- http://www.informationweek.com/shared/prin…cleID=166401789
July 22, 2005
"A new phishing attack that poses as a message from eBay Inc. is loose on the Web and fooling users with a genuine-looking message. The attack uses an E-mail that appears to come from eBay and says the company needs some information to protect the customer from Internet attacks. If users click on a link, they are taken to a form that asks for personal information, which is captured by the bad guys and could be used for identity theft and other problems. The messages were first spotted in Israel by security vendor Fortinet Inc., which reported Friday morning that security appliances at its customer sites had recorded 46,000 hits by the phishing wave. Based on the number of attacks and the speed at which they're spreading, Fortinet said this phishing attack ranked in the top 10 of all time. Fortinet said it recorded 12,000 hits in the first two hours after the first one was detected Thursday evening. "On a scale of 1 to 10 on creativity, this one is high up on fooling users," says Patrick Nolan, virus researcher at Fortinet. "But after the first click, it brings on text looking like any other phishing attack." He thinks the hackers are working hard to spread the attack quickly, because Fortinet usually sees only a couple of thousand phishing messages…"
Phishing attacks soar as viral onslaught wanes
- http://www.theregister.com/2005/07/29/blac…malware_report/
29 July 2005
"The volume of phishing attacks on UK businesses in July increased 45 per cent, according to email security company BlackSpider Technologies. BlackSpider detected more than 360,000 emails carrying a phishing threat in July, compared to just under 250,000 in June 2005.
Spam levels reached a yearly high in July, accounting for 77 per cent of all emails processed by BlackSpider. Meanwhile virus-laden emails dropped slightly from 2.9 per cent in June to 2.6 per cent in July. The NetSky-P virus toped BlackSpider's malware chart for the fifth successive month. Phishing fraud emails appeared at second and sixth places in Blackspider's top ten while variants of older viruses (namely NetSky, MyDoom and MyTob) made up the other places…"
Phishing via Hosts File
- http://www.websensesecuritylabs.com/alerts…php?AlertID=251
August 03, 2005
"Websense Security Labs™ has detected a new trojan variant that performs a phishing attack against users. The trojan modifies the hosts file on the infected machine, and then maps the real address of a bank to the IP address of a phishing site. This mapping causes users to be redirected to a phishing site when they attempt to access their bank account…the browser displays the correct web address, but has actually loaded a phishing site. After users enter their logon information into the fake website, they are redirected to the real website of the bank. This trojan also functions as a keylogger. The trojan starts capturing keystrokes once it detects an online banking site is being accessed. The trojan then uploads the captured keystrokes to the attacker…"
Brazil Pinches 85 Phishers
- http://www.techweb.com/wire/security/170100794
August 26, 2005
"Brazilian police have arrested 85 people in connection with a phishing ring that pilfered over $33 million from duped consumers who handed over their online bank account usernames and passwords…Fraud in general, and phishing in particular, are serious problems in Brazil. The country's Computer Emergency Response Team – its version of U.S. CERT – recently released figures that shows e-fraud reports had more than tripled since April. Analysis done by the U.S.-based Anti-Phishing Working Group, meanwhile, has pegged Brazilian phishers as among the most aggressive and technically sophisticated in the world. The Brazilian arrests dwarf other raids recently carried out by global law enforcement, including 12 people nabbed in the U.K. May of 2004, five grabbed last December in Germany, and 15 pinched in Spain earlier this month."
Phishing Alert: Red Cross / Hurricane Katrina
- http://www.websensesecuritylabs.com/alerts…php?AlertID=275
September 04, 2005
"Websense® Security Labs™ has received reports of a new phishing attack that targets people to donate money in order to support the relief efforts for Hurricane Katrina. The spoofed email is written in HTML and poses as if it was coming from the Red Cross. The email also has the Verisign "Secure Site" Logo on it to help deceive the end-user that it is legitimate. Upon connecting to the link provided within the email, the user is directed to a fraudulent website which is hosted in Brazil and was up at the time of this alert. The site is also hosting other content and appears to have been compromised. The user's credit card, expiry date, and PIN are requested through a online form and, once entered, the user is then redirected to the real Red Cross website…"
EDIT/ADD:
- http://www.techweb.com/wire/ebiz/170700815
September 06, 2005
"In the eight days since the American Red Cross began collecting donations for Hurricane Katrina relief, it's gathered more than half of the $409 million total from the Web, the organization said Tuesday.
Approximately $209 million has come from Web donations, the Red Cross said…Last week the Red Cross also appealed to 700,000 former contributors via e-mail, and raised $4.5-million. A follow-up was mailed on Thursday…
Some differences can be spotted, however, in the phishing site. While the real American Red Cross site includes links to information on non-online ways to donate – such as by phone or by mail – the bogus site has trimmed the choices to online only…"
Phishing Alert: Salvation Army
- http://www.websensesecuritylabs.com/alerts…php?AlertID=297
September 26, 2005
"Websense® Security Labs™ has received reports of a new phishing attack that targets The Salvation Army. Users receive a spoofed email message, which gives statistics for the Salvation Army and requests donations for the relief effort of Hurricane Katrina aftermath. The email contains a link to the phishing site, which requests payment information.
- http://www.websensesecuritylabs.com/alerts…php?AlertID=297
Update (September, 27th 2005):
"With the support of several ISPs and Websense, The Salvation Army has been able to quickly shut down the fraudulent websites. As of this update, all known phishing sites which had targeted The Salvation Army are now offline.
The Salvation Army would like the public to be aware that donations can be made securely at https://secure.salvationarmy.org/ . Details of The Salvation Army's response to the disasters presently facing the USA can be found at http://www.salvationarmyusa.org/ …."
Bogus FIFA lottery scam hits the net
- http://www.theregister.com/2005/09/28/fifa_lottery_scam/
28th September 2005
"Fraudsters have launched a phishing campaign that tries to dupe football fans into believing they've won a FIFA-sponsored lottery in an attempt to steal bank account information. The bogus email notifications of supposed $1m winnings prey on interest in the Football World Cup tournament, scheduled to take place for the first time in South Africa in 2010. FIFA, the international football governing body, has posted a warning on its website. The latest spam attacks represent a phishing refinement on standard lottery scams themed around the 2010 World Cup dating back over a year or more. "Everyone should be suspicious if they are unexpectedly told they have won a fortune," said Graham Cluley, senior technology consultant for Sophos. "Computer users who fall for this trick will be feeling as sick as a parrot when their bank accounts are emptied and they find they have become the victim of identity fraudsters"…"
Unsuspecting Users Still Freely Give Up Personal Info
- http://www.techweb.com/article/printableAr…_section=700028
November 8, 2005
"The vast majority of Americans are all too willing to give up private information that could be used to guess online account names and passwords, a security firm said Monday, showing that the threat of identity theft hasn't yet sunk in. RSA Security lured consumers with a bogus survey on New York City tourism and the promise of gift certificates. Official-looking pollsters in the city's Central Park asked questions ranging from the mundane – "Is this your first visit to New York City?" – to the personal – "What's your mother's maiden name?" – to duplicate how phishing attacks dupe users with real logos and industry lingo. More than 70 percent of those polled gave up their mother's maiden name – a potential goldmine, since it's often used to confirm identities or demanded in a password reset – while over 90 percent handed over their place and date of birth. More than half told the pollsters how they come up with online passwords.
"A lot of personal information actually functions like a password and, as such, needs to be robustly protected," said Chris Young, vice president of consumer authentication at RSA in a statement. "With a bit of sleuthing, motivated phishers can guess a password by having [a victim's] address and trying combinations that assume he's a fan [of a particular sports team]. Our survey reminds us that we all need to be more aware of such vulnerabilities, and take precautions."
Young advised consumers to keep all aspects of their password-creation methodology, as well as all personal information, as secret as possible. He also recommended that users rely on a variety of passwords, not the same one for all accounts or access."
IRS web site screwup used by phishing scammers
- http://www.theinquirer.net/?article=28037
30 November 2005
"SOPHOS SAID that an email purporting to be from the Internal Revenue Service (IRS) sends people to a legitimate government site but is really a phishing scam. It uses a vulnerability on the real IRS site. The email promises US taxpayers a refund but leverages a security configuration error at the IRS site which then bounces the unwary to a bogus look alike site. Said Graham Cluley, senior tech consultant at Sophos: "The link in the email simply bounces the user off a US government website onto a site owned by the criminals, who are ready and willing to steal their credit card details, social security number and other personal information".
The scam is more sophisticated than your average racket, said Cluley because people are invited to paste a link rather than click on a link, and do get to go to the IRS site briefly. He said that "unfortunately the way the government website has been configured allows the phishers to bounce the unwary in their direction instead". He said it should be a warning to every business and agency to be careful it cannot be abused. Sophos has a display of the government SNAFU, here…"
- http://www.sophos.com/pressoffice/news/art…1/irsphish.html
Windows hosts file modified by Phishing attacks
- http://www.websensesecuritylabs.com/alerts…php?AlertID=363
December 05, 2005
"Websense® Security Labs™ has observed an increase in phishing attacks that use modifications to the Windows hosts file to deceive users. Various exploits and social engineering tricks are used to execute malicious code that appends several entries to the Windows hosts file. These entries redirect traffic from the legitimate web addresses of several banks to the IP address of a phishing site created by the attacker. The next time the user attempts to visit one of the targeted banks, they are instead redirected to arrive at a phishing site. However, the web address shown in the browser's address bar appears to be the correct address. The logon information of the unsuspecting user is captured, as they attempt to access the site. The example… targets four banks: HSBC Brazil, Banco Itau, Banco Banespa, and Bradesco. The phishing sites used in this attack are hosted in California and were online at the time of this alert…."
(Sample hosts file and screenshots shown at URL above.)
Study says 1 in 4 targets of e-mail phishing scams
- http://tinyurl.com/9ccmm
Dec 7, 2005
"Roughly one in four U.S. Internet users are targets of phishing attacks – phony e-mails seeking personal financial data – according to a study conducted by Time Warner Inc.'s Internet unit AOL and the National Cyber Security Alliance. In a phishing attack, e-mails ask prospective victims to verify personal information through links to real-looking Web sites. According to the study, 70 percent of consumers who received such e-mails thought they were from legitimate companies…."Phishers are getting better at tricking consumers into revealing their bank account and financial information, and most Americans can't tell the difference between real e-mails and the growing flood of scams that lead to fraud and identity theft," said Tatiana Platt, AOL's chief trust officer, who's in charge of privacy and security. "Consumers need to be aware of the risk, and they need to use critical protections like anti-virus software, spyware protection, and a firewall to help protect them from online threats," she said…"
- http://www.websensesecuritylabs.com/alerts…php?AlertID=368
December 12, 2005
"Websense® Security Labs™ has received reports of a new phishing attack that targets customers of Wal-Mart. Users receive an email message, written in HTML, claiming that their Wal-Mart logon account has been compromised. The message reminds users that the terms and conditions of their account require that it be under control at all times. The email message also states that the parties connected to the account have been involved in money laundering activities, illegal drugs, and various Federal Title 18 violations. When users click the link within the email, they are directed to a fraudulent website, which is hosted in the United States and was up at the time of this alert. The fraudulent site first requests the users' logon ID for www.walmart.com and then requests their credit card information and other personal identity specifics. This site has hosted phishing attacks for other targets in the past… As Christmas nears we expect further ecommerce-related fraudulent activity…"
(Phishing email screenshot available at URL above)
Malicious Website / Malicious Code: Fake McAfee Patch
- http://www.websensesecuritylabs.com/alerts…php?AlertID=370
December 13, 2005
"Websense® Security Labs™ has received reports of an email scam disguised as a patch for McAfee products. Users receive a spoofed email message instructing them to click on a link to immediately download and install a patch from McAfee. This patch claims to address a virus that does not exisit. The link in the email takes users to a fraudulent website, that appears to be the legitimate McAfee security site.
The patch hosted on this page is actually a Trojan downloader. The malicious site is hosted in the United States and was online at the time of this alert.
Spyware Lures to Install Potentially Unwanted Software
- http://www.websensesecuritylabs.com/alerts…php?AlertID=379
December 19, 2005
"Websense Security Labs ™ is seeing a large increase in the number of websites and emails that use deception and/or browser vulnerabilities to install potentially unwanted software. The common theme among these threats is the use lures of possible spyware infections on your machine. In some cases, the scam actually reports fraudulent information regarding the security of your PC.
In many cases they also request money in return for cleaning the outlined security problems (we have seen as much as $500 per year). Over the last 2 weeks, we have identified more than 1500 sites that have some (or all) of the following criteria:
- They are hosted in Ukraine and Russia
- The website domain names are registered in countries like Vanuatu and Mexico
- IP netblocks hosting sites are often hosting other questionable sites such as fraudulent search engines
- IP netblocks have been hosting malicious code such as Trojan horse downloaders, droppers, and hosts-file redirection software
- Malicious code that modifies DNS settings has used these netblocks for DNS resolving
- Downloaded code often includes several pieces of spyware, adware, and other potentially unwanted software
- Removing the software often requires that you to fill out a survey
- Several of the sites contain links to other sites that are hosting IE exploit code …"
(Various Example Screenshots available at URL above.)
