Featured Articles
Announcing Pi
Technical Specifications
Raspberry Pi FAQs
Win a Pi
Raspberry Pi Wishlist
Actions
Forum Thread Details
  • Replies 10 replies
  • Subscribers 676 subscribers
  • Views 1037 views
  • Users 0 members are here
Related

Alleged Farnell survey with spoofed source

morgaine

Beware of emails with the subject line "Share your views with Farnell element14" pretending to come from someone "@circle-research.com".  They don't.

 

DON'T CLICK ON THE LINKS.

 

The header lines show that in reality the mails are coming from bre.globalpark.com, and there is nothing to suggest that the survey is authorized by Farnell nor that there is any factual association with circle-research.com.

 

What's more, the two domains are both of questionable status, as their domain registrations don't tally with the sites that host them --- circle-research.com is actually hosted on kundenserver.de but has a domain contact in a private flat in the UK and mail exchanger on 1and1.com, while globalpark.com belongs to Globalpark AG but has email contact @3uu.de and is hosted on what appears to be a colo at hosteurope.de .  All of this is typical of phishing scams --- the details are all over the place instead of consistent with the claimed source domain.

 

Unless Element 14 / Farnell reply and confirm that this is authorized by them, it's just your standard phishing attempt.  DON'T REPLY TO IT.

 

 

Morgaine.

Parents

  • Hi Morgaine,

     

    Thanks for asking and for protecting our community members from possible phising attempts. 

     

    I just received word from the team who was responsible for the email, this isn't a phising survey but one that is sanctioned by Farnell element14 (what we are called in Europe).  It was sent from the market research company on our behalf.  Each quarter, we send a customer satisfaction survey to people who have purchased from us in the last few months.  If you've received this email, we would really appreciate if you could take a few minutes and tell us what we think.  It's really important to us to keep learning about our customers, what they need and to find new ways to improve.

     

    Sorry for the scare and hope this helps to know it's legit image

     

    Thanks,

    Nicole

  • in reply to nlarson

    Thanks Nicole!  Very good news indeed that this wasn't a phishing scam.  We don't need .them. image

     

    I reiterate my advice given earlier though, and suggest that you pass it on to the Element 14 Farnell department that commissions such surveys, or to your techies.

     

    Do not do things this way.  Organized crime absolutely adores the lack of source validation on email and the way that customers give their trust to arbitrary third parties.  This is so much easier for them than breaking and entering houses and being chased out by rottweilers.  The Internet is an absolute boon for them, 2 billion innocents just some clicks away and almost no possibility of getting caught.

     

    The least we can do in this situation is to not put our customers in harm's way unnecessarily.  Try to send everything from your own domains if possible, as this is by far the simplest approach for your customers to understand.  Your sysadmins can easily arrange a protected drop box on your site into which accredited 3rd parties can drop their emails, which your own site then sends out automatically.

     

    And if for some reason that is not possible, then require your nominated 3rd parties to use a cryptographic validation system (there are many kinds, typically using digital signatures) so that your customers can validate the message or the source against information on your site.  And be sure to revoke your authorization key as soon as the 3rd party has finished the mailshot, because private keys outside of your control don't stay private for long.  This is more complex for customers to understand though, so I'd recommend the first approach before this one.

     

    It was a false alarm this time, fortunately.  Alas, one day it won't be.  We should try to avoid that happening.

     

    Morgaine.

  • in reply to morgaine

    I agree with Morgaine on this. Seriously, it's not  hard at all to make all mails to come from your domain. Everybody does it this way and I'm actually surpriced E14 doesn't. It makes it so much simpler to know if its a fishing attempt.

Reply Children
No Data