Tuesday, May 3. 2005
Beware the replay
American Express apparently just sent an email to some of their cardmembers that provides the perfect opportunity for a phisher to create a replay attack. They apparently tried putting some smarts behind their links but it's been demonstrated how to easily bypass their filters and send an email very similar to the following (real, but sanitized) email:
Wow. Invisible tracking links that determine whether the user read the email. Links that actually connect to a different URL than advertised.
All the classic scam techniques, demonstrated by a big, trusted company.
From: American Express [mailto:AmericanExpress@email2.americanexpress.com]
Sent: Monday, May 02, 2005 3:55 PM
To: someone@san.rr.com
Subject: Update Contact Information
Dear Cardmember,
Our records indicate that your billing address is no longer valid for your account ending in 82005.
Having your most updated contact information is critical to our ability to service your account and to provide you with information on important changes that impact your account.
Please take a moment to update your contact information on https://www.americanexpress.com/updatecontactinfo. If you prefer, you can copy and paste or type the URL directly into your address bar.
If you have any questions regarding this message, please call the telephone number on the back of your card for assistance from a Customer Service Representative.
Thank you for your time and continued business with American Express.
Sincerely,
American Express Customer Service
To Reply to this e-mail
Simply log in to our Secure Message Center at https://www.americanexpress.com/messagecenter and send your inquiry via secure e-mail. If clicking on this link does not work, please cut and paste it into the "address" bar of a new browser window. This e-mail was sent from a notification-only address that cannot accept incoming e-mail.
Notice About Servicing E-mails
This e-mail was sent to you by American Express Customer Service to provide important information about your account and/or online products and services for which you are registered. You may receive customer service e-mails even if you have requested not to receive e-mail marketing offers from American Express.
Privacy Statement
For details on our e-mail practices, please visit the American Express Privacy Statement at http://www.americanexpress.com/privacy.
AGNEUATH0003001
Wow. Invisible tracking links that determine whether the user read the email. Links that actually connect to a different URL than advertised.
All the classic scam techniques, demonstrated by a big, trusted company.
Trackbacks
Trackback specific URI for this entry
No Trackbacks