An estimated 12 million video doorbell units are being used worldwide, and leading the market is the Amazon-owned home security system, Ring. The company’s primary product is a video enabled doorbell that detects motion, notifies you someone is at your door, and allows you to see, hear, and speak to your visitor in real time from anywhere. Customers purchase the doorbell and enroll in an inexpensive subscription service so they can store or share videos and receive notifications.
In mid-January, INKY detected a brand impersonation and credential harvesting threat. Phishers posing as home security giant Ring, had created a phishing campaign designed to steal credit card information and social security numbers from unwitting customers.
The ploy began with a simple, yet potentially alarming email with a subject line of “Ring Video Doorbell Disconnection”. Customers were told to update their membership to prevent their service from being disconnected. As you can see in the example below, the next obvious step for any concerned customer would be to click on the HTML attachment found in the email. Of course, that’s when the real troubles begin.
Malicious HTML email attachments, like the one found in this phishing email, give phishers a strategic advantage because they take users to a malicious website that is now hosted on the victim’s local machine instead of the internet. Standard URL reputation checks are avoided, and phishing content can’t be detected since nothing is hosted on the internet.
In this case, clicking on the HTML attachment builds a fake Ring website on the recipient’s local machine. An examination of the HTML and CSS code shows this attack using the same fonts, colors, and logo that Ring uses in their real website.
As you can see below, after reading instructions for resolving the issue, victims are given a link to log into their Ring account. Because the hijacked site impersonates a Ring login page (using their logo, colors, and fonts) customers can be easily fooled – especially since the cybercriminals are counting on victims being distracted by potential disconnection of their account. However, upon careful inspection, you can see that the link that appears to go to https://ring[.]com/dashbord/upgrade but is instead directed to https://www.immobilmedia[.]com/ring, an Italian real estate website hijacked to host phishing content.
Once victims click on embedded link, they are taken to what appears to be a Ring account login page. What users might not realize is that even when fake credentials are used, the phishing form allows you to move forward…inching closer to the phishers ultimate objective of harvesting credentials.
After completing the login process, customers are presented with a form to update credit card information. The form also asks for a social security number, which is suspicious considering vendors rarely ask for your social security number and hardly ever along with credit card information.
After entering their credit card number and other personal information, victims click on “Continue” and receive a fake account activation notification. Of course, this too should seem odd given that fact that the initial email asked customers to update their information to prevent being disconnected. The message they receive assumes they were actually disconnected.
The account activation notification appears briefly and then the web browser redirects victims to the real Ring website. In the meantime, the victim’s data entered on the fake website is sent directly to phishers or stored on the servers of the hijacked website.
As you probably know, a common blunder phishing attacks share is poor grammar and basic errors in usage. While many of these are overlooked by distracted or panicked victims, we like to point them out in an effort to make everyone a little more phishing-conscious. Grammatical errors should be especially rare in instances of brand impersonation since sizable companies have their own writing and editorial teams helping to ensure each customer communication is clear and professional. Let’s take a closer look at our Ring phish.
There were a number of common phishing techniques used in the Ring phishing scam.
Brand Impersonation — uses company logos and trademarks to impersonate well-known brands to make an email look as if it came from a legitimate source.
Data or Credential Harvesting — collecting personal data under false pretenses. In this case, the victims entered login credentials, SSNs, and credit card information into what they thought was Ring’s website.
Malicious HTML Attachments - encouraging recipients to click on an email attachment that harvests credentials and skirts most anti-phishing technology.
Time Pressure — adds a sense of urgency to the potential loss, again steering the target away from doing a common-sense analysis of the situation.
It’s always a good idea to stay current with the latest phishing scams, understand what’s really happening behind the scenes, and implement best practices whenever possible.
Always remember, urgency is a phishers best friend. When you feel rushed over an email you recently received, it could be a signal to slow down and pay attention. Of course, the best way to prevent phishing attacks is with the help of a third party. INKY watches out for fake account update messages and all other types of phishing emails every day, around the clock to keep companies safe. We provide the most comprehensive malware and email phishing protection available. INKY is also the only behavioral email security platform which means not only do we block phishing attempts, we also coach users to make safe decisions – everywhere, all the time. By signaling suspicious behaviors with interactive banners, INKY guides users to take safe action on any device or email client.
Find out what INKY can do for you. Request a free demonstration.
----------------------
INKY is an award-winning, behavioral email security platform that blocks phishing threats, prevents data leaks, and coaches users to make smart decisions. Like a cybersecurity coach, INKY signals suspicious behaviors with interactive email banners that guide users to take safe action on any device or email client. IT teams don’t face the burden of filtering every email themselves or maintaining multiple systems. Through powerful technology and intuitive user engagement, INKY keeps phishers out for good. Learn why so many companies trust the security of their email to INKY. Request an online demonstration today.