25th May 2004

AOL

SNVerify22339@aol.com <SNVerify22339@aol.com>

Account Termination, Please Respond ASAP

HTML

link leads to a forged AOL web form - submitted form data is captured by a remote script

Yes

Spoofed - http://www.aol.com (you'll see this if your browser is vulnerable (see below)
True URL - http://geocities.com/aol_people
** The URL in the email message is shown as http://www.aol.com@geocities.com/agree_aol which attempts to exploit the URL spoofing vulnerability in unpatched Internet Explorer browsers (which would incorrectly show http://www.aol.com in the address bar instead of the true URL)
(the presence of the '@' symbol in any link is a sign of a possible exploit of this vulnerability).

Medium

1. Exploits URL Spoofing (canonicalisation) in Internet Explorer browsers - run Windows Update to ensure your browser is patched.
2. The forged page is currently being forwarded to the genuine AOL domain - this has something to do with one of the scripts coded into the page - we are presently unsure of the reason why this is so, but it could be to add a sense of authenticity until email recipients come back later to enter details, or it could be that AOL have altered a script that they reference in their code to initiate the redirect.
3. The page is scripted and encoded to prevent viewing the source code - we were able to descramble this quite easily.
4. Other versions of this spoofed AOL email are in circulation, iincluding ...
Account Error #22936
Please Validate Your Screen Name
Please Tend to This Urgent Matter
Account Error #12493