Exposition
I went onto Joongonara (a Korean secondhand marketplace) to sell two tablets that had just been gathering dust. There was one iPad selling suspiciously cheap that caught my eye. When I contacted the seller they immediately deleted the listing — turns out it was phishing. Since things had come to this, I decided to analyze the hacker’s server.
Rising Action
When you browse secondhand sites, you occasionally see attractive listings priced below market. For example, a tablet worth ₩430,000 listed at ₩380,000, or a laptop worth ₩2.1M listed at ₩1.9M. In cases like this it’s worth suspecting a scam at least once. Some people really are selling in a hurry, but if a listing matches the following, it’s usually a scam.
- The only contact given is a KakaoTalk ID.
- No in-person meetup location is listed, or it’s a place name you’ve never heard of.
- You message the KakaoTalk ID and their location shows up as China or Hong Kong. (99.9% phishing in this case.)
- As soon as you make contact, they delete the listing.
The scammer either lists no meetup location or a bogus one, and steers you toward KakaoTalk. Once you contact them, they inevitably insist on a shipping (parcel) transaction. If you trustingly wire the money you’d be scammed on the spot, but almost nobody does that these days. So the scammers put in a little more thought: they propose an “escrow / safe transaction.” And then they immediately build a phishing site.
Checking the link of the site they built, you can see it’s not a Naver domain.
You might say, “Who would fall for it thinking it’s Naver when the domain doesn’t even end in naver.com?” — but it seems to be more people than you’d expect.
Following the link, you find a page built by scraping Naver’s HTML.
If you press “Pay with Naver Pay” here, you’re taken to a screen the hacker made. (But on mobile it doesn’t load — apparently they never built a mobile page. If you’re going to run a scam you should be thorough; this is way too sloppy.)
Naturally, I press “Yes.”
It prompts a Naver login. If you enter your real Naver credentials here, they’re saved verbatim into the hacker’s database. That account is then used for further phishing or sold as personal data. I briefly considered typing something rude, but out of fear of retaliation I entered a meaningless string for now.
(And while analyzing, I happened to notice that some hero of justice had already left them some choice words.)
Next it’s time to enter your phone number and home address. If you put in your real information here, that too gets saved verbatim into the hacker’s DB.
Crisis
Right as I was about to start the analysis in earnest, the scammer messaged me.
They kept pushing, and I got the feeling they were about to shut the server down. So I bought time by saying I’d get back to them later, then dove back into the analysis.
Climax
By this point a question arises: “Did these bad kids running the phishing actually secure their own site?”
Sure enough, the scammers had no idea how to protect the “assets” (?) they’d painstakingly gathered through phishing.
To cut to the result: the server held the personal information of a huge number of people. The logs started from early 2019, and an enormous amount of data was stored. All of it was exposed defenselessly to SQL injection, so secondary leakage of this personal data is a serious concern.
The data used internally was mostly in Chinese, so I couldn’t make out what it meant. Skimming through, I found that the DB stored the domain information used for phishing.
Looking closer, the web structure of every host was identical — each server connected to a central server’s DB. They seem to run phishing across about 129 domains simultaneously. From a rough estimate, it looked like people doing this for a living, moving in an organized fashion. I’d guess the setup hands out one or two hosts per scammer and puts them to work.
Resolution
To avoid falling for phishing like this, it’s good to check the link’s domain from now on. But even if the domain really is the service provider’s, if that service has a vulnerability like XSS, checking the domain alone can’t prevent phishing. So whenever possible I think it’s best to meet in person or buy new.
P.S. As always, it really does seem best to buy new from an official seller.
Disclaimer
This post was written for the public interest. Please do not misuse the information obtained here. Any legal liability arising from this post rests with the abuser.
If there is anything problematic in this post, I will edit the content or delete the post. (delsponn@gmail.com)