web publishing, these go hand in hand). Say also owns a number of sites, like ReadWrite, SplatF, Remodelista and The Kitchn. One of my colleagues wrote about what we’re up to in terms of our direction and focus and sums it up nicely. And we’re hiring — if you’re interested, drop me a line.

And personally, while I’ve been away from my blog, I have been posting semi-frequently on Twitter, and on Please. Fix. That. where I rant about broken things I come across.

Other than that, the wife and kids are doing fine. We’re enjoying our 9th year in California. We own a house as of a couple of years ago and we have two parakeets.

There, you’re all caught up.