In this post I will demonstrate how I reversed engineered a phishing attempt from a SMS pretending to be LUNO and trying to steal my personal details, inspecting the SMS, under a controlled environment, inspect the fake website and see what they are trying to accomplish in order for us to learn what the risks are and how to avoid them.
The Suspicious Text Message
So I received a phishing attempt via SMS, pretending to be LUNO (twice), with their hopes, of making me update my account details:
What is Phishing
Phishing is a social engineering attack to steal your personal data, pretending to be someone that they are not.
So reading this message, is similar to some stranger knocking on your door, asking you for your online banking details, because someone “from the bank” said they will freeze your account if you don’t update it via them. But let me explain.
About the SMS
So what this text message is trying to tell me, is that I should click on that link and update my Luno account.
So let’s back up one step, step 1. NEVER follow any emails or sms messages instructing you to change or update or login to your account to make changes.
Legal Pages at LUNO
If we head over to Luno’s legal section of their website and browse to their Avoid having your account compromised page, you will see that they mention that you should never follow SMS messages (as one example) to “update your account, as this is a phishing attack where you are being tricked into a attempt of the attackers trying to steal your personal information, in order to gain access to your account”:
Red Flags on the SMS
So let’s review this SMS message and try and point out the red flags:
- A lot of websites can’t stress enough that they will never ask you to update your details. If you are unsure, logon to the website directly and look for notices.
- The link: bitly is a url shortener that anyone can use, which hides the original url, as for Luno, their website is https://luno.com.
- Sense of urgency / steps to action: This is how a lot of people are tricked, they want you to feel that you must take action, as you can see
to avoid deactivation ... if not updated
- I’ve removed the number, but usually with emails you can inspect where the email comes from. With marketing messages, a lot of businesses use random numbers, and this might be where they think that people will assume its from a automated system (my opinion)
Reverse Engineering their Process
So let’s decipher this message and see where this link is taking us and what are they trying to accomplish, we know by now this is a phishing attack. I cannot stress this enough, do not click on unknown links, as your information about your source IP and browser are also captured.
But for this demonstration, I am using a environment without leaking our source address, we can try and figure out what they are trying to do, essentially using a virtual desktop via a VPN.
Let’s start with the link, I have used a VPN connection to hide my source address, and making a curl request with following the location flag, to see what the shortened URL translates us to:
$ curl -IL https://bit.ly/3xxxxzt
date: Wed, 08 Sep 2021 22:28:44 GMT
content-type: text/html; charset=utf-8
cache-control: private, max-age=90
content-security-policy: referrer always;
via: 1.1 google
So we can see that when we go to
https://bit.ly/3xxxxzt it redirects the request the the target URL, which is
location: https://hxxxxxxxxxxxxxxt.org/2915/LUNO/, and not
Note: I’ve added the
x's intentionally as I don’t want people to click on the links.
Inspecting the fake website
So I was curious to know how this website looks like and what they are trying to do, so I used a project dorowu/ubuntu-desktop-lxde-vnc for accessing a desktop environment accessible via vnc in your browser which runs on a container, and the reason for container requirement, is that I can use it in conjunction with the dperson/openvpn-client container so that I can use the openvpn container’s network for this desktop container, so that my traffic is masqueraded behind the VPN.
If you would like to skip the technical details, you can skip the following part.
This is the
docker-compose.yml for having a linux desktop in the browser behind a VPN:
- /dev/net:/dev/net:z # tun device
command: '-f "" -r 192.168.0.0/24' # enables fw and routes local traffic
test: ["CMD", "curl", "-Ss", "ifconfig.co"]
Booting the services above, and accessing our desktop to verify that we are running behind a VPN:
As we can see we are being routed via Netherlands, which is the same OpenVPN config that I am using.
Inspecting the Website
After entering the unsafe URL into my container browser, we can see that we are being prompted with a login, so we know that the attacker wants to capture our account information, as we can see except for the URL, it looks very similar to LUNO’s website:
After inspecting the elements of the login form:
we can see that theres a php file on their server called
ver1.php, and what the html is showing us, is that its capturing the following fields:
- email address
- mobile number
And when you click “Next” it will submit those form fields to their
ver1.php file, assuming that its a server side script, that captures those fields and stores them to a database, and perhaps notifies them that someone submitted the form (assuming - as we don’t have access to that file)
So let’s fill some dummy data into the form:
After we submitted the form data and we inspect the network tab on the right, we can see that a POST request was being made (meaning, submitting data to the server) to the
ver1.php file and the scary part is, that we can see the form data was sent to them in plain text:
So now they have:
Which is dummy data that I generated until it met their acceptance criteria.
What does this mean for us
The even more scarier part is that they prompt you for your Multi Factor Authentication (MFA/2FA) pin, so if you have MFA associated to your LUNO account (which you should), only you have access to this pin that is being generated. So let’s take a scenario where you open up your MFA device, and enter this pin into this form, and press submit. This essentially means, that they now have your sign in details as well as your MFA pin (which only lasts for 15-30 seconds.
So taken the fact that they have the details mentioned above, in near-realtime, they can use the captured information, and use that to sign into your account, then they change your password, or even worse, transfer all your funds as an example.
Always ignore and delete messages telling you to “do this or else”, “update account settings”, or anything that instructs you to click on unknown links or let you use your confidential information on unknown sites. Always make sure you read and understand the security tips of the websites you register to.