Optus Ad

In recent days I have received two emails for my Australian Telco, Optus, that are offering information and services related to their upcoming release of the Apple iPhone 4.

Now I am not complaining that Optus is contacting me. The services they are offering are things I want to hear about and sign up to. What I am complaining about is the way they have chosen to go about contacting their customers.

Here are some specifics related to these emails:

• Both emails where from iPhone4@optus.com (where is the .AU)
• Both emails contained links to URL's that where not specific to Optus's main website
• When each link was followed, they lead to a page where a SSL certificate warning was displayed
• When the user had finally got through the warning and to the registration page, they where asked to enter personal details such as Name, Surname and Phone Number

The first email was for the Optus's 2-in1 SIM Card Upgard Offer (now expired). It's embedded link was for http://app.en25.com/e/er.apsx? (followed by a long string of parameter data). If this link was followed, a browser window opened and then redirected to http://optus2-in-1order.com.

Before opening this new page, the browser displayed the following SSL Certificate warning (as seen in Chrome):

Optus 2-in1 Upgrade Site Certificate Warning

This is the type of warning a user would see when a site is using an invalid or forged SSL certificate. The reason this warning was being displayed is because the certificate was issued for use with *.securesite.net not optus2in1offer.com:

This is Not the SSL Certificate you are Looking For!

If the user proceeds though this warning, they will see a page requesting they enter some personal details to be able to register for the offer. Does any of this ring alarm bells for you?

The second email was much the same, except that the embedded link in the email was now explicitly pointing to https://optusiphone4.com/content/launch (followed by some long parameter data), instead of the more obscure http://app.en25.com as was used in the first email (still the link is not related to Optus's main site http://optus.com.au, which would have been a more secure address for both these emails).

If the link was followed, the browser then showed a certificate error again (though this error now relates to missing owner information, rather than what appeared to be a forged SSL certificate for a different URL, as was displayed with the first email). This is the warnign (as shown in Chrome):

Optus http://optusiphone4.com Site Certificate Warning

The reason for this warning is less obvious - and may have now been resolved as I get the following when I click on the on the the Orange Triangle with Exclamation Mark in Chrome's Address Bar:

Now you See It now you Don't (Is the Cert Fixed Now?)

By now you might be asking: "What's the big deal? If it's all owned by Optus and ends up being safe, why all this fuss?"

Well, other than confusing and scaring the average customer, and otherwise looking very unprofessional, here are my concerns:

• This approach conditions Optus customers to become easy marks for phishing scams, by conditioning them that emails from Optus will contain links to 'foreign' URL's outside of Optus's official web site
• That it is usual for Optus's external websites to contain incorrect SSL certificates that the customer has to allow (ignore) to get to the main offer page
• That Optus's approach in these emails makes the phishing scammer's job much easier, as all they have to do is copy one or more of these emails, change the embedded links to point to a site of their own, and send them out to potential Optus customers
• That the scammer can also use any SSL certificate the like (even ones they have create themselves) so they can use Secure HTTP (HTTPS) to make their fake site look more 'official'

Once a scammer has got an Optus customer to their own site, they could then 'phish' the customer for any details they might be interested in and expect that a reasonable percentage of Optus's customers would fall for the scam.

I hope Optus has leaned from their mistakes in this campaign (that this is not the way to go about making these types of offers to customers). But given that marketing is more interested in selling, than in customer security, I expect that it would be a good thing if each of you reading this post, was to consider contacting Optus personally. If you did this, it would help to reinforce to Optus that these practices are not acceptable to their customers and that they must reconsider how they will undertake future campaigns like these, both for their customers' security and for their own professional standing in the tech community.

Optus can be contacted via this link on their website: Contact Optus.

I hope that other companies, considering such marketing campaigns, take note of these mistakes and put their customers' security above the of priority of making sales.

Safe Surfing!