Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[popper]

Originally Posted by Paul Delaney

Yep the link worked - done that too



EDIT: Only if using Firefox Browser

the URL works fine in advanced browser (that uses IE as its engine)...

to help them understand i entered this as the reason for listing it as a Phish.

"this Phorm run and administered US based webpage is part of the new breed of so called Intra-ISP assisted Phishing sites.
see:
http://www.cableforum.co.uk/board/12...-page-478.html
for more information."

[bluecar1]

would i be right in thinking,

as in the trials when phorm had no contract with BT, phorm still has no contract as BT etc have not commited to roll out this product and phorm are collecting PII on the www.webwise.bt.com/ website?

my understanding is that BT etc, have commited to a trial not full roll out unless the trials are deemed a sucess, so what is the legal position?

is this why the kit is not on the BT network?

[SelfProtection]

Originally Posted by bluecar1

would i be right in thinking,

as in the trials when phorm had no contract with BT, phorm still has no contract as BT etc have not commited to roll out this product and phorm are collecting PII on the www.webwise.bt.com/ website?

my understanding is that BT etc, have commited to a trial not full roll out unless the trials are deemed a sucess, so what is the legal position?

is this why the kit is not on the BT network?

Surely running any of the Trials through the BT Network & effectively performing the Trial(s) would automatically make them responsible for properly securing their Own Customers Data as the DPA currently stands!

[Rchivist]

Originally Posted by AlexanderHanff

Good job, did you read the paragraph I added to the end of my previous post. I added it after you quoted it so I just want to make sure you have seen it.

Actually, saying that, even if personal data given to third parties was protected under the constitution, I can't see even that would help a non US citizen, since the constitution would not apply afaik.

Alexander Hanff

I think I'll steer clear of the US Constitution if you don't mind and just stick to good old Magna Carta ;-)

---------- Post added at 21:44 ---------- Previous post was at 21:23 ----------

Originally Posted by SelfProtection

Surely running any of the Trials through the BT Network & effectively performing the Trial(s) would automatically make them responsible for properly securing their Own Customers Data as the DPA currently stands!

That page purports to be a BT page. It bears the BT logo. It uses the BT page design and layout. It has identical links in the footer. It is the site that BT are sending customers to when they want information about webwise.

And of course it is identical to the BT hosted mirror BT Webwise site they put up when I asked them to at
http://www.productsandservices.bt.co...=CON-WEBWISE-I

A good question from a non BT enquirer could be to innocently ask what is the difference between
www.webwise.bt.com
and
http://www.productsandservices.bt.co...=CON-WEBWISE-I

and why the Contact page on the BT mirror leads to a different destination to the Contact Page on the www.webwise.bt.com site even though they are otherwise identical

Contact Us link on webwise.bt.com - goes to webwise.bt.com/contactus.php which is a data collection form with only one option

Contact Us link on BT Webwise mirror site - goes to
http://www.productsandservices.bt.com/contactus
which is a quite different page offering a variety of normal BT departments for contact.

The data collection page asks for personal BT account inormation as well as other personally identifiable information and likewise does not make it clear that it is not a BT page. The mysterious message suggesting that you contact your ISP "direct" cos it's quicker is unexplained and doesn't make any sense to the innocent and ininphormed.

Nowhere is it made clear that it is anything other than a bona fide BT page.

I wonder whether the anti-phishing feature of BT Webwise will identify webwise.bt.com as a phishing site?


I think this one could be VERY interesting!!!
(Fondly imagines a few more BT execs hitting forehead and going Doh!)

---------- Post added at 21:55 ---------- Previous post was at 21:44 ----------

Sent to Emma Sanderson

Greetings.
Just to let you know that there a number of reports now on the web of a new phishing site.

This site purports to be that of a major ISP, and includes a contactus.php page which collects personal data, including the account number for the customer's phone bill.

The site uses the ISP parent company logo and is identical to the layout of normal ISP pages.

The contact page for the phishing site does not produce the same result as the contact page for the genuine page hosted by the ISP itself.

Investigation using WHOIS sites, and reverse lookups, has revealed that the pages and the domain that they are on, are in fact registered not to that ISP, and not hosted by that ISP. These pages are some of them hosted by FASTHIOSTS in Gloucester, some by Gryon, and some over in the USA by THEPLANET.COM

This phishing site is therefore collecting personal data from a UK ISP customer base, including customers phone account reference numbers, and sending it outside the EU.

Please add this site to the list of sites that your new Webwise antiphishing facility will warn us about.

You may already be aware of this site, which is starting to turn up on phishing alert lists all over the internet. Many people are reporting it, via google, firefox, IE7 and other antiphishing lists.
It is of course http://webwise.bt.com as well as www.webwise.bt.com

I am sending in a full report to the ICO about this site and obviously hope they take action immediately and appoint a case officer.

Can you get this site shut down?

Unless I hear to the contrary any reply to this email may be published on the internet.

[popper]

i added that direct contact us page too, as it seems several people are still marking the main page as not a phish, they obviously dont understand as yet.

http://www.phishtank.com/phish_detai...hish_id=450882

iv also clicked and submitted a "something wrong with this submission" to alert the admins as to why exactly it is a phish and pointed them here to learn more....

hopefully that and the obvious personal information shown on that contactus page will make it clear they are trying to collect personal data and it might not get all the "not a phish" confirmations of the other two so far.

[mark777]

I think we need to be a bit careful over the phishing issue. Many sites link to e-payment sites that are 3rd party hosted but designed to look like the host site. These collect information that Phorm would love.

Perhaps where BT decide to point their domains is up to them? There may be an issue about the data going abroad, but i'm not so sure that the 'impersonation' is an issue.

Wish it was.

[popper]

the difference of OC that you know full well your being directed to these 3rd party site, wereas the Phorm owned Phishing site above is not owned by BT, run by BT, but may be allowed by BT without the consent of the users.

and its NOT made clear in any shape or form you are entering a non BT internal site were you are encouraged to enter personal and private BT data that will be collected inside a US based database for unknown purposes.

that is clear phishing in most peoples book is it not!

as for 'impersonation' ,well weather its BT aproved or not, doesnt take away the fact it is still 'impersonation'....
as in
Impersonator

http://www.reference.com/search?q=impersonation
"

An impersonator is someone who imitates or copies the behavior or actions of another. There are many reasons for someone to be an Impersonator, the most common could be:

• Legally: An entertainer impersonates a celebrity, generally for entertainment, and makes fun of their recent scandals or known behavior patterns. Entertainers who impersonate multiple celebrities as part of their act are typically called impressionists.
• 
  
• Illegally: As part of a criminal act such as identity theft. This is usually where the criminal is trying to assume the identity of another in order to commit fraud such as accessing confidential information or to gain property not belonging to them. Also known as social engineering.
• Political decoy, used as a form of protection for political and military figures. This involves an impersonator who is employed (or forced) to perform during public appearances, to mislead observers.

See also

• Wannabe
• Impostor
• "

[bluecar1]

interesting point in the BT privacy statement

*******
Are third party sites covered by this policy?

Third party Internet sites that you can link to from BT´s websites are not covered by our privacy policy, so we urge you to be careful when you enter any personal information online. BT accepts no responsibility or liability for these sites.
Other companies which advertise or offer their products or services on our website may also allocate cookies to your PC. The types of cookies they use and how they use the information generated by them will be governed by their own privacy policies and not ours.
********

wonder if that includes the webwise site not in the BT network?

that covers links but not when redirected by BT to a third party site (eg. phorm run sites)

[popper]

Originally Posted by bluecar1

interesting point in the BT privacy statement

*******
Are third party sites covered by this policy?

Third party Internet sites that you can link to from BT´s websites are not covered by our privacy policy, so we urge you to be careful when you enter any personal information online.

BT accepts no responsibility or liability for these sites.
Other companies which advertise or offer their products or services on our website may also allocate cookies to your PC.

The types of cookies they use and how they use the information generated by them will be governed by their own privacy policies and not ours.
********

wonder if that includes the webwise site not in the BT network?

LOL, and its a full circle...

that Phorm BT impersonator site links to the same PS and in there
http://www.webwise.bt.com/webwise/contact.php
http://www2.bt.com/btPortal/applicat...a&type=privacy





"...We do not use this information to:

• identify individuals visiting our website; or
• analyse your visits to any other websites (except that we do track you if you go to websites carrying our banner, but we do not identify personal details while we do this); or
• track any Internet searches which you may make while on our website.

Return to top
What personal information do we collect about you from other companies and organisations?

• We may receive personal information about you from other companies and organisations (for example, for marketing purposes) and we rely on these third parties to obtain your consent for us to use this information.

...
"

[bluecar1]

Originally Posted by mark777

I think we need to be a bit careful over the phishing issue. Many sites link to e-payment sites that are 3rd party hosted but designed to look like the host site. These collect information that Phorm would love.

Perhaps where BT decide to point their domains is up to them? There may be an issue about the data going abroad, but i'm not so sure that the 'impersonation' is an issue.

Wish it was.

yes but when you go to buy something online you will normally see a message about being transferred to the epayment site, they are not normally promoted as being part of the vendors site,

but i do concur we need to be a little careful and smart about the phishing aspect, we need to see what happens tomorrow when the trial goes live and what feedback we get as regards to the exact url the invitation sends you to to opt-in, as it would not suprise me to find phorm playing games with dns

[popper]

its mad, there appear to be still people not understanding it is a phish
as the % keep going up and down....
http://www.phishtank.com/phish_detai...hish_id=450834

to try and make it even clearer to those people i also added
the contactus link off that main page that should (but who knows what these 'not a phish' people are thinking?) make it easyer.

http://www.phishtank.com/phish_detai...hish_id=450882

this too needs more confirmed clicks if you can find the time..

hopefully the screen grab and tech details to the US site when it gets updated by the system will make it cristal clear to them it IS a Phish.

[bluecar1]

interesting approach / idea over on the consumer action group forums

http://www.consumeractiongroup.co.uk...887-phorm.html

see post by david m
*********
If you are a customer of BT Retail (or of any other BT divisions e.g. BT Business) , Virgin Media or Carphone Warehouse Talk Talk, or any other company that thinks to profile your data for advertising , then you might like to write to them quoting the very clear The Data Protection Act 1998 section 11:

11 Right to prevent processing for purposes of direct marketing
(1) An individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing for the purposes of direct marketing personal data in respect of which he is the data subject.
(2) If the court is satisfied, on the application of any person who has given a notice under subsection (1), that the data controller has failed to comply with the notice, the court may order him to take such steps for complying with the notice as the court thinks fit.
(3) In this section "direct marketing" means the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals.
************

[popper]

Originally Posted by bluecar1

yes but when you go to buy something online you will normally see a message about being transferred to the epayment site, they are not normally promoted as being part of the vendors site,

but i do concur we need to be a little careful and smart about the phishing aspect, we need to see what happens tomorrow when the trial goes live and what feedback we get as regards to the exact url the invitation sends you to to opt-in, as it would not suprise me to find phorm playing games with dns

assuming it does OC

did the techy Bt users run a baseline wireshark capture so as to compare later during the tial offer etc

#7122

remember we are using this for the good, not the bad (never use it for the bad), with that in mind there are several tubes you can use to learn the basics.

http://search.virginmedia.com/result...shark+howto&cr

http://www.youtube.com/watch?v=7ezGT...eature=related

im not good with the wireshark diagnostics
but its clear that Phorm or BT will not be able to pass or hide anything by/from the tech users that know how to use and extract the Phorm information we are after getting from the captures.

i cant think of a good way to have wireshark auto triger a capture if they suddenly offer you the Phorm invite page, so we might need to work out how best to capture that section, any wireshark admins here have any idea's how best to do the above?.

---------- Post added at 01:07 ---------- Previous post was at 00:03 ----------

OT ,
BTW Phoenix has landed
http://playlist.yahoo.com/makeplayli...segment=149773

http://www.nasa.gov/mission_pages/phoenix/main/

[Digbert]

Could this new Consumer Law be used to report Webwise to Trading Standards?

http://news.bbc.co.uk/1/hi/business/7416809.stm

The caption to the photo should read "The internet has been used by scam artists to con people out of their data"

[tdadyslexia]

Originally Posted by popper

its mad, there appear to be still people not understanding it is a phish
as the % keep going up and down....
http://www.phishtank.com/phish_detai...hish_id=450834

to try and make it even clearer to those people i also added
the contactus link off that main page that should (but who knows what these 'not a phish' people are thinking?) make it easyer.

http://www.phishtank.com/phish_detai...hish_id=450882

this too needs more confirmed clicks if you can find the time..

hopefully the screen grab and tech details to the US site when it gets updated by the system will make it cristal clear to them it IS a Phish.

I have confirmed that they ar a phish.