Thanks FedEx, This Is Why We Keep Getting Phished (2024)

3 hours ago

Phishing SMS pretending to be parcel delivery services are common, but this one turned out to be a real FedEx notification.
The SMS contained multiple red flags: typos, urgency, odd URLs, and mismatched details.
An 87% majority of respondents to a poll considered the message 'dodgy AF'.
Investigation revealed the BPOINT payment link was vulnerable to parameter tampering, but it was a legitimate service.
A follow-up SMS was even more broken, with a non-functional link and inconsistent capitalization.
Calling FedEx directly confirmed the shipment and fees, and an email with the invoice proved authenticity.
The real danger is that legitimate companies like FedEx can inadvertently mimic scammers, making it hard for users to distinguish.
Technical controls alone are insufficient; human awareness of scam patterns remains crucial.

Anti-fraud tools lag behind scammers who exploit cheap internet calling and artificial intelligence.
No single solution exists; authentication, traceback, call blocking, and enforcement must work together.
STIR/SHAKEN authentication is not a silver bullet; bad actors obtain legitimate numbers to bypass it.

The author posted 'pleasedonotescape.com' to Show HN, which included a list of AI agent jails and promoted his own jail 'byre'.
Within 14 hours, 13 LLM-generated spam emails were received: 10 to the site address and 3 to the HN profile address.
The spam emails sold services like pitch-deck scoring, QA reports, homepage teardowns, competitor reports, SEO fixes, social media content, freelancers, and a VC scouting agent.

Group chats on major messaging services are end-to-end encrypted but vulnerable to content manipulation by malicious group members or compromised devices.
Attackers can send messages with the same ID but different content to different recipients, breaking transcript consistency.
Examples include fake meeting invitations, manipulated polls, and hidden malware links disguised as harmless content.

The author encountered a seemingly legitimate Cloudflare product page that exhibited multiple signs of a phishing attack, such as an unfamiliar domain and a suspicious permission request.
Despite initial suspicion, the product ('Wallet') was later confirmed to be legitimate, highlighting the difficulty in distinguishing real sites from phishing attempts.
The author criticizes the lack of best practices, including a missing 'Report' option and a misleading green checkmark UI element, and urges developers to follow security standards.

The 2015 Underhanded C Contest results were announced, with the winner and runners-up recognized for their submissions.
The challenge was a real-world nuclear verification problem sponsored by the Nuclear Threat Initiative.
Many submissions used NaN poisoning attacks, where floating-point NaN values cause false comparisons.

Anti-fraud tools lag behind scammers who exploit cheap internet calling and artificial intelligence.
No single solution exists; authentication, traceback, call blocking, and enforcement must work together.
STIR/SHAKEN authentication is not a silver bullet; bad actors obtain legitimate numbers to bypass it.

The author posted 'pleasedonotescape.com' to Show HN, which included a list of AI agent jails and promoted his own jail 'byre'.
Within 14 hours, 13 LLM-generated spam emails were received: 10 to the site address and 3 to the HN profile address.
The spam emails sold services like pitch-deck scoring, QA reports, homepage teardowns, competitor reports, SEO fixes, social media content, freelancers, and a VC scouting agent.

Group chats on major messaging services are end-to-end encrypted but vulnerable to content manipulation by malicious group members or compromised devices.
Attackers can send messages with the same ID but different content to different recipients, breaking transcript consistency.
Examples include fake meeting invitations, manipulated polls, and hidden malware links disguised as harmless content.

The author encountered a seemingly legitimate Cloudflare product page that exhibited multiple signs of a phishing attack, such as an unfamiliar domain and a suspicious permission request.
Despite initial suspicion, the product ('Wallet') was later confirmed to be legitimate, highlighting the difficulty in distinguishing real sites from phishing attempts.
The author criticizes the lack of best practices, including a missing 'Report' option and a misleading green checkmark UI element, and urges developers to follow security standards.

The 2015 Underhanded C Contest results were announced, with the winner and runners-up recognized for their submissions.
The challenge was a real-world nuclear verification problem sponsored by the Nuclear Threat Initiative.
Many submissions used NaN poisoning attacks, where floating-point NaN values cause false comparisons.

Hasty Briefsbeta