Disaster donation scams continue

FYI…

- http://isc.sans.org/diary.html?storyid=4426
Last Updated: 2008-05-17 00:05:47 UTC - "…Ever since Hurricane Katrina back in 2005 ( see http://isc.sans.org/diary.html?storyid=643 ), we've seen after every significant natural disaster, the scammers start registering domains and try to collect donations. The last 2 weeks have seen Cyclone Nargis hit Myanmar and then the big earthquake in China and as expected, we've seen registration of domains related to those disasters. These may not all be scams, but we repeat the advice we first gave nearly 3 years ago - if you wish to donate money to help the victims of these disasters, we suggest you stick to the established charities that you have a relationship with (such as the Red Cross or Church World Service or the like) through their main web pages or the phone."

Grrr… more:

- http://isc.sans.org/diary.html?storyid=4432
Last Updated: 2008-05-19 14:16:38 UTC - "… Earlier today we received interesting reports from China of text messages (SMS) being distributed which request the reader to transfer money to a certain account number, or even just reply to the message to help fund relief to the Sichuan earthqake. In addition, late last week reports appeared of a message which invited readers to help the Red Cross fight "poverty and suffering" by making a call, or sending a text message.

While one would expect more physical acts, such as sending text messages or calling a number allow better identification of the culprits than more obscure credit card number theft and distribution, this is often not the case. While the owner of a number may easily be identified in many cases, it is often just the company providing a service for another third party. The latter may have used fake For-a-fee telephone numbers, both for call and SMS are often purchased through service providers, which may require less stringent verification of their clients than the actual phone network."

FYI…

- http://preview.tinyurl.com/6y4cgy
May 19, 2008 (Infoworld) - "…From the reports, it appears that a Chinese hacker or group of hackers was able to gain access to the portion of the Red Cross site that linked to the accounts being used to collect donations from the public. In order to siphon some of these funds off for themselves, six fraudulent accounts at four different banks were opened under three different names. Because reports are only just emerging, it is too early to determine how long the redirection was in place and how much money was captured from prospective donors…"

FYI…

- http://www.theregister.co.uk/2008/05/22/ch…thquake_trojan/
22 May 2008 - "Unscrupulous virus writers have inevitably latched onto the Chinese earthquake disaster, which killed more than 50,000, to punt malware. The Trojan-laced email attacks follow earlier phishing scams themed around the Sichuan province disaster. Emails with infected Word attachments contaminated by MalDoc-Fam Trojan are being distributed in messages the pose as news about the disaster, net security firm Sophos reports*. The malware-tainted emails typically appear with body text suggesting they contain news from China's official press agency, Xinhua…"
* http://sophos.com/pressoffice/news/article…8/05/quake.html

.