Paul Mutton of security firm Netcraft discovered that phishers are using Facebook's TLS certificate to create "highly convincing" scams that can go unnoticed by most users.
The phish uses an iframe(*) to display a Facebook verification form within a social network app (the URL is apps.faceboοk.com and something else, as you will see in the images below).
Naturally this form is not from the social network, but comes from an external Hostgator website that uses HTTPS and Facebook's certificate.
This combination means that browsers will not warn their users about the impending danger.
As soon as the victims log in through the form served as an iframe, a second fake login form will appear claiming that the first credentials were incorrect. It will then ask the victims to log in again.
After the second successful login, another page appears (when the user submits their credentials for the second time) which states that the victim will receive an email message for verification approval within the next 24 hours.
“Scammers use Facebook's login platform to carry out remarkably persuasive phishing attacks against its users», says Paul Mutton.
See the images:
“To fool even the one who remains suspicious, the phishing website pretends that the initial credentials were incorrect.”
How to identify: The social network login page URL does not contain the word apps.
How to protect yourself? Add two-factor authentication from your account settings.
____________________
(*) iFrame is the technique of displaying a page within another. At iGuRu.gr for those who remember we had used iFrame to display the forum of iGuRu.News which was hosted on another server on a page of iGuRu.gr.
