SMS Phishing Part 1

With the recent mentioning of NKF hiring an external company Protonweb which resulted in scam and undelivered work, it bought up a previous case I had, which I thought was worth mentioning…

Sometime back, I received this SMS :

With Love from XXX: Enjoy 5X XXX$ for shopping or dining! SMS "XXX shopping" or "XXX dining" followed by your card number to 90241111 by 10 Dec 05. T&Cs apply.
( XXX is a bank, which is not so bad overall )

Sound ok to you? Well, it doesn’t to me. I did not feel safe SMS my credit card to anybody. Not even the bank. Wait a minute, this is not even a 78xxx number… its just a normal SIMS number or even a prepaid card number which you can buy anywhere…

So I thought, this is probably a new way of phishing… by SMS. Now, a simple question before I go on. With ONLY the credit card number, what can you do? Most people will tell me : nothing. You dun have names, telephone etc… well, at least not even the date of expiry. OK, I am going to tell you it doesn’t take a lot of guesses to find the DOE. With common sense that bank replaces card 3 months ahead, so you can start check with at least 3 months. And most bank do not issue card exceeding 2 years ( some exception now with 5 years max ). So that’s not a lot of guesses to do. Now with these 2 piece of info, I can buy lots of things such as body part enhancement BS on the internet. J

Back to the SMS. So I decided I want to probe. I called the number instead of SMS back the info. It belongs to a automatic machine which answers. It dos not do much and there are no options. But it did gave me one piece of information. The company is called localguru and is located at http://www.localguru.com/. Now I am suppose to make joke about a company call localguru, but lets skip that and suppose they just happens to like this name. Open my browser and http://www.localguru.com/, waited a few minutes. Blank. Not found. DNS failure. Wonderful.

Domain localguru.com.
Type A
Class IN
TTL 3600
Answer 209.67.50.203

Domain localguru.com.
Type NS
Class IN
TTL 3600
dns5.register.com.

Domain localguru.com.
Type NS
Class IN
TTL 3600
dns6.register.com.

So I did my DNS search and found the above. And of course followed by a Whois.
Registrant: tmdigital.com
1508 Two Exchange Square 8 Connaught Place Hong Kong, HK HK HK
Domain name: LOCALGURU.COM
Administrative Contact: Mackay, Tony ****@tmdigital.com
1508 Two Exchange Square 8 Connaught Place Hong Kong, HK HK HK
+852 9180 2111
Technical Contact: Mackay, Tony ****@tmdigital.com
1508 Two Exchange Square 8 Connaught Place Hong Kong, HK HK HK
+852 9180 2111
Registration Service Provider: WebsForSale.com,
*****@websforsale.com +852 9180 2111
http://www.websforsale.com
This company may be contacted for domain login/passwords, DNS/Nameserver changes, and general domain support questions. Registrar of Record: TUCOWS, INC. Record last updated on 25-Dec-2004. Record expires on 23-Jan-2006. Record created on 23-Jan-2000.
Domain servers in listed order: DNS5.REGISTER.COM 216.21.234.73

Ok, so a Hong Kong company is running the show behind this. I started to feel the chills. It’s a Hong Kong company that does NOT even have a website that is running this! I decided to email the bank.

This is getting long, I will continue the story in another post …