Featured Articles
Announcing Pi
Technical Specifications
Raspberry Pi FAQs
Win a Pi
Raspberry Pi Wishlist
Actions
Forum Thread Details
  • Replies 10 replies
  • Subscribers 664 subscribers
  • Views 673 views
  • Users 0 members are here
Related

Alleged Farnell survey with spoofed source

morgaine

Beware of emails with the subject line "Share your views with Farnell element14" pretending to come from someone "@circle-research.com".  They don't.

 

DON'T CLICK ON THE LINKS.

 

The header lines show that in reality the mails are coming from bre.globalpark.com, and there is nothing to suggest that the survey is authorized by Farnell nor that there is any factual association with circle-research.com.

 

What's more, the two domains are both of questionable status, as their domain registrations don't tally with the sites that host them --- circle-research.com is actually hosted on kundenserver.de but has a domain contact in a private flat in the UK and mail exchanger on 1and1.com, while globalpark.com belongs to Globalpark AG but has email contact @3uu.de and is hosted on what appears to be a colo at hosteurope.de .  All of this is typical of phishing scams --- the details are all over the place instead of consistent with the claimed source domain.

 

Unless Element 14 / Farnell reply and confirm that this is authorized by them, it's just your standard phishing attempt.  DON'T REPLY TO IT.

 

 

Morgaine.

  • I was about to fill this in when I saw your post. Actually I think it's genuine. They give a phone number and they have a web site. I rang them and spoke to Andrew Dalgleish and he said the email came from them. The survey looks like the usual Farnell survey so either I'm too gullible or you're too paranoid image

     

    Michael Kellett

  • in reply to michaelkellett

    One of my longer-term contracts was at a major national ISP, working as a networking engineer on firewalls and as a sysadmin on mail, web, DNS and other systems .... so I know exactly why I should be paranoid, and why you should be too. image

     

    In case the survey and the source turn out to be genuine (confirmed by Element 14 / Farnell, not by phoning the 3rd party and asking them), I would strongly advise against allowing 3rd parties to do things in Farnell's name without any type of validation being offered nor any prior annoucement.  This kind of innocence feeds into the hands of organized crime directly, and should be avoided.

     

    Morgaine.

  • in reply to morgaine

    Hello Morgaine,

     

    I see it's now three hours since you posted your first warning but still no official Farnell response image

     

    I do agree that it would be a very good idea (to put it mildly) for a company doing surveys by email to use more transparent domain naming/hosting.

     

    Michael Kellett

  • thanks for sharing this Morgaine.  hope we hear something from Farnell to confirm your observation.

  • Hi Morgaine,

     

    Thanks for asking and for protecting our community members from possible phising attempts. 

     

    I just received word from the team who was responsible for the email, this isn't a phising survey but one that is sanctioned by Farnell element14 (what we are called in Europe).  It was sent from the market research company on our behalf.  Each quarter, we send a customer satisfaction survey to people who have purchased from us in the last few months.  If you've received this email, we would really appreciate if you could take a few minutes and tell us what we think.  It's really important to us to keep learning about our customers, what they need and to find new ways to improve.

     

    Sorry for the scare and hope this helps to know it's legit image

     

    Thanks,

    Nicole

  • in reply to Nate1616

    Happy to help!  Have a good weekend! image

  • in reply to nlarson

    Thanks Nicole!  Very good news indeed that this wasn't a phishing scam.  We don't need .them. image

     

    I reiterate my advice given earlier though, and suggest that you pass it on to the Element 14 Farnell department that commissions such surveys, or to your techies.

     

    Do not do things this way.  Organized crime absolutely adores the lack of source validation on email and the way that customers give their trust to arbitrary third parties.  This is so much easier for them than breaking and entering houses and being chased out by rottweilers.  The Internet is an absolute boon for them, 2 billion innocents just some clicks away and almost no possibility of getting caught.

     

    The least we can do in this situation is to not put our customers in harm's way unnecessarily.  Try to send everything from your own domains if possible, as this is by far the simplest approach for your customers to understand.  Your sysadmins can easily arrange a protected drop box on your site into which accredited 3rd parties can drop their emails, which your own site then sends out automatically.

     

    And if for some reason that is not possible, then require your nominated 3rd parties to use a cryptographic validation system (there are many kinds, typically using digital signatures) so that your customers can validate the message or the source against information on your site.  And be sure to revoke your authorization key as soon as the 3rd party has finished the mailshot, because private keys outside of your control don't stay private for long.  This is more complex for customers to understand though, so I'd recommend the first approach before this one.

     

    It was a false alarm this time, fortunately.  Alas, one day it won't be.  We should try to avoid that happening.

     

    Morgaine.

  • in reply to morgaine

    I agree with Morgaine on this. Seriously, it's not  hard at all to make all mails to come from your domain. Everybody does it this way and I'm actually surpriced E14 doesn't. It makes it so much simpler to know if its a fishing attempt.

  • You can never be too sure! Even though this one turned out to be legit, it doesn't take the scammers long to smell fresh meat. Thanks for caring and sharing!