I just got one of those random skypes, I'll quote it here for the lols:


Anyway, clicking the ling of course takes you to a scareware virus scanning page. (which will in all likelyhood not still be up by the time you read this) Here's a screenshot in case you miss it.

So, clicking on that (I have to click on the very tippy bottom of the alert bubble on the bottom, I'm sure windows users have a much larger flashy target somehow) takes me to cart.secureorderstore.com. So I thought aha, THAT I can maybe do something about. It too may be something that's no longer valid by the time you read this, so here's another screen shot.

Anyway, I loaded the root of the page (https://cart.secureorderstore.com/) and it's a blank apache template page so I assume it's an infected high bandwidth zombie of some sort being used to collect everyone's credit card numbers and maybe even sell you something, but it's certainly not on the up and up.

So I look again... the little icon to the left of the URL is a gold lock, ya, whatever. BUT, it IS https, and the padlock in the upper right is showing, AND I didn't get a warning for an unsigned certificate, which really surprised me when I thought about it. hmm, that's unexpected. So if I can try to make the signature go away that may be a start. Clicking the lock, I get an Equifax Signature ... ok. There's somewhere I can go.

Or can I? The secureorderstore.com domain is obviously being used for unadulterated fraud, but equifax is signing off on them. I tried for awhile to find a way to contact them to report it and maybe get their cert revoked, (ya I know it won't do a LOT of good, but it'll get rid of ONE of the locks on the screen) but I was unsuccessful.

It appears that equifax is almost as shady as these fraudsters, from what I'm reading online. They appear to have really crappy customer service, and do their darndest to prevent you from contacting them via email. So, anyone got an address with a pulse I can report their supporting fraud to? I find it ironic that a company whose business appears to be geared toward accountability is helping fraudsters.

Reporting to Equifax won't likely do any business. The certificate was actually issued by RapidSSL, not by Equifax (Equifax is the upstream CA). The shopping cart on secureorderstore.com is already dead.

This isn't the first time that organized crime has duped someone into issuing a security cert for a malicious Web site. There is so much money in computer viruses that it's worthwhile for organized crime to set up fictitious businesses, with real business licenses and the whole bit, just to get security certs or digital signing certs.

One such "business," Mistland Limited, tricked a CA into giving them not only SSL certificates but even into giving them code-signing certificates, which they attached to their malware. So the malware would download and run even on computers that had their internet security settings cranked up to maximum, which will cause a browser refuse to download and run an unsigned app.

What's a CA?

ryck

"Certificate Authority"