Skype Gets Phishy - in Chinese

Posted on September 6, 2007
Filed Under China Internet, Security |

pix1.jpgI’m a big fan of Skype. It’s one of the more useful internet services out there. I’m logged into it all the time, with my status typically set to “Not Available”. That means chat messages will still pop up. Every once in a while I’ll get a slew of messages from different users in Chinese. The image to the left is an example.

Using Google Translate I got a rough translation:

Respected TOM-skype users:
Congratulations! Skype your account has been randomly selected for the award system [users] lucky,
You will be pleasantly surprised by the Company bonuses ¥ 28,000 yuan (renminbi) and Samsung Q30 laptop a series.

Please log activities website: http://www.skype-1.com/w/ for recipients! Remember opponents code: (50188)
Counseling hotline: (089) -88803-9290
[Skype issued by the news, without any response. ]

People are phishing on Skype!

The Anti-Phishing Working Group (APWG) defines phishing:

Phishing attacks use both social engineering and technical subterfuge to steal consumers’ personal identity data and financial account credentials. Social-engineering schemes use ’spoofed’ e-mails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as credit card numbers, account usernames, passwords and social security numbers. Hijacking brand names of banks, e-retailers and credit card companies, phishers often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using Trojan keylogger spyware.

It’s one of the oldest tricks in the book for stealing user data on the internet. Tricks get old because they work - the APWG tracks thousands of new sites every month.

I was curious about the URL in the Skype message, www.skype-1.com. Using samspade, on online WHOIS service. WHOIS data tell you who is the registered owner of a site and their contact information. This is what came back:

Domain Name: skype-1.com
Registrant:
at eng
bei jing shi
100000
Administrative Contact:
at eng
at eng
bei jing shi
bei jing Beijing 100000
CN
tel: 01023232323
fax: 01023235656
342270928@qq.com

etc…

Clearly not Skype or their Chinese partner, Tom Online.

Phishing would appear to be relatively immature in China. The APWG partners with Websense to track phishing worldwide. As the map below shows, China seems relatively free of phishing websites.

phishmap.jpg

The level of sophistication shown by the hacking community in China would argue against Websense’s data. If they’re phishing on Skype, they’re phishing everywhere else online (mobile phishing?).

And what of www.skype-1.com? When I went to the site (hosted by bootchina.com and apparently located somewhere in Anhui province) it was gone. The provider had yanked it (or had been told to yank it), leaving this message (the translation is from Google again, so it’s a little funky):

Respected user Hello!

自今年5月起，公安部、信息产业部、全国“扫黄打非”工作小组办公室等十部委开展了《联合打击淫秽色情专项行动》，中国互联网协会也发起了“文明办网 自查互查”的活动。 Since May this year, the Ministry of Public Security, Ministry of Information Industry, the “helping” the office of the group, 10 ministries in a “joint campaign against pornographic”, the China Internet Association also launched the “inter-civilization offices network self check” activities. 为了以全新的互联网风气迎接党的十七次代表大会胜利召开，树立和弘扬以“八荣八耻”为核心的社会主义荣辱观，作为国内最大的信息化基础应用服务运营商之一，将在全国范围内积极配合相关部委和组织展开打击网络淫秽色情专项行动，倡议广大用户从自律开始，净化网络空气，营造健康向上的绿色网络环境。 In order to meet the new Internet culture of the 17th Party Congress convened victory, foster and promote “8-8 Shame” at the core of the socialist concept of honor, as the country’s largest information technology application services based operator of the country will actively cooperate with the relevant ministries and organizations to combat start network pornographic special action, initiatives from the majority of users discipline, purifying air network, and create a healthy and progressive green network environment.
根据《互联网信息服务管理办法》（国务院令第292号），应国家相关公安机关要求，现正式提醒广大用户不得利用互联网制作、复制、发布、传播含有下列内容的信息： According to the “Internet information service management approach” (the State Council Order No. 292), should be relevant state public security organs, now formally advise customers not to use the Internet, copy, distribute, disseminate information with the following contents:

（一）反对宪法所确定的基本原则的； (1) by the Constitution against the basic principles set;
（二）危害国家安全，泄露国家秘密，颠覆国家政权，破坏国家统一的； (2) of endangering national security, leaking state secrets, subverts the government, or undermines national unity;
（三）损害国家荣誉和利益的； (3) the expense of national honor and interests;
（四）煽动民族仇恨、民族歧视，破坏民族团结的； (4) to incite ethnic hatred or ethnic discrimination, undermining national unity;
（五）破坏国家宗教政策，宣扬邪教和封建迷信的； (5) undermines national religious policy, about the cult and feudal superstition;
（六）散布谣言，扰乱社会秩序，破坏社会稳定的； (6) spreading rumors, disturbs social order, or undermines social stability;
（七）散布淫秽、色情、赌博、暴力、凶杀、恐怖或者教唆犯罪的； (7) dissemination of obscenity, pornography, gambling, violence, murder, terrorism or abetting crime;
（八）侮辱或者诽谤他人，侵害他人合法权益的； (8) insults or slander others, against other people’s legitimate rights and interests;
（九）含有法律、行政法规禁止的其他内容的。 (9) containing laws and administrative regulations prohibiting other content.

So much for that phisher (crushed by the new Internet culture of the 17th Party Congress, no less) - but I’m sure there are plenty more out there.

Comments

2 Responses to “Skype Gets Phishy - in Chinese”

  1. simon on September 6th, 2007 9:39 pm

    Check out http://www.zoippe.com. No phishing yet and free minutes as well.

  2. Catching Mice in China - Technology and business in and around China » Review: China in Symantec’s Internet Security Threat Report on September 24th, 2007 5:08 pm

    [...] China, I’m surprised that this rating is so low. I have no data of my own (other than my own experience), but it doesn’t make sense that this effective trick wouldn’t be used by China’s [...]

Leave a Reply