How Unity is setting us up to be phished ... or maybe I was phished

[JohnnyA]

We would like to invite Platformer PRO 2 to participate in our upcoming Spring Sale! The sale will feature about 500 assets at 50% off, plus a “Daily Deal” each day – one asset per day at 70% off.

Start: April 14, 2020 23:00:00 Pacific time

End: April 29, 2020 23:59:59 Pacific time

Platformer PRO 2: 50% off

While marketing for the sale will start and end at the times above, assets may start being “on sale” an hour or two earlier, and may remain “on sale” for an hour or two after. During the sale, we will also be distributing targeted coupons designed to increase revenue for publishers. You may see some sales at a lower price due to coupon use, usually 5% or 10% on top of the regular sale discount.

After a sale ends, we usually have a couple dozen users who contact us about issues they faced purchasing assets during the sale. If users have a valid issue that kept them from purchasing a discounted asset during the sale, we may distribute a coupon to let them complete their intended purchase for the on-sale price. This is not common, and usually affects fewer than 30 users. You may see some additional discounted purchases after the sale ends for this reason.

Do you want to participate?

If so, please complete this form by Monday the 23rd. Enter your business email address (should be the same we used to send you this invitation), and this unique code:

Important: If you do not enter the correct code, your submission will not be valid. Be sure to copy/paste the code shown above!

If you have been invited to participate with more than one asset, you will need to fill out the form for each individual asset.

Thanks!

PS. Have you joined the affiliate program yet? Sales are an amazing time to promote your assets, and earn 5% commission on ALL revenue generated by your links! Sign up here.

PPS. Are you active on the private Publishers forum? If not, you can apply for access using this form. Submissions are checked weekly.

My Reply:

Andrew,

sending out bulk emails with links that go to sites that are not even Unity 3D is extremely poor security practice. How on earth can publishers determine that this is not a phishing attempt?

This is of particular concern given how keen most publishers are to get in a sale (urgency is one of the key factors in the success of a phishing campaign). This practice is literally setting up tens of thousands of people to be phished in the future.

Regards,
John A

[JohnnyA]

For context the email contains links to a tracking site (appspot.com) rather than to Unity itself. I didn’t post the links in case this actually is a phishing atttempt.

[Vectorbox]

The ‘appspot(dot)com’ domain has been flagged as spam on Microsoft Answers.

The registrar is MarkMonitor Inc which uses Google name servers. Probably worth submitting an abuse report… whois

[JohnnyA]

Definitely looks dodgy, although Unity sales requests are always so dodgy it is difficult to tell.

[JohnnyA]

The follow up email seems to suggest this is real:

Hi John,

Thanks for your thoughts – I do hope we can one day build this into the publisher portal. I actually hope we’ll be doing that this year.

Not sure how long you’ve been a publisher, but the methods we’re using today are the most secure we’ve done so far, as we’re only asking for two pieces of information: Your business email (which was used to send the email), and a number that is mathematically related to an asset in your portfolio, but otherwise not easily computed unless you know the algorithm we used. The goal there is simply to ensure that if the signup link did leak out (which hasn’t yet happened as far as I know, with any of our past invites), a bad actor couldn’t sign up another publisher for the sale.

The email comes from my personal email address, and from time to time people do ask if it’s legit – either directly contacting me back, or asking support@unity3d.com

Until we have it built into the site, this is likely the best method we have available.

Thanks,

Andrew

(I will double check with support@unity3d.com)

[AndrewAssetStore]

This is a legit email. Thanks all!

[angrypenguin]

@AndrewAssetStore

This is a legit email. Thanks all!

I’ve more than once now seen Unity staff make statements like this, which is also a security issue.

Now, any spammer can come and copy the email contents posted above, stick it in their spam mails, and if anyone Googles it they’ll find staff saying it’s legit.

You should really be telling people how they can check if it’s legit. For example, if it is digitally signed then what signature should they check for?.