Phishing Email - Subject: RE: [ Reminder ][ Sign-in New Device ] The following changes to your Account, Update Activity Account Submitted Changed to Your Billing

For the record, this is an Apple phishing email attempt that is recently going around and made it through spam filters. What to do?  Report them, goto bottom of page.

From : "support@apple.com"   Subject :Subject: RE: [ Reminder ][ Sign-in New Device ] The following changes to your Account, Update Activity Account Submitted Changed to Your Billing ATTACHED E-Statement_AccountID.pdf CONTENTS - ALWAYS PREVIEW ONLINE Policy Violation Immediate action required  : Your Apple ID needs additional verification

Here's  a preview.

SPAM/ PHISHING LINKs;  

1. https://qoo10.sg/....

How to tell this is a Phishing email ?

1. Check email address in full, if it's not from originating company then it's phishing.
2. Hover over all links in email, if it's not from the apple.com site then forget it.
   
   
3. The best way is to look at message source, see below.

How to examine Email Message Source ?

Now lets look at message source

1. Outlook.com->Actions->View Message Source. 
2. Gmail.com->More (down arrow to top right)->Show original.

Check for suspicious links, anything that does not originate from apple.com.

Report Phishing Email (not as Spam)

1. Outlook.com->Junk (at Top)->Phishing Scam
2. Gmail.com->More (downarrow to top right)->Report Phishing 

Report Phishing URLs at Google now 

If you have recievied this email take further action now by click these links

1. https://www.google.com/safebrowsing/report_phish/

Report phishing at Microsoft and government agencies

1. http://www.microsoft.com/security/online-privacy/phishing-faq.aspx

Report phishing emails to Apple 

Forward the email to abuse@icloud.com. This provides Apple's legal department and law enforcement with useful information to help prevent future phishing emails.

Microsoft Edge Chromium browser still talks to Google

According to the public deck "What Microsoft Edge has contributed/altered in Chromium" ( https://t.co/YVMLFXoluj ), there is still a reporting component that talks to Google mother ship? 

A challenge : Does any know what is contained information still goes to Google ? 

To enable logging, launch Chrome with these command line flags:

--enable-logging=stderr --v=1  # Linux (newer instructions for Linux: here)

--enable-logging --v=1  # Windows

https://www.chromium.org/for-testers/enable-logging



To enable capture Network Log, goto address chrome://net-export/

Click the button to start logging future network activity to a file on disk

Choosing Include raw bytes (will include cookies and credentials). In Chromium, this includes encrypted bytes and personal information.

To view the log contents, goto here https://chromium.googlesource.com/catapult/+/master/netlog_viewer/

and you can upload your capture log to https://netlog-viewer.appspot.com/ to interrogate. 

Can a UNC Network Share be Unicode

Well, the answer is partially, but the formal documents say otherwise and are incorrect.

Given a UNC Path is represented as

"\\" host-name "\" share-name  [ "\" object-name ]

host-name must be a NetBIOS computer name according to

https://support.microsoft.com/en-us/help/909264/naming-conventions-in-active-directory-for-computers-domains-sites-and


however, the share-name can be Unicode. 

And lastly, the object-name can be Unicode and is widely understood.

object-name = *path-name [ "\" file-name ]

Example : \\centos7\Ȧunicode\build

Here's the UNC Path Specification from Microsoft
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc


The filespace selector is a null-terminated Unicode character string in the following ABNF syntax:

•  UNC                = "\\" host-name "\" share-name  [ "\" object-name ]
•  host-name          = "[" IPv6address "]" / IPv4address / reg-name  
•     ; IPv6address, IPv4address, and reg-name as specified in [RFC3986] 
•  share-name         = 1*80pchar
•  pchar              = %x20-21 / %x23-29 / %x2D-2E / %x30-39 / %x40-5A / %x5E-7B / %x7D-FF  
•  object-name        = *path-name [ "\" file-name ]
•  path-name          = 1*255pchar
•  file-name          = 1*255fchar [ ":" stream-name [ ":" stream-type ] ]
•  fchar              = %x20-21 / %x23-29 / %x2B-2E / %x30-39 / %x3B / %x3D / %x40-5B / %x5D-7B / %x7D-FF 
•  stream-name        = *schar
•  schar              = %x01-2E / %x30-39 / %x3B-5B /%x5D-FF
•  stream-type        = 1*schar

where Augmented Backus–Naur Form (ABNF) is a metalanguage based on Backus–Naur form (BNF), but consisting of its own syntax and derivation rules.

But 

•  share-name         = 1*80pchar

pchar is defined as a pointer to a CHAR, which is ANSI

https://docs.microsoft.com/en-us/windows/desktop/winprog/windows-data-types

But share-name can be UNICODE therefore; 

•  share-name         = 1*80pcwstr 

pcwstr (A pointer to a constant null-terminated string of 16-bit Unicode characters)

How to set a Unicode Net Share?

Remember in CMD Window set code page first to 

chcp 65001

which will change the code page to UTF-8. Also, you need to use Lucida console fonts in CMD Window.