With the recent outbreak of the fifth wave of COVID, the government has adopted an array of measures to cope with the epidemic, including vaccine passports. UD security researchers found that hackers seized the opportunity to launch SMS phishing attacks as the public are concerned about those measures. If users are not aware of phishing, they are likely to suffer from financial and personal data loss.
1. SMS Phishing attack
2. Points to note
3. How to prevent SMS phishing?
SMS Phishing attack
We found an example that the attacker pretended to be an official of the Department of health and sent a phishing SMS with ID "BeCOVIDSafe" to the recipient, asking them to buy fake vaccine certificate.
If the recipients click the shorten link, they will reach a fake webpage that looks similar to the Department of health official website. In order to purchase the vaccine certificate, users need to submit personal information and payment methods, including credit card number, expiration date and CVV number. The website will even require SMS verification code to process payment, which greatly increases the credibility of the website. When all the information is submitted, payment transaction will be done immediately.
Points to note
- SMS system can not verify the sender ID, as long as the sender ID is the same as the real ID, the mobile phone system will automatically classify the SMS as the same sender. As a result, it makes the recipients thought the SMS is sent by the real sender.
- There is a limit on the length of links for SMS message. Attackers will use shortened website links generated by service provider such as "Bitly". As shorten links are commonly used by companies, it is difficult for the recipients to identify the problem right the way when they read the SMS.
How to prevent SMS phishing?
Unlike email, SMS has no security setting or software to filter suspicious message. It greatly depends on the users to identify phishing SMS. Please note the following tips:
- Users should first think about whether the content of the SMS is reasonable.
- IOS / Android system will automatically group SMS with the same sender ID, so fake SMS is easy to mix with real ones. Even if you receive daily SMS messages from brands and companies, you should be keep your eyes open. If you click the link and open the webpage, you should also pay attention to whether the website is the official one.
- You can use "short link expander"（ e.g. https://www.expandurl.net/ ）to restore the link to its original state, so you are able to check whether it is a valid link (check if the domain name is correct).
- If necessary, you should contact the organization to verify the promotion content.