Gary Thornock's Weblog

Jordan Gunderson posted a couple of days ago about a couple of phishing scams that specifically target members of Mountain America Credit Union, a relatively small¹ credit union here in Utah. One of the scams was also mentioned in this article at the Washington Post site.

I'm a long-time member of Mountain America, and I have to agree with Jordan: it's a bit alarming that I haven't seen an official warning from MACU. The fact that the bad guys managed to get an SSL certificate signed by Equifax is much more alarming, though. The whole point of getting a paid certificate from a major CA (as opposed to using your own self-signed cert) is that the CA is supposed to be trusted to do its homework and verify that the certificate request is legitimate.

¹ "Relatively small" in the national sense, of course: MACU is one of the largest credit unions in Utah.