Spam on Omid Farhang

Security researchers take out botnet responsible for 18 billion spam emails a day

Thu, 19 Jul 2012 23:00:00 +0000

Independent: If you’re a fan of fake Rolex watches and cheap Viagra look away now.

A huge spam botnet responsible for an estimated 18 billion messages a day has been taken out by security researchers.

The four year old botnet – known as Grum – is believed to have been responsible for around 18% of the world’s spam emails.

A botnet is a cluster of infected computers used by cybercriminals to send a variety of spam emails – often offering cheap Viagra, fake watches or unusual dating solutions.

Fake Facebook Photo Notifications Contain Malware

Thu, 19 Jul 2012 09:25:00 +0000

Mashable: Sophos’s NakedSecurity blog outlined the threat on Wednesday. The company’s SophosLabs intercepted a “spammed-out email campaign” which was designed to spread malware. Sophos provided the following example:

The blog notes that the email address above misspells “Facebook” as “Faceboook.” The link takes the user to a malicious iFrame script, which exposes the user’s computer to malware. However, within four seconds, the user’s browser is directed to a presumably innocent Facebook page like the one below to act as a smokescreen.

Spam attack on Dropbox users

Thu, 19 Jul 2012 07:29:00 +0000

H-Online: Spammers are currently sending large volumes of spam to users of cloud storage service provider Dropbox. The H’s associates at heise Security have so far received four different pieces of German-language spam at an email address used solely to register with Dropbox, and some of their readers have reported the same problem; similar reports can also be found on the Dropbox forums. In almost all cases, the spam is for suspicious-looking online casinos.

‘Botnet' sends out spam as malware spreads on Android phones: researcher

Sun, 15 Jul 2012 18:04:00 +0000

Malware has been spreading on Android mobile phones that takes control of certain email accounts to create a “botnet” to send out spam, a security researcher says.

Microsoft security engineer Terry Zink says the malware has infected phones of users’ Yahoo email accounts to send out spam messages.

“We’ve all heard the rumors, but this is the first time I have seen it – a spammer has control of a botnet that lives on Android devices,” Zink said in a blog post on Tuesday.

Automated Skype calls and Fake Antiviruses

Sun, 03 Jun 2012 15:47:00 +0000

This is an old story back from September, 2011, but since recently I’ve seen users complaining about this, I want to share it again [Credit to NakedSecurity, SophoLabs]:

You may have received an automated call from a user who claim to be from Skype or somewhere which says:

Attention: this is an automated computer system alert. Your computer protection service is not active. To activate computer protection, and repair your computer, go to [LINK]

Hackers use fake Facebook cancellation emails to deploy malware

Wed, 23 May 2012 12:34:00 +0000

H-Online: A new type of phishing strategy, which aims to trick unsuspecting users into installing a trojan by pretending to be an account cancellation request from Facebook, has been discovered by Sophos. The email messages link to a third party application on the site that will install a Java applet and then prompt the user to update their Flash player, but will actually deliver the trojan malware.

The email messages that are sent out claim to be from Facebook and state: “We are sending you this email to inform you that we have received an account cancellation request from you.” However, Facebook never sends such account cancellation confirmation messages via email. Users who want to cancel their Facebook account can do so by visiting facebook.com/deactivate.php to deactivate their account; they may later delete it after a cool down period has passed.

Phishers Offer Fake Storage Upgrades

Thu, 03 May 2012 11:20:00 +0000

Symantec Connect: Customers of popular email service providers have been a common target for phishers for identity theft purposes. Phishers are constantly devising new phishing bait strategies in the hope of stealing user email addresses and passwords. In April 2012, Symantec observed phishing pages that mimicked popular email services in an attempt to dupe users with attractive storage plans.

Customers were flooded with fake offers of free additional storage space for services such as email, online photo albums, and documents. In the first example, the phishing site was titled “Welcome to New [BRAND NAME] Quota Verification Page”. According to the bogus offer, the additional storage plan ranged from 20 GB to 1 TB per year, at no extra cost. The phishing page boasted that the free additional storage plan will help customers prevent loss of data and the inability to send and receive emails due to exhausted storage space. It also stated that the plan will auto-renew each year and the customer can choose to cancel at any time by returning to the same page:

WikiPharmacy? Fake Notifications Spammed Out

Thu, 26 Apr 2012 15:03:00 +0000

Symantec Connect: Symantec is intercepting a resurgence of spam attacks on popular brands. Spam messages that are replicas of the Wikipedia email address confirmation alert are the new vector for the present. The said spam messages pretend to be originating from Wikipedia, and are selling meds, with the following subject line: “Subject: Wikipedia e-mail address confirmation”.

The spoofed Wikipedia page is a ploy to give legitimacy to the sale of meds online. The embedded URL in the message navigates to a fake online pharmacy site that is dressed up as a Wikipedia Web page. Furthermore, to give the email a legitimate look, the spammer has added the recipient’s IP address in the body of the spam mail. Needless to say this IP does not belong to the user.

IMG0893.zip – Your photo all over Facebook? Naked? Malware campaign spammed out

Mon, 23 Apr 2012 19:02:00 +0000

SophosLabs is intercepting a spammed-out malware campaign, pretending to be an email about a revealing photo posted online of the recipient.

The emails, which have a variety of subject lines and message bodies, arrive with an attached ZIP file (IMG0893.zip) which contains a Trojan horse.

Subject lines used in the spammed-out malware campaign include:

RE:Check the attachment you have to react somehow to this picture
FW:Check the attachment you have to react somehow to this picture
RE:You HAVE to check this photo in attachment man
RE:They killed your privacy man your photo is all over facebook! NAKED!
RE:Why did you put this photo online?

Free Stuff on Social Networks Not Free

Thu, 29 Mar 2012 15:22:00 +0000

Symantec Connect: In recent years, scammers have flocked towards social networking sites as they have grown and made it easier to access a large number of potential eyeballs to convert into dollars. Brands have found value in leveraging social media to know what their customers are talking about, so, naturally, scammers are doing the exact same thing.

Free iPads and iPhones

Every time Apple unveils a new iPad or iPhone, you can bet there are scammers out there trying to leverage the announcement for financial gain. In the days leading up to and after the announcement of the new third-generation iPad, Twitter users who tweet about the new tablet most likely will receive some targeted Twitter replies from scammers offering the new device for free:

New Dr Who girl Jenna-Louise Coleman's name exploited by Twitter sex video scammers

Thu, 22 Mar 2012 12:41:00 +0000

SophosLabs: Jenna-Louise Coleman has been unveiled as the new “Doctor Who” companion, joining the BBC TV time traveller in his TARDIS later this year.

“Doctor Who” is one of Britain’s biggest television shows, and is popular elsewhere around the world, so it was no surprise to find 25-year-old actress Jenna Louise-Coleman’s name was a trending topic on Twitter today.

Unfortunately, there are frequently mischief-makers, scammers and cybercriminals waiting to exploit a popular search term or hashtag.

Apple's new iPad is great, but it's not free, nor called iPad 3

Mon, 19 Mar 2012 08:37:00 +0000

SophosLabs: Only hours after the launch of Apple’s newest iPad we are beginning to see spammers trying to use the excitement over its release to ensnare innocent people into their scams.

The scammers are sending out emails with the subject “Where do we send your Free iPad 3, just Test & Keep! See details”. The email contains an image with the text “TEST & KEEP an iPad 3 FREE – Click here”.

This time, the bad guys want your tax accountant

Fri, 09 Mar 2012 21:21:00 +0000

avast: While taxpayers are the regular target of springtime malware schemes, this year the bad guys are aiming for the accountants.

A series of imposter emails are threatening recipients with the removal of their professional accreditation if they fail to respond promptly. The tax-phish appear to be from organizations such as the American Institute of Certified Public Accountants(AICPA), Better Business Bureau(BBB), and Intuit tax services.

After clicking on the email, users are redirected through a hacked legitimate site to the final malware distribution center where their computer can download fake antivirus or another malware package selected by the bad guys.

Dropbox Abused by Spammers

Thu, 08 Mar 2012 11:55:00 +0000

Symantec Connect: Recently we noticed spammers abusing Dropbox, a popular cloud-based, file-hosting and synchronization tool, to spread spam.

Dropbox accounts have a public folder where files can be placed and made publicly available. This function is useful to spammers, as it effectively turns Dropbox into a free hosting site. Spammers have abused URL shortening and free hosting sites for some time. Dropbox also provides a URL shortening service, which spammers have also abused.

Google opens a pharmacy? It's spam of the day

Thu, 08 Mar 2012 11:46:00 +0000

SophosLabs: Is Google really extending its online empire, and opening an online pharmacy?

Of course not. So don’t believe spammed-out emails like the following:

Do you notice how the spammers have changed the “o”s in Google to Cialis and Viagra tablets? Very creative.

Part of the spam message reads as follows:

We've just launched a pharmaceutical interfaces for Google, as well as several new features that will improve the Google experience for the people buying pills and using pharmaceutical interfaces.

Free iPad 3? It doesn't exist! Beware of scams

Thu, 01 Mar 2012 07:41:00 +0000

It is widely anticipated that Apple will announce a new version of its iPad tablet computer in San Francisco on March 7th.

An invitation sent to journalists, inviting them to an event organized by Apple, has fueled speculation even further as it appears to show a close-up of someone using an iPad.

Could it be the new iPad with a much lusted for improved display and souped-up processor? Only time will tell..

Oops! Selena and Bieber's hidden camera bedroom video Facebook scam

Tue, 28 Feb 2012 21:00:00 +0000

Oops indeed. At least if you were one of the Facebook users who believed that a hidden camera video had leaked onto the net of Justin Bieber sharing some intimate moments with his girlfriend Selena Gomez.

Of course, Bieber’s typical fans – or those who would delight in his public humiliation by a hungry paparazzi – are probably unlikely to think twice about clicking on a link shared with them by their Facebook friends, claiming to leak to a sex video.

Beatles for Sale? It's spam of the day

Mon, 27 Feb 2012 14:54:00 +0000

I’ve owned up to some of the great loves of my life in the past.

For instance, I’m a music lover and I’m very partial to board games (even during a denial-of-service attack).

Today I can also share that I like The Beatles. In particular, anything from “Rubber Soul” and later when the “Yeah yeah yeah” turned into something rather more “Yeah man. Dig it”.

I’ve simply never come across a more talented combination of musicianship and songwriting abilities – for me, you can kick The Stones, The Who, Cream and.. yes.. even MeatLoaf to the kerb, as Lennon, McCartney, Harrison and Starr are the guv’nors.

Fake AICPA Mail Serves Blackholes and Rootkits

Tue, 21 Feb 2012 20:29:00 +0000

Sunbelt: Be wary of emails claiming to be from AICPA – as per their alert here, these are not real and any mention of “unlawful tax return fraud” is just a bait to convince the end-user to open up a malicious attachment (in this case, a .doc file although there are rogue PDF files in circulation too).

As with many of the malicious spam campaigns doing the rounds at the moment, this one will use the Blackhole exploit kit to serve up zbot from multiple compromised domains. Worse, a Sakura kit (typical example here) will download Sirefef / ZeroAccess , which as we’ve seen elsewhere is not a good thing to have on your system.

Масленица Началась, And So Is Spam!

Tue, 21 Feb 2012 19:59:00 +0000

Symantec Connect: Maslenitsa (Маслница) is a religious holiday celebrated in Russia and Ukraine during the last week before Lent, i.e. the seventh week before Pascha (Easter). This festival is also known as Pancake week or Butter week. During this week people enjoy the social activities that are forbidden during the prayerful Lenten season, such as partying, dancing etc. This year the Maslenitsa will be celebrated from February 20 to February 26.