DNS Scam Redirects Trezor Users To Cryptocurrency Phishing Site
Over the weekend a phishing campaign targeting Trezor customers was discovered by the hardware wallet company.
Between June 30 and July 1, 2018, Trezor’s support team began to investigate the cause of alerts it had received regarding an invalid SSL certificate for the company’s website. Further investigation revealed a phishing campaign being perpetrated against the Trezor customer base.
According to Trezor, users who attempted to visit their legitimate URL were redirected to a phishing site in what appears to be either a BPG hijacking or DNS poisoning. The fake Trezor site prompted users to enter their recovery seed and order number after claiming the hardware device had suffered memory damage. Trezor users who turned over this information basically handed over access to their devices by doing do, which means funds could be transferred from their wallets by the malicious actor.
Earlier this year, cryptocurrency wallet service provider MyEtherWallet was also the victim of a similar DNS spoofing attack.
Responding to the phishing incident, Trezor issued a public service announcement on its official blog, where it gave specific warnings regarding its different devices:
“Trezor One: You should never enter your recovery seed on a computer, along with the order number. The order is always given to you by your Trezor device. Never by the computer.
For enhanced security, use the Advanced recovery method→
Trezor Model T: You should never enter your recovery seed anywhere but on your Trezor device. Under no circumstances should you enter your seed on a computer.”
Some users found themselves unsure if emails from Trezor warning of the scam were legitimate, and not just another phishing attempt following the attack.
The phishing site was eventually shut down by the hosting provider.
MetaCert is committed to building tools that alert users to fraud and scams with the MetaCert Protocol. If you want to learn more about the MetaCert Protocol, ask questions and leave suggestions on both our White Paper and Technical Paper which we’ve published here on Medium and have made available for download in PDF form as well:
The MetaCert Protocol will ultimately operate on the staking of META Tokens to categorize URIs. Both a public and private sale for META Tokens will be held. The public sale for META Tokens will begin July 25, 2018 and last until August 25, 2018.
The private sale for META Tokens began on June 20, 2018 and is ongoing until July 20, 2018.
MetaCert is creating solutions for anti-phishing, child safety, brand protection, crypto-address verification, and news credibility with the MetaCert Protocol. You can find out more about the MetaCert Protocol by joining our Telegram community to stay up to date on our blockchain project. Remember to install Cryptonite, to protect yourself from phishing scams before it’s too late.
