Eth-phishing-detect: rd.com

[jakesyl]

https://www.rd.com/culture/dollar-bill-symbols/ doesn't appear malicious. It's readers digest.

[409H]

ReadersDigest was compromised and malicious files are loaded on that domain for MetaMask users designed to steal their private keys (commit: https://github.com/MetaMask/eth-phishing-detect/commit/86f14d57817c7512d521b29c8c63d25b5216f841)

Please read: https://medium.com/metamask/new-phishing-strategy-becoming-common-1b1123837168

Awaiting confirmation from rd.

[danfinlay]

Indeed, Reader's Digest was hacked and never responded to our attempts to contact them. We _could_ take down the block, and assume they are no longer compromised, but users also could then be phished on their site again.

More info here:
https://medium.com/metamask/new-phishing-strategy-becoming-common-1b1123837168

I did a small experiment to check, and the phishing effort is not currently active there. We could probably take it down. Sure would be nice to hear back from them, though...

[billgates10]

interesting

[olenasokolov89]

Hi Dan,,
Unfortunately, we did not receive any e-mails regarding this issue (or maybe it wasn't forwarded to the appropriate department).
As far as I understood, currently we don't have any fishing efforts on our website, We also ran the check, and I don't see any fishing attemps: https://app.webinspector.com/public/reports/92000262
Please let us know if we need to do any additional steps to have the block removed.

Regards,
Olena Sokolova
DevOps Manager in Trusted Media Brands.

[409H]

Hi @olenasokolov89 - have you raised the issue with your security department to audit for any vulnerbilities in your stack since there was a phishing attempt on your domain targetting MetaMask users - read: https://medium.com/metamask/new-phishing-strategy-becoming-common-1b1123837168

If so, can you sign a message from a RD PGP key or email from an RD account to verify

[olenasokolov89]

We did have vulnerabilities in the end of June, and it was addressed by the mid July.

Rd.com is a part of Trusted Media Brands group, and trustedmediabrands,com is our corporate address. https://www.trustedmediabrands.com/brands
You may also check it in the footer of rd.com (see Trusted Media Brands copyright).
If needed, we can create an rd.com e-mail and send confirmation on the required address.

[409H]

If needed, we can create an rd.com e-mail and send confirmation on the required address.

Please if you can. Email [email protected] and [email protected] and reference this issue number.

Is there a public post-mortem of your vulnerabilities?

[olenasokolov89]

I have sent request to get an e-mail with rd.com extension, will submit a request soon.

---

Not sure about post-mortem. Google blocked some of our websites in June (we had our server hacked). rd.com was NOT blocked, but we used iframe there from the blocked website (contest website).
We re-built that server, and submitted request to google that we are all good.

Can you please specify if there are nay other evidence we can provide?

[409H]

Ah okay - that's ok, I'll wait for the email to come in then I'll remove from the blacklist - thank you!

[olenasokolov89]

Have submitted requested from the corporate e-mail.
thank you

[409H]

Thanks - please give ~10minutes for caches to update

[olenasokolov89]

Thank you for your help!