Category Archives: Phishing
The Simple Phishing Toolkit includes a site scraper that can clone any Web page — such as a corporate Intranet or Webmail login page — with a single click, and ships with an easy-to-use phishing lure creator.
An education package is bundled with the toolkit that allows administrators to record various metrics about how recipients respond, such as whether a link was clicked, the date and time the link was followed, and the user’s Internet address, browser and operating system. Lists of targets to receive the phishing lure can be loaded into the toolkit via a spreadsheet file.
The makers of the software, two longtime system administrators who asked to be identified only by their first names so as not to jeopardize their day jobs, say they created it to help companies educate employees about the dangers of phishing scams.
As pointed out, it’s almost a necessity to have something like this today.
It seems that not long ago, the idea of organizations phishing their own employees was controversial. These days, there are a number of organizations that offer this awareness training as a service. If you’d rather design and execute the training in-house, SPT looks like a great option.
- Phishing: US Government or ID10T? (renaevans.wordpress.com)
- Phishing – Run From the Hook! (zachner.me)
- Recursive phishing email (boingboing.net)
If you haven’t applied the patch yet beware. If your still using IE 6, upgrade.
Starting late Wednesday, researchers at antivirus vendor Symantec‘s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.
Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.
As of midday Thursday, Symantec had spotted hundreds of Web sites that hosted the attack code, typically on free Web-hosting services or domains that the attackers had registered themselves.
The IE flaw being leveraged in these attacks was also used to hack into Google‘s corporate network last December. It has been linked to similar incidents at Adobe Systems and 33 other companies. Microsoft patched the vulnerability in an emergency security update Thursday morning.
The Google attack hit IE 6 on Windows XP, but over the past week hackers have found ways to exploit the flaw on more recent versions of the browser as well. These latest techniques do not appear to be used on the Web sites Symantec has uncovered. They use the IE 6 exploit code, Talbot said.
Still, with IE 6 still being widely used, the move to more widespread attacks is worrying. “It may be an indication that attackers have finally ramped up their attack toolkits and are now ready to launch widespread attacks,” Talbot said.
Phishing is being used to gain victims.
He believes that the criminals are tricking victims into visiting their Web sites by sending spam e-mail or instant messages with links to sites.
On Thursday, Websense published some sample e-mails used in targeted attacks that exploit the IE bug. A typical subject line is “Helping You Serve Your Customers.” The e-mail reads, “I just heard the news: Helping you serve your customers” and includes a link to the malicious Web site.
The e-mails contain spoofed e-mail addresses, designed to fool victims into thinking that they were sent by a colleague. The malicious Trojan used in the attack is not the same one that was used in the Google attack, however.
Websense has seen these e-mails sent to targeted companies in the U.S. and the U.K., said Patrik Runald, a security research manager with Websense. “These attacks are actually continuing; they happened today; they happened yesterday and they happened the day before.”
However, Websense believes that the e-mails it has tracked are part of a small-scale targeted attack, similar to those used on Google and Adobe in attacks that are ongoing. Websense has counted only about 25 malicious Web sites to date, but the number is rising fast, Runald said. (Source: InfoWorld)
Related articles by Zemanta
- Widespread attacks exploit newly patched IE bug (computerworld.com)
- Microsoft Plugs Security Hole Used in December Attacks (bits.blogs.nytimes.com)
- 5 More Reasons Why IE6 Must Die (mashable.com)
Microsoft Outlook users.
The phishing e-mail arrives in Outlook e-mail in-boxes and looks like it comes from Microsoft. It prompts recipients to reconfigure their Outlook by clicking on a link that leads to a Web site that asks for an account name and password, as well as mail server information, according to the TrendLabs Malware Blog.
By getting the mail server information, the phishers would get total access to the Outlook user’s account and be able to read e-mails and use it to spam others, TrendLabs said. (Source: Microsoft Outlook users targeted in phishing attempt)
In other words use caution and don’t click anything without highlighting the link to see where it goes.
Related articles by Zemanta
- Google tool targets Microsoft Outlook users (money.cnn.com)
- Google Apps syncs with Outlook – a cure for cloud computing angst (venturebeat.com)
- Is that tweet from a cyber crook? (cnn.com)
As online crimes have become more prevalent, the attacks have become more sophisticated. Learn how the latest attacks work to avoid becoming a victim.
Go here to see a recorded webcast on phishing attacks.
or two or three targeting Facebook.
TechCrunch provides the details of the original attack on April 29.
If you get an email message that looks to be from Facebook with the subject, “Hello,” and featuring the text below, don’t bother clicking on the link included. Doing so takes you to a site called fbaction.net that mimics the look of the main Facebook login page, hoping to get you to sign in. Naturally, if you do that, the site will have access to your account and can send out more of these messages to your friends.
The message body will apparently read something like this (with YOURFRIEND being replaced by the name of a friend of yours):
YOURFRIEND sent you a message.
Facebook blocked outgoing links to the domain while IE8 and others started flagging it as suspicious before GoDaddy pulled the plug on the domain.
However it appears there are a few variations out there now.
One is krmked.net, details can be found here.
Another is fbstarter.com, here are the details.
But now there seems to be a new one linking to http://fbstarter.com/. It comes in the form of a message from a friend telling you to “Look at this!” When you click on the link, you are taken to what appears to be a Facebook sign-in page. If you go ahead and sign in, the phishers have access to your account and can then send messages to all of your friends.
I just got one of these messages. It looks like this:
Joshua sent you a message.
Subject: Look at this!
And fbstarter is hyperlinked.
Facebook to its credit jumped quickly on this one as well according to TechCrunch:
We’ve already blocked http://www.fbstarter.com from being shared on Facebook. You’ve probably seen what this looks like but I’m including a screenshot. Now, we’re deleting that URL from walls and inboxes. We’ve also blocked access to the URL so if someone does find it on Facebook (on their wall, in their inbox, or in an email notification) it won’t send them to the destination. Finally, we’ll automatically reset the password on any account that sent the malicious link. Thus, the data becomes useless to the bad guys very quickly.
In addition, we work with MarkMonitor (they made an announcement today). We send them URLs and they get them added to the browser blacklists and work to get the sites taken down. I’ve included a screenshot of the warning from Firefox that resulted from their work on the phishing attack yesterday (fbaction.net). They got that site taken down, too. Today’s site (fbstarter.com) has been down most of the morning. MarkMonitor and Facebook are watching it closely, though.
The key to not falling victim is to not just click something without checking the path of the hyperlink as phishing ones will have additional information on the backend.
Of course if it seems to be something that a friend wouldn’t send – don’t open it without checking with them.