What we need is an Internet standard that allows this level of protection to work at scale – without any discussion, without any partner agreements,” said Brett McDowell, a security manager at PayPal who serves as chairman of the group. “That is what DMARC does.”

Setting industry standards is an important step, but still more important is getting the corporate world to adopt them. There will probably be some protesting and the inevitable excuses such as “I don’t have the time to implement them/train my IT department” and the most popular excuse “cost too much in time/productivity/money”. It may take some time to get most businesses aboard, but I think once they are, it will make a dramatic difference in the amount of spam and phishing attacks sent from corporate addresses or exploting popular brands.

What do you think? Will your company adopted the new standards? If not, why?

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Banks and Top Websites Develop New Spam Fighting Techniques

Malware developers seem to appreciate a little humor when it comes to naming their schemes. One of the latest email scams to invade inboxes everywhere is no exception, it seems, and the FBI has been quick to let businesses know that if they don’t keep their eyes open for a phishing scam originating in an email from FDIC, NACHA and the Federal Reserve, opening the mail’s attachment could be one of the most devastating choices in a young 2012. Worse yet, this new scheme appears to be linked to the Lord of the Greek gods – or its eponymous malware, anyway.

‘Game over’ is never a good thing, whether it means that your last ship has been destroyed and your quarter spent, whether it’s a lame and overused witticism that yet again has found its way into the mouth of Hollywood’s action hero du jour, and yes, even when cyber criminals are searching for just the right name for their latest piece of malware. While we’re not averse to debating the first two, our interest here is firmly with the latter. It seems the U.S. Federal Bureau of Investigation shares that interest, as evidenced by a security bulletin earlier this month that identifies a new email scam, one which cyber criminals have decided to call – what else? – Gameover.

Gameover is a phishing attack that appears in the form of spam emails spoofing the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Bank, or the National Automated Clearing House Association (NACHA). Like a multitude of others, the scheme preys on users’ fears and/or lack of vigilance, informing them that there has been a problem with their bank account or an ACH transaction (ACH stands for Automated Clearing House, a network for financial institutions in the U.S.). Sufficiently frightened, recipients are encouraged to click the included link, which instead of resolving the issue, takes the user to a malicious site where the Gameover malware is executed.

The malware has been identified as a variant of ZeuS, a notorious piece of malware which has been responsible for stealing financial information through the practice of keylogging for a number of years. Once activated, the cyber crooks can steal banking information such as account numbers and passwords.

As if that wasn’t enough…

More than just a keylogger, however, ZeuS (and coincidentally, Gameover) has an added payload. According to the FBI:

“After the perpetrators access your account, they conduct what’s called a distributed denial of service, or DDoS, attack using a botnet, which involves multiple computers flooding the financial institution’s server with traffic in an effort to deny legitimate users access to the site — probably in an attempt to deflect attention from what the bad guys are doing.”

But wait – there’s more!

In what sounds like a novel involving international intrigue, FBI investigations have been able to trace the attacks as far as to jewelers, as the stolen funds are used to purchase “precious stones and expensive watches from high-end jewelry stores”. The crooks contact the jeweler, tell them what they’d like to purchase and inform them that they will wire the money the following day. The following day, a “money mule” – a person involved in the money laundering part of the crime – shows up at the jewelry store to pick up the merchandise. The jeweler confirms that the money (the stolen money from the spam scheme) is in their account and upon doing so, turns the merchandise over to the mule, who in turn delivers the merchandise to the crooks or converts it into cash that upon being transferred, is effectively laundered.

Wow – It really is the stuff of imagination, but even more interesting is that the FBI has suggested that the mules could be unsuspecting victims of those omnipresent ‘work at home’ schemes that we see everywhere. While the federal agency has confirmed that many of the mules are willing participants, it has also noted that an increasing number are likely people who have succumbed to these schemes and have been unwittingly recruited into laundering money stolen from victims of the spam scheme.

Be on the lookout for this one and advise your staff ASAP. At very most, it could be a story worthy of a novel. At very least, it could save you and your users plenty of headaches and lost funds.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

FBI Declares ‘Gameover’, Link to ZeuS

Naturally, such tools would be very useful for IT departments and system administrators to educate employees on how to spot phishing scams. Employees falling for such scams are a leading cause of corporate data breaches, and such breaches can cost a company millions.

“The whole concept with this project started out with the discussion of, ‘Hey, wouldn’t it be great if we could phish ourselves in a safe manner?’” said Will, one of the Toolkit’s co-developers. “It seems like in every organisation there is always a short list of people we know are phishable, who keep falling for the same thing every six to eight weeks, and some of this stuff is pretty lame.”

While it appears the developers had honest intentions when they created the toolkit, the fact remains it could be pretty attractive to the bad guys and they have no way of controlling that. Right now it doesn’t record any data typed into the fake phishing sites it generates, but they said future versions of the kit will have that functionality. That may make it irresistible to scammers looking for a way to create phishing campaigns that’s fast and won’t eat into any profits.

What do you think? Are these toolkits helpful or just asking for trouble?

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Go Phish Yourself?

The first one is a new incarnation of an old scam. Emails that look like they’ve come from your friends arrive with an urgent message about them being on a trip to a far flung place such as Madagascar, London, or Berlin and needing help. You see, they were mugged/assaulted and all of their money and documents were stolen, and they really need to go home but there’s the matter of their hotel bill. The messages generally ask for about $1600 to be sent via Western Union. Of course it’s just a variation of a 419 scam. If you get one, no matter how convincing it sounds, try contacting your friend first. In 99.9% of cases you’ll find they are safe and sound at home.

Next is the Better Business Bureau, who has joined the ranks of the brandjacked as new spam messages claiming to be from them are making the rounds. The messages tell the recipient that a complaint has been filed against them and urges them to click the included link to read it and respond. Anyone who does so is taken to a malicious site that attempts to infect their computer with the infamous Zeus Trojan. Zeus, distributes by a botnet with the same name, installs a keylogger and several other nasty bits on to the infected system and steals banking info and other sensitive data.

Finally, popular companies such as Facebook, American Airlines, Paypal, and several major banks are also being brandjacked by scammers. In some cases the phishing messages are receipts for fake purchases or reservations and in others, fake message or fraud notifications. In almost all cases, the attachments and links in the messages deliver malware. It looks like the spammers are hard at work building up their botnets!

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Several New Phishing Campaigns Going Strong

The year’s off to a rousing start, with all sorts of interesting security news this week: Wikipedia led a temporarily successful foray against SOPA and PIPA by joining numerous websites that went dark for a day; the founder of Megaupload had his hands slapped when law enforcement officials told him resoundingly, “no, you can’t pirate copyrighted material” – insult was heaped upon injury when dozens of expensive cars were towed away to show him they were right; and Koobface – the Facebook botnet that has been harassing Zuckerberg for years – was taken down by its own creators after the Facebook gang teamed up with The New York Times to uncover and publish the identities of the worm’s owners. To round off the week, QR codes (like the one in the image here) may just be the latest form of spam, and news out of the Twitterverse suggests that Darwin’s cardinal rule is not only true, it’s actually a dire prophecy of our impending extinction.

The year’s less than a month old and it may already be shaping up as ‘the year of anything goes’. Topping the headlines was a mass protest against seemingly inevitable anti-piracy legislation SOPA (Stop Online Piracy Act) and PIPA (Protect I.P. Act), as innumerable websites intentionally went dark on January 18. Led by students’ greatest friend and perpetual source of dubious information Wikipedia, the activist movement irritated web surfers across the globe and scored one for the little guy as the bureaucrats in Washington, DC backed off the proposed legislation and shelved the bills, albeit temporarily. It’s practically inevitable that some wily spammer will take advantage of this controversy, so keep your eyes open and watch your back.

In a related story and in the spirit of fishy timing (i.e., the same week as the aforementioned protests), Megaupload founder, Kim Dotcom, was carted off along with several other geniuses who figured they would get away with providing a conduit for copyrighted material, all the while skimming millions of dollars off the illegal activity and thumbing their noses at the FBI. German national Mr. Dotcom, lamented as his lavish New Zealand mansion was raided and dozens of vintage cars were hauled away as the spoils of war. Again, there’s more here than meets the eye, especially now that Anonymous has its back up.

In an LMAO moment, individuals responsible for Koobface – a nasty piece of malware that has been frustrating Facebook and Twitter users for years – have taken down their own command and control server after Facebook teamed up with The New York Times to uncover and embarrass five of the founders – Russian nationals living in St. Petersburg, Florida. The named individuals have scrambled to scrub their online profiles, but it’s highly doubtful that erasing their cyber identities will have much of an effect in the real world, where police carry real guns and real handcuffs.

Are QR codes the newest spam threat? Some people think so. QR – or Quick Response – codes were developed in the automotive industry and have been used for a while. Slowly entering the mainstream  over the past couple of years, they are in wide use in Japan, the UK and the US, amongst other countries. Popular because of their fast readability and relatively high storage capacity (compared to bar codes), the increased use of smartphones with cameras and QR reading apps have made the codes a prime target for manufacturers and retailers; heck, even Google’s looking at getting into the game by using QR codes as a secure login method.  The problem is that QR codes can contain virtually any information, meaning that they are already being exploited by scammers and spear phishers. Keep an eye on this one, folks – and think twice before you take a picture of that code staring you in the face.

Finally, from the Twitterverse, here’s one that, no matter how much you shake your head, won’t rid that sickening feeling that the human race is on a collision course with extinction. Perhaps a case of ‘you can’t spell Twitter without ‘twit’, this recent article shows just how careless – or ignorant, or both – web users really are. Get this: over a twenty-four hour period, more than 11,000 Twitter users shared their email addies with the rest of the world. A safe practice if we were living in Thomas More’s Utopia, but it’s not the case if you reside anywhere on Earth, which is rife with people who would just love to use that information against you. This is just a guess, but it looks like spear phishing season is open and Twitter is the local watering hole.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Week in Review: You Can’t Spell Twitter Without ‘Twit’

A new spam campaign is brand jacking popular social networking site LinkedIn to spreadlinks leading to shady domains. The emails, which look like notifications from the site telling the recipient they have a message waiting, contain links that allegedly lead to the messages. Instead they take the recipient to a pharmaceutical site offering fake prescription drugs and male enhancement products.

Spam involving these sites is nothing new. Even though the infamous Canadian Pharmacy ring was severely incapacitated when first Spamit and then Rustock went down in 2010, it hasn’t stopped spammers from trying to cash in on these fake pharmacies. While some actually sell drugs, they are almost always fakes made in India. Since these copycat drugs are made with absolutely no regulations or oversights, the FDA issued a warning to consumers to avoid ordering from these types of sites. There are also variants of these sites that are little more than fronts for phishing operations (people place their orders but never get anything and their CC info is stolen) or attempt to deliver malware.

While like most phishing emails, hovering your cursor over the URL will reveal that the link is fake, there are still people who see the LinkedIn branding and click, thinking it’s legit. What’s more unbelievable is that some of those people will actually stay on the site and buy something.  As long as these tactics work, spammers and phishers will keep using them.

Have you ever fallen for a phishing email? Even if you only clicked on the link, it counts. Share your story with us!

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Fake LinkedIn Emails Delivering Spam

Early Monday morning I received an email from Zappos, the popular online retailer.  Theemail informed me that they had been hacked and my personal info, along with that of 24 million other customers, had been compromised:

First, the bad news:

We are writing to let you know that there may have been illegal and unauthorized access to some of your customer account information on Zappos.com, including one or more of the following: your name, e-mail address, billing and shipping addresses, phone number, the last four digits of your credit card number (the standard information you find on receipts), and/or your cryptographically scrambled password (but not your actual password).

THE BETTER NEWS:

The database that stores your critical credit card and other payment data was NOT affected or accessed.

While it’s great that actual credit card numbers weren’t taken, the info that was leaves me and my fellow Zappos customers open to spammers and spear phishing attacks. It’s likely the hackers now know at least some of our buying history and can use that info to create very targeted campaigns, not to mention if they are able to decrypt the passwords they took before the account owner follows the company’s directions and changes it, theoretically they could access that account and go on a buying spree.

There are a couple of things to be learned from this and other recent breaches. Change the passwords you use regularly, and avoid using the same password and username on multiple sites. The hackers behind the Zappos breach will likely be able to find their way into other accounts because so many people use the same password over and over at different sites. If you’re a Zappo’s customer, change all your passwords and keep a close eye on your accounts, especially your financial ones.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Zappos Data Breach Could Result in New Phishing Attacks

An open redirect vulnerability has been found on both Facebook and Google. This could easily be used to redirect users to a phishing page or a malicious domain. In a phishing attack, users wouldn’t even realize they’d been redirect, they’d just think their log in didn’t work the first time. This could potentially give scammers access to thousands of Facebook and Google accounts, and since many people have Gmail accounts linked to their Google accounts, access to those as well. A spammer’s paradise. Here’s a look at how it works:

Google

The Google vulnerability is located at the follwing URL:

https://accounts.google.com/o/oauth2/auth?redirect_uri=<malicious redirect>

If I’m not mistaken, I believe that this is actually a flaw inside of the Google API for 3rd party applications, because it is contained under the oauth directory. Oauth is what is used to make a secure link to an online account via a web API without the user compromising their password to an untrusted application.

Facebook

The Facebook vulnerability is located at the following URL:

http://www.facebook.com/l.php?h=5AQH8ROsPAQEOTSTw7sgoW1LhviRUBr6iFCcj4C8YmUcC8A&u=<malicious redirect>

In order to test both of these vulnerabilities, I recommend using the Facebook phishing tutorial found at Null Byte. However, when our web page is done, the link to our URL should be appended after the equal sign where it says “malicious redirect”. After you have crafted your URL, click it and see if you go through to your phishing page. If you did, pat yourself on the back and go mess with some of your friends.

What’s truly outrageous about this is that when notified about this, both Facebook and Google ignored the issue completely. Now as far as Facebook is concerned, this doesn’t surprise me. Anyone who has ever had a problem with the site and needed to contact them knows it’s next to impossible. Unlike most sites, they have no customer service or tech support email or phone number, no online chat or webform – nothing! Instead they offer a help center which really isn’t all that helpful, and a ‘Known Issues’ page where any and all user posts are ignored. So yeah, I can see how Facebook could ignore this.  I am surprised Google is though. They’ve always seemed more user friendly to me.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Security Vulnerability Found in Facebook and Google – A Spammer’s Paradise

This week, a phishing attack landed in the inboxes of several US government agencies, spoofing the US government’s cyber security watchdog and response agency. Complete with attachments, the e-mail’s payload was a nasty little virus that has already been tracked back to Mother Russia. To make matters a little embarrassing, perhaps, it’s not enough that the agency which was spoofed in the attack has reported a disruption of its own systems, but it’s also the government body responsible for identifying and mitigating just this type of thing.

On January 11, news erupted of a rather malicious little spoof email that circulated through the mail servers of several national, state and local government agencies and even private sector employees. The scam in question was an email pretending to be the product of US-CERT, the United States Computer Emergency Readiness Team, a division of the Department of Homeland Security.

Sent with fake source addresses that included soc@us-cert.gov and the subject line Phishing incident report call number: PH000000XXXXXXX and an attachment named US-CERT Operation Center Report XXXXXXX.zip, a nasty little file which was anything but a report. In fact, after some quick investigation, the attachment – which executes a file named US-CERT Operation CENTER Reports.eml.exe – was discovered to be a variant of the infamous Zeus virus known as ‘Ice-IX’, a keylogger that steals banking and other personal information. As if that isn’t enough, the worm also bypasses firewalls and other protection schemes.

Oh, the Irony!

US-CERT responding by doing what it’s supposed to do: it posted a bulletin and notified agencies. And while not admitting that anyone at US-CERT actually opened the little bugger, an operator at the agency has stated

“difficulty receiving emails due to the phishing campaign”

according to SC Magazine. A little embarrassing, considering that this is just the type of thing US-CERT has been mandated to protect against, it’s a forgivable fumble considering that the scam artists continue to get wilier and more creative in their attacks.

In an ‘it never hurts to state the obvious’ moment, US-CERT included the following advisories in its security bulletin:

US-CERT encourages users to do the following to reduce the risks associated with this and other phishing campaigns:

• Do not open the attachments in email messages from unknown sources.
• Install anti-virus software and keep virus signatures files up-to-date.
• Refer to Recognizing and Avoiding Email Scams (pdf) documents for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for information on social engineering attacks.
• Refer to Recovering from Viruses, Worms, and Trojan Horses document for additional information on how to recover from malware.

From Russia with Malice

The story gets a little more interesting from here, when Nextgov.com reported on Wednesday that

“Researchers outside of US-CERT traced the malicious software to a botnet – a remotely-controlled network of infected computers – that is taking commands from computers located in Russia.”

It’s not clear why researchers outside of US-CERT traced the location – it would seem natural that US-CERT was capable of doing that sort of thing. Isn’t it logical to assume that’s what the “response” part of their name is for?

Regarding the attack and its location, there’s clearly no love here, only malice. So why was an e-mail from Russia so specifically targeted at and around US-CERT and US government agencies? It’s extremely unlikely that this was state sponsored – the method used and speed at which it was detected suggest something far too ham-handed to be anything that nefarious. So taking that into consideration, the incident still poses something of an oddity. If a group, say organized crime – which is alive and well in Mother Russia – was responsible for the attack, what could they possibly hope to gain by phishing government agencies in the US? And if it was some cyberdude named Boris, who figured he’d take time from his daily routine of scamming innocents to pry into US-CERT’s activities, he certainly isn’t the brightest cyberdude in cyberspace.

It’s very mysterious, this one, and it will be interesting to see what, if anything, comes from the follow-up investigations.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

US-CERT Hooked by US-CERT Phishing Attack

In Part 2 of our look at what you can expect in the coming year, faint rumblings out of Japan suggest that one prediction from Part 1 of this article has already come true. If the very real prospect of becoming an innocent casualty of war isn’t enough to make you run backward toward the year that just passed, these bold predictions reveal how hackers will develop an even stronger sense of camaraderie, and how mobility is sure to become a four-letter word. And if you thought spamming and Internet scams made it personal in 2011, you ain’t seen nuthin’ yet.

How about that? 2012 wasn’t even seven days old when news out of Japan this week revealed some eerie premonitions of the things to come and earmarks of a bold prediction made one week ago.  Engadget, ZD Net and other media outlets are reporting that the Japanese government has been working in concert with Fujitsu since 2008 to develop a powerful ‘cyber weapon’ – a piece of software that, upon the detection of a cyber attack (such as DDoS, for example) tracks the attack back to the source.

Sounds pretty straightforward, right? Sure, until you consider that the software also attacks and disables every machine it finds along the trail. The goal, Engadget reports:

“is to stop the spread of a malicious piece of code by finding and shutting down, not just the source, but all middleman PCs that are also now potential hosts. In some admittedly extreme scenarios this weapon could potentially spiral out of control, taking out far more computers than intended.”

Hmm… Botnets are nothing more than large numbers of unsuspecting computers carrying out their attacks at the behest of the infector and ignorance of the computer’s owner. Japan’s little toy, while it sounds like it might be fun to take for a spin, could have the unpleasant and unprecedented effect of being the cause of some serious collateral damage. Casualties of war? Here’s a tip for everyone: while you still have a chance, give that fave desktop or laptop of yours a great big hug before it’s too late.

1. Hackers of the World, Unite

Robin Hood met Mafia Boy last year as hacktivism took center stage. Indeed, 2011 was an entertaining year for anyone who followed the exploits of Anonymous and LulzSec. The drama unfolded like a kabuki play born in the mind of Ken Kesey and brought to life by a troupe of mimes with Tourette Syndrome, and there were even a few arrests along the way to make this reality show really…ahem… arresting.

Prediction: We will see some new hacking activity from these groups, with some high profile web takedowns in the process. While that’s not a stretch, this is: hacker groups like Anonymous and LulzSec will grow in size substantially, resembling an ‘occupy’ type movement that will take the war online. The civil and social unrest of 2011 will turn to face the financial behemoth that is the Internet.

2. Mobility Means Vulnerability

If we learned anything about spam in 2011, it’s that spam is like that proverbial bum of a brother-in-law who’s been living in your basement for the past two years. It’s not going away, good luck making it work for you, and you will be out-of-pocket at some point. Spammers continued to use every means at their disposal in 2011, with SMS spam becoming a real pain in the neck. Security flaws in the two most popular smartphone platforms – iOS and Android – just accented what we already suspected: that spammers and purveyors of malware had taken their show on the road.

Prediction: 2012 will see a massive increase in mobile spam, and mobile devices will become the swords upon which we will live or die unless we get mobile security under control.

3. It’s Nothing Personal…Well, Actually, It Is

A significant development in spam and phishing in 2011 was the way in which the scam artists were getting smarter; you know, smarter in much the same way that a chunk of igneous rock living at the bottom of a fetid riverbed is smarter than a rotting patch of lichen hanging for dear life to the side of an oak tree. Like it or not, the scambags are wilier, finding new and innovative ways to pick your pocket without actually residing in the same time zone.

Prediction: The scambags will become even cleverer in their assaults, finding new methods to lull people into a false sense of security. How this will occur remains to be seen, but our bold prediction is that it will most likely involve highly targeted, multilevel campaigns where the scammer will use detailed knowledge of the targets, and multiple contact methods like email, phone, SMS and even snail mail to enact their evil schemes.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Bold Predictions for 2012 (Part 2)

They would send their victims text messages informing them they had won a lottery or that they had been named in a will and had inherited a large sum of money:

 ”In the lottery scam, the victim receives a message stating that he has been randomly picked up in a lottery system of a multi-national corporate company, in which, he won one million pounds and then victim’s email ID is sought.

When the victim replies, he would be sent an e-mail, stating that he should appoint a UK-based lawyer to represent him to complete the process. The accused provide lawyers’ names and takes Rs 50,000 to Rs 75,000,” the IPS officer said adding that a fake Coca Cola company’s letter-head, mentioning the prize money, was recovered from them.

For tax payments in the UK, they further seek Rs 1.5 lakh. Once the payments are made, they say the cash has arrived in India and the victim should pay to RBI and Customs Department for clearance of the money. In this way, the victim shells out at least four to five lakh (rupees) over a period of time.”

The men are being held in Mumbai. The 419 scam has been around forever and while you would think most Internet users would have heard of it by now and wouldn’t be fooled, many countries in which Internet access was a luxury reserved for the very rich are now seeing it opened up to the masses as it becomes more and more affordable. This means millions of new users, and that’s what scammers are counting on and what is likely to be the reason this ring focused on users in India. It will probably be a very long time before the 419 scam wears out its welcome.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

International Phishing Ring Busted

University students in the United Kingdom and their parents should be on the lookout for emails purporting to be from the Student Loans Company. Responsible for administering the thousands of government loans for higher education taken out by UK students each year, the Student Loan Company recently sent out warnings to its customers about the phishing campaign.

Like so many other phishing attacks that claim new victims daily, this attack involves emails designed to look like they are from the Student Loan Company, but of course are not actually from this agency. At no time were the Student Loan Company’s servers or data compromised or involved, but the attackers have many ways to develop lists of students with loans being serviced by the Student Loan Company. Many students’ social media settings make their email addresses available, and discussing finances is not the taboo topic amongst today’s college students that it was to their parents’ generation.

The emails were sent to victims advising them to update their personal details on the loan servicer’s website, and included a link to a bogus site set up to look like the Student Loan Company site. Victims who clicked on the link and entered their personal details into the phishing site were providing their personal information, including user names and passwords to the attackers.

Unusual activity on student accounts may have been what enabled the company to discover that students’ accounts were compromised. The manager of Fraud Prevention and Detection, Heather Laing, was quoted as saying:

“We are currently contacting a number of students by telephone who we have identified as being at risk of having their details compromised, to advise them of the necessary security steps they should follow to ensure their details are protected”.

Without indicating how many students may have been impacted, the Student Loans Company is contacting all customers who may have been affected by this attack. They are also contacting all customers, reminding them of how to verify an email is from them, and reminding them that no email will ever be sent to them requesting account information.

This is not the first such attack to target students. Last week, the Metropolitan Police Service announced the arrest of six suspects in connection with a phishing attack targeting students back in August of this year. More than £1 million was stolen from victims’ accounts after they were fooled into entering their personal information into another bogus website. The six suspects face charges including conspiracy, money laundering, and violations of the Computer Misuse Act.

Readers should take a few moments now to share this story with their coworkers, family, and friends. Phishing attacks continue to plague users because they work – people are fooled into entering their confidential information into websites every day. Whether the attackers play upon victims’ fears, gullibility, or ignorance, they continue to attack users because they continue to succeed in exploiting their victims. By raising awareness, we can help others to not be victims themselves.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Latest Subject of Phishing Attacks: UK Student Loans Company

A new study reveals that spam email volume has plummeted to levels not seen since 2008. Spam now accounts for 70% of global email volume, down from a high of 90% and very close to the levels seen after the shady ISP McColo was shut down three years ago. The drop in the levels is attributed to the fact that spammers have moved to more targeted attacks for their spam, malware, and phishing attacks, rather than the massive blasts to random addresses they have traditionally favored. Spam filters are also becoming more and more effective and users more educated.

I think social networking has also contributed to the drop. People just don’t rely on email quite like they used to. Instead they hop on Facebook or Twitter and send a message. Spammers will always go where the biggest audiences are and that means the social networks. Not only do sites like Facebook offer enormous traffic, they also offer something else spammers covet-trust. A spam link on Facebook or Twitter is much more likely to be clicked since it will look like it was posted by a friend and people naturally trust their friends. It’s this built in trust that makes spam so rampant on these sites. It’s hard for people to break the habit of clicking on their friend’s links.

Another feature that spammers love is Facebook’s refusal to vet third party apps. Unlike Apple’s App Store, which has a strict approval process, developers must navigate in order to have their apps made available for downloading, Facebook lets anyone post any app they want. This means rogue apps aplenty. They will respond to user reports and shut down such apps, but it would be better if Facebook had a system in place to prevent them from being posted in the first place.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Spam Levels Plummet to 2008 Levels

A judge awarded Yahoo! over $600 million in damages in the conclusion of a lawsuit filed in 2008. In the suit, the company claimed the unnamed spammers infringed on their trademarks and harmed the brand by using them in a campaign of messages claiming the recipient had won a lottery sponsored by them. The lottery was fictitious and the emails where actually an attempt to cash in on the famous Nigerian or 419 scam. The recipient is told they have won millions in a foreign or online lottery. If they respond, they are told they must pay certain fees before their winnings are handed over. If they pay, they are simply told there are still more fees. This goes on until the victim gets fed up or goes broke.  These types of messages may also act as phishing bait, luring the recipient to go to a site and log in so that their personal details can be stolen. Yahoo! says the spammers sent over 11 million fake lottery emails between 2006 and 2009.

The judge awarded Yahoo! $27 million in damages for trademark infringement and $583 million in damages for CAN-SPAM violations. However, they aren’t dancing to the bank. Not surprisingly, the spammers ignored the lawsuit completely and never showed up in court. It’s believed they may be located in Thailand, Nigeria and Taiwan, making it next to impossible for Yahoo! to actually collect on their judgments.

How do you feel about companies suing spammers? Is it a waste of time and money since the chances of getting any judgments awarded are slim to none? Or do you think they server as an effective deterrent?

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Yahoo! Awarded Millions in Spam Case

Recently researchers have detected a variety of new spam campaigns coming from Cutwail. Among them are phishing attacks disguised as fake Facebook friend requests (if the user clicks on the embedded link to accept the request, they are brought to a fake Facebook login page and their details stolen), and malware laden ACH transfer cancellations and order confirmations for airline ticket reservations. These attacks are meant to alarm recipients and/or peak their curiosity and click on the provided links, which lead to malicious websites that attempt to download Trojans that add the victim’s computer to the botnet.

Currently the sites the malicious spam messages point to are hosting SpyEye, a dangerous type of malware designed to steal login credentials and other personal information such as banking info and launch transactions with that info. Bobax is a Trojan that sends information about the computers it infects to its command and control servers, scans the computer’s data for email addresses to harvest, and uses the infected system to pump out spam.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Cutwail Botnet Still Going Strong

Activity – up; average phishing uptime – down

For starters, the group has discovered that there’s been an increase in global phishing attacks, from 42,674 in the second half of 2010 to 112,472 in the first half of 2011. To anyone following the trends in phishing activity, this isn’t earth-shattering news, but interestingly enough, even though overall activity is on the rise, the average uptime of phishing attacks has dropped significantly. In the first half of 2011, the average uptime of a phishing attack was 54 hours and 37 minutes, compared to an average uptime of 73 hours in the second half of 2010.

“The “uptimes” or “live” times of phishing attacks,” the report states, “are a vital measure of how damaging phishing attacks are, and are a measure of the success of mitigation efforts. The longer a phishing attack remains active, the more money the victims and target institutions lose.”

The report notes that the first 48 hours of a phishing attack are the most critical, as they represent the most lucrative time for the scammers, so quick takedown is an essential component of anti-phishing efforts.

More than a third of attacks involved shared servers

APWG’s report cites the increased use by phishers of shared virtual servers as a primary reason for this.

“Nearly every year we see a new tactic being used by phishers that drastically affects our Statistics,” APWG says, but this year the group has seen “a dramatic rise in what is actually an old tactic, but one that has been obscure until recently.”

As stated, the hacking of servers that host a large number of domains isn’t a new tactic, but the technique employed by the hackers is interesting, to say the least. According to APWG’s findings, the phishers, upon hacking the server, are placing a single copy of their phishing content on the server and then updating the server configuration to include that content in all the domains hosted by the server – effectively, every site on the server now has an infected section that can be accessed via a specific subdirectory.

To wit, the report states, “instead of hacking sites one at a time, the phisher can infect dozens, hundreds, or even thousands of web sites at a time, depending on the server.” The numbers are a tad staggering, according to APWG, which “identified 42,448 unique attacks that utilized this tactic, each using a different domain name. This was 37% of all phishing attacks worldwide.”

Phishers, apparently, have a hankering for Chinese

Perhaps most interesting in the new report is the massive increase in targeted activity by Chinese at Chinese.

“Attacks perpetrated largely by Chinese criminals,” APWG reports, “victimize Chinese Internet users and steal their credentials for Chinese e-commerce and banking sites.”

Attacks increased by 44% over the first half of 2011 and a mind-blowing 70% of malicious domain registrations worldwide were specifically targeted at Chinese institutions in the past six months. While APWG is identifying the source of these phishing attempts as being from China and directed at China, interestingly enough the Chinese phishers are using “free and low-priced” domain providers outside of China.

For whatever reason, the Chinese phishers have chosen to bypass the hacked domain route.

“Unlike most phishers, Chinese phishers do not use many hacked domains. Instead, they continue to register domains, on which they set up their phishing pages. Of the 11,192 domains used in 1H2011, at least 10,179 of them (91%) were maliciously registered, up from 5,895 in 2H2010.”

Interesting stuff this, and well worth the read. There’s more in the report to keep your head spinning, so head on over to APWG’s site and check out the downloadable PDF.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

APWG: Massive Surge in Phishing Targets Chinese Sites

Many retailers claim that up to 80% of their online sales come from the time period between Cyber Monday and the weekend before Christmas.  But Cyber Monday isn’t only a day that store owners and holiday shoppers look forward to, online scam artists relish this day as well because they know that this is their busiest time of the year as well.

Some of the Scams

When it comes to online scams around the holiday season, spam plays an important role.

To get the attention of their victims, cyber criminals use spam. Whether they send spam messages through email, blog and forum comments, SMS text messages, micro blogging feeds or through social networks you can be assured that the amount of junk messages advertising holiday savings or a limited quantity of that hard to get toy is sure to increase.

But now that they have your attention, what will they try to get you to do? Let’s take a look at some of the scams that people run during the holiday season.

Affiliate Storefronts

Affiliate marketing is a great way for content publishers to make money from their blog or website. They advertise a company’s product or store, and then receive a small percentage of sales made from visitors they send to the e-commerce site.

Now some people set up complete storefronts that offer nothing more than affiliate links. They offer no products or customer service. All they do is forward a buyer on to the real storefront and collect a percentage.

These types of sites aren’t illegal, and are mostly harmless to the visitor, however they can be confusing to someone who thinks they are buying something from one of these sites. Especially when it comes to returns or customer service.

Phishing

What would any online scam be if phishing wasn’t involved? We all know how this works but let’s put a little holiday spin on it.

You receive an email, text message, wall post, etc. about super savings on the perfect gift for someone in your family and click on the link provided. You give your personal information and your financial information and you wait for the gift to arrive.

But it never does. Instead, your personal information and credit card information have been sold off and you spend your holidays cleaning up your credit score.

Malware Delivery

With all the packages being shipped over the holidays it is a wonder how FedEx, UPS and the Postal Service manage to keep delivery errors so low. But things do happen and ever so often an online shopper will receive an email telling them that their package was delayed and something needs to be done to fix the shipping mistake.

If it’s legitimate, that’s the end of it. But with tracking capabilities, a spammer can tell if someone clicks on a link they sent out. Now all they have to do is send those people a fake email from a shipping company telling them that they have download an attachment so they can clear up any shipping issues before it’s too late. The attachment contains malware that once installed, infects the victim’s computer.

Most of the time, we may be cognizant that this is a common scam. However add a bit of holiday stress and common sense can be hard to come by.

Don’t Fall Victim

Odds are you will be the recipient of spam this holiday season. The trick to not falling victim to the various scams is to be smart and remain vigilant. These tips can help keep you on your toes:

• Avoid clicking links. If you see an online special copy the coupon code and type the site’s address directly into your address bar.
• Check shipping problems at the source. If you receive an email regarding shipping issues, visit the shipper’s website or the store where you bought the item. Both should be able to inform you of your package’s status.
• Shop at secure sites. Seeing a lock on the page doesn’t make it secure. Make sure that the page where you enter your credit card information is https.
• Check your credit card statements regularly. Fighting fraudulent charges early will help you in the long run.
• Make sure you understand the website’s privacy policy. Know what they intend to do with your personal information once you hand it over. If the site doesn’t have a privacy policy, don’t give up the goods.
• Beware of something that is too good to be true. Remember, a deal that is too good can simply be bait to hook you

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Don’t Fall Victim to these Cyber Monday Scams

A variety of phishing attacks are pounding the net this month.

While some claim phishing may be a dying art, as long as there are people foolish enough to fall for the scams, phishers will stick around. Here’s a look at the current phishing topics making news.

Phishing Scam Hits StubHub Users:

 http://www.ticketnews.com/news/StubHub-warns-customers-about-phishing-scam101127538

Netflix Brandjacked for Phishing Campaign:

http://www.nbcdfw.com/news/tech/Phishing-Email-Tries-to-Net-Netflix-Customers-133659803.html

Spear Phishers Target Chemical and Defenese Company:                                          

http://arstechnica.com/business/news/2011/11/nitro-spear-phishers-attacked-chemical-and-defense-company-rd.ars

Paypal Labeled Major Phishing Risk:

http://www.spamfighter.com/News-17027-E-mail-Phishing-Threat-PayPal-Users-at-Risk.htm       

Holiday Shoppers Warned About Phishing Attacks:

http://www.gmanews.tv/story/238156/technology/holiday-shoppers-warned-vs-12-online-scams-of-christmas   

Let us know about stories we missed and what you’re thinking about the stories above!      

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

November Phishing Roundup

With the world about to end on Tuesday, you probably have more pressing matters on your agenda, like kissing your kids goodbye, donning your tinfoil hat, booking the first available space ark to Mars, and spending some last special moments with the one you love the most – the Internet – using that quality time to finish those Torrent downloads, grab some virtual games for the long trip, and search for a good recipe for soylent green. But just in case the Earth doesn’t get into a smackdown with an asteroid the size of an aircraft carrier and we’re not all converted into the cosmic equivalent of a badly shipped box of corn flakes, you may want to take note of the latest SSL Certificate security breach. And when you hear how long the purported malware has been infecting their servers, you may be tempted to dust off your old typewriter and dig your fax machine out of the rummage pile in the basement.

The encryption method that provides nearly every secure online transaction today is reliant upon third parties – the Certificate Authorities – to ensure that every connection is digitally signed as a reliable source; so what if those certificates are compromised? Well, for starters, we may be taking on some new computer overhead in the form of botnets or spyware. But that’s just speculation, right? CAs offer secure digital transactions and we can all sleep at night, right?

[Sigh]. The hits just keep on coming in a year that has seen massive security breaches and data breaches, the unprecedented rise of hacktivism, the hacking of SSL/TLS, deadly new botnets and smarter spammers. Amidst all these high-profile stories, it may be tempting to turn a blind eye from a number of security breaches at SSL Certificate Authorities in 2011, and in case you were wondering, there have been a few. In fact, more than a half dozen CAs have been breached this year, including four different Comodo resellers, DigiNotar, StartSSL, and the ubiquitous GlobalSign. Now, the fine people over at The Register are reporting that KPN Corporate Market, based in the Netherlands, has ceased issuing any new Secure Sockets Layer certificates after it discovered attack tools stored on its servers.

The tools in question were Distributed Denial of Service (DDoS) attack mechanisms and while that may seem like serious business to most of us, KPN wants to assure us that it probably isn’t anything to worry about.

“There is no evidence,” The Register states, “that the compromise affects KPN servers used to generate the certificates that Google, eBay, and millions of other services use to cryptographically prove their websites are authentic, rather than easily created imposters. But the possibility cannot be completely excluded” KPN officials said in a statement issued Friday (Google translation here).

Okay, it most likely isn’t anything. Well, it could be something, but how can anyone possibly know? I mean, it’s not like the malicious software has been sitting there on the certificate servers, for like, oh, I don’t know, four years or anything. Right?

KPN states that they were taking action while they continue to investigate the breach, “which may have taken place as long as four years ago.”

C’MON, MAN! Four years? Are you freaking kidding me? To put that into perspective, that’s one-fifth of the lifetime of the World Wide Web. CA’s are supposed to be the front line of defense against botnets, spyware, adware, and a host of other security risks. I don’t know if it’s even possible (I’m sure it is) to estimate just how many certificates have been assigned in four years, but when you consider the aforementioned breaches of other CAs – all this year – it makes one wonder if we’ve been treading water in the River Styx all these years. “The compromise underscores the fragility of an SSL system that’s only as trustworthy as its most insecure, or most corrupt, member,” notes The Register. Around since 1994, there is plenty of speculation today to suggest that SSL is truly broken.

The Register points out that there are more than 600 CAs trusted by today’s mainstream browsers and all that’s needed to forge a replica of a credential for [insert website here] is unauthorized access to one CA. From an anti-spam perspective, it’s bad enough that we have to worry about the websites that represent a clear and present danger. What happens when we can’t trust any sites?

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Latest SSL Certificate Breach Sparks Renewed Interest in Phone Booths, Typewriters and Fax Machines

While I personally do not understand the appeal of Facebook, I have to acknowledge that it is a major force on the Internet, and an important part of a lot of Internet-savvy folks’ lives. It’s not just for the kids; even my CEO is on Facebook, and I swear his VCR was blinking 12:00 at last year’s Christmas party! Look around your office, and then check your web proxy logs (or your DNS server’s cache if you don’t filter Internet access) and I guarantee you’ll see that Facebook is a big deal in your office too. It’s that almost universal appeal that makes it such a useful tool for attacking unwitting users.

I’m starting to see dozens of emails each day that on the surface appear to be notifications from Facebook to users informing them that they have a lost message on Facebook. The sender shows up as “Facebook.” The graphics are simple but accurate (let’s face it, Facebook isn’t exactly known for its stunning visuals,) the fonts are the same, and the text is just close enough to realistic to be believable. Here’s a snap of the most commonly encountered message.

obviously NOT a real Facebook notification

Of course, this message is a fake, and can easily be identified as such by anyone who takes more than a second to look at it. Mousing over the blue Facebook, the link to the “lost message,” the link in the FAQ, or even the unsubscribe at the bottom of the message (not shown), all reveal that this is a phishing message. All of those links go to some website in an .FR domain which is definitely NOT a Facebook site, but is designed to deliver malware to vulnerable browsers. But it’s not the vulnerable browsers that worry me nearly so much as it is the vulnerable users that will click on those links.

I can protect my users at the office by filtering out these messages, but I’m absolutely certain that they are getting through lesser filtering systems maintained (or not) by my users’ personal ISPs. Considering the almost rabid addiction many of them exhibit towards Facebook (come on, next time a coworker’s phone beeps in a meeting, get up to see whether it’s really a work-related message, or just a notification that someone posted on their wall), the likelihood that they will click on the link to see what message was lost is dangerously high.

And while you may think that their personal computer is not your problem, think again. Do you not offer webmail? Do you prohibit (and enforce) working on company files using home computers? Those users check their company webmail using that computer. They work on company documents at home when they are on a deadline, or staying home with a sick child. And any malware they get on their personal computer becomes a problem for you. Key-loggers alone should be enough to keep you up at night.

Once again, I am calling upon you to raise awareness amongst your users. Let them know these messages exist, and that they should not be fooled. Point them to this post or better yet, go over it in a company meeting. Do whatever you can to help your users identify this sort of thing and avoid becoming a victim. Trust me, you’re also helping yourself.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Phony Facebook Notifications – More Trick, Less Treat