Spam Wars Dispatches

Your Telephone Account Number

As frequent readers of this blog know, my primary concern is educating everyday users about avoiding tricks that criminals use to capture private data. An article at Trusteer warns of a recent attack technique that takes treachery to a new level. The underpinnings are a little complicated, but a user heading for trouble probably wouldn't notice what's going on. In fact, warning systems built into detecting bank account or credit card fraud essentially become disabled for the user, leading to incredible difficulty after the fact.

The problem begins — as if often the case — with a PC infected by a particular piece of malware. Now, before you say "But I have antivirus software installed on my PC!", there may be times when you find it necessary to use another person's computer, or a computer in a publicly accessible location to perform even a quick transaction (e.g., check your balance) with one of your financial institutions. You can't possibly know if that PC is clean, even when its owner or administrator swears on a stack of AV CDs that everything is OK (oh, well maybe the profiles haven't been updated this week...oops). These days, the same goes for using someone else's smartphone to access your accounts — a very risky proposition for numerous reasons.

So, this infected PC constantly monitors activity, looking especially for access to financial sites. At that point, it's easy for the malware to capture login credentials, which can then allow its masters to get inside your account. Rather than bleed your credit card or bank account dry for a quick shopping spree, the crook sends you a fraudulent email that tries to trick you into handing over your telephone number and account details. Why? So he can screw with your call forwarding such that telephone verifications from the institution are sent to established criminal call centers who provide all necessary verification data you've allowed to be phished or stolen. Your account stays alive longer for the crooks to bleed you even drier.

Because the institution has performed its job of verifying a transaction against information that only you, the customer, should know, you will have one helluva time getting things fixed.

How can you best protect yourself? You should be suspicious of any unsolicited email or telephone call you receive that asks for personal information of any kind. The more dire-sounding the reasoning behind the call, the more cautious you should be. If there is a genuine problem with your account, then you should be able to log into the account online the normal way (i.e., by following a pre-existing bookmark to the site) or call the institution by the telephone number on your most recent bill or statement. Just as you should not trust a link in an email, so should you mistrust a phone number given to you by an unsolicited telephone call.

If you're not paranoid about criminals coming after your valuables, you're crazy.

Phony (and Inept) Intuit Email (Updated)

I love it when crooks make simple mistakes that cost them. Look at the following email message claiming to come from Intuit (the accounting and tax return software company):

From: INTUIT INC.
Subject: Your tax information needs verification.

Dear Account Holder,

In order to guarantee that correct data is being maintained on our systems, as well as to provide you better quality of service; INTUIT INC. has partaken in the Internal Revenue Service [IRS] Name and TIN Matching Program.

We have discovered, that your name and/or Employer Identification Number, that is indicated on your account does not correspond to the data obtained from the IRS and/or SSA.

In order to check and update your account, please click here.

Yours truly,
INTUIT INC.

Corporate Headquarters
2632 Marine Way
Mountain View, CA 94043

Is this a phishing expedition or a malware lure? It's hard to tell because the doofus failed to set up the botnet spam sender to fill in the actual link. Here's the source code:

click here

The {int_link} text is a placeholder for the actual link to be inserted. My gut feeling is that this template is supposed to be used to lure recipients to a hijacked web site for malware delivery. That's just my, um, intuition based on years of reading this crap.

Anyway, don't be surprised to see a subsequent blast with this social engineering trick — don't want to screw around with tax stuff, right? — but with the link "fixed."

Update (26Jan2012, 1800 PST): He's been going at it now for over six hours and still no change in the URL. He must be scratching his head over why he has zero responses (my favorite number). Here are variations in the Subject: line I've seen personally:

We need your tax information ASAP.
Your tax information needs verification.
Urgent update of tax information is requested.
Verify the correctness of your tax information.
Tax Information needed urgently.
Please update your tax information promptly.
Verify your information for INTUIT INC..

Message bodies also vary a little, but the basic intention is the same.

Somewhere along mid-run, the idiot figured out how to include the actual image binary data for the Intuit logo header at the top of the message. But he still can't figure out the active link stuff. He must have burned through at least a hundred bucks of botnet time with no chance of payback. I'm doing the Snoopy happy dance.

Microsoft Legal Department Malware Lure

The latest in the malware lure campaign invokes the mighty piracy-fighting lawyers at Microsoft. In the email, the recipient is essentially accused of using pirated MS products, and he/she had better click the link to register a PC and avoid court. What a bunch of bullshit.

Here's the message:

Subject: Microsoft legal department

We've been tracking the illegally installed versions of our products for a long time, we've recently won tht claim in International Court, and we were alloud to request from the providers personal details of persons using the illegally installed versions of Microsoft products. We've decided to solve this problem avoiding court. After you follow this link, we register your PC as a legal one, thereby you avoid the judicial issues concerning presumably illegally instaled software on your PC.
With Respect To You
Emeline Welsh

SHA2 check sum: c084bfe116bfe1169dc08e16923723a5a5728e11169dcccccc08e6b572849237

How 'bout the typos and use of the non-word "alloud"? Hmmm, not what I'd expect from Microsoft's lawyers. Tee hee.

As a million times before, the link leads to a hijacked web site, where a page of obfuscated JavaScript can lead a user of an unprotected PC down the path of screwdom.

iPhone 5 Malware Lure

Some believed that the "Think Different" ad campaign of Apple was grammatically incorrect. Not so. But here's a scam email that is way too incorrect:

Subject: Brand new iPhone 5 design

We are pleased to introduce you a piece of future. Take a look at the new iPhone's design here.

[35 line breaks omitted]

Copyright © 2012 Apple Inc. All rights reserved.

The link, of course, is not to any genuine Apple site (although the freshly-minted domain has "iphone5" in its name). It downloads a Windows executable...which is a piece alright, but not a piece of future.

The OTHER Ben Bernanke

Bank of America is frequently abused by crooks who try to gain a level of credibility in perpetrating their scams. The following is a slight variation on a frequent 419 (advance-fee) scam:

Subject: NOTIFICATION OF CREDIT FROM BANK OF AMERICA

NOTIFICATION OF CREDIT FROM BANK OF AMERICA.

Attn: Beneficiary,

We received a payment credit instruction from the Federal Government of Nigeria to credit your account with your full Inheritance fund of US$10.3Million from the Nigerian reserve account with our bank, Bank of America on 23rd of December, 2011.

However, you shall required to provide the followings data’s below:

{1}. Your Full Name and Address.
{2}. Your Confidential Tel, Cell and Fax.
{3). Your Bank name and address.
{4). Your A/c Name and A/c Numbers.:
(5). Your Swift Code / Routing Numbers.

Please do provide the above information accurately, because this office cannot afford to be held liable for any wrong transfer of funds or liability of funds credited into a ghost account.

Thanks for banking with Bank of America while we looking forward to serving you with the best of our service.

Thanks and God bless you.

Regards,

I omitted the full signature section because it's where the fun really begins:

So, I'm supposed to believe that Ben Bernanke is an account office at the Athens, GA branch of BofA, while also being Chairman of the Federal Reserve Bank of New York. Notice, however, that this is Ben M. Bernanke. The middle initial of the real Ben Bernanke is S. He's also the Chairman of the whole Federal Reserve. And something tells me that Ben S and Ben M are not identical twins with only distinguishing middle names.

Anyone who takes this email as genuine and responds needs some adult supervision. Seriously.

Goofy Malware Lure

I'm kind of left speechless by this amateurish attempt to get unsuspecting recipients to click their way to PC infection:

Subject: Your order for chopper for the weekend

Your order for our air commuter services has been taken and processed. The rotorcraft will be at your disposal from 16.45 saturday to 7.30 p.m. wednesday. Once again, the rates are as follows:
1 hour in the air: 525$
Takeoff / Landing: 254$
1 hour standstill on the ground: 78$
Longest period in the air is 3 hours.
When flying for longer distances, a co-pilot is needed, and the cost consequently increases by 120$ per hour.

Tital to pay.doc 406kb
Best wishes
Trey Toney

Secure Checksum: 5a572849d084b57dccc03af4bf49

Clearly written by a non-U.S., English-as-a-third-language crook. Like so many of these messages, the link isn't to an attached document, but rather to a hijacked web site, where obfuscated JavaScript takes over.

Tuesday Morning Malware Lures

More malware lures today to induce unsuspecting email recipients to click a link to Hell or open a Trojan-loaded attachment.

First the link variety. This time, the crook is using a bunch of legal mumbo jumbo. It's mostly meaningless, but invocating "the court" may put the fear of God into recipients and get the clicking finger adrenalin going:

Subject: Re: Fwd: Our chances to win an action are better than ever.

We discussed it with the administration representatives, and if we plead guilty our slight infringements to improve their statistics, the major action will be closed due to the lack of the state interest to the action. We have executed your explanatory text for the court. Please read it carefully and if anything in it of you feel uncomfortable with anything in it, advise us.

Speech.doc 556kb

Best Regards
Alita Feliciano

Secure Checksum: b1de6f8a5c8a50c3e1de127d4b650c3e6f

Although the message is formatted to make it appear as if the link is to an attachment, it is really just a clickable hyperlink to a hijacked web site where nefarious things happen to the unprotected PC.

The second one displays the guts of the malware distributors. They pose as no less than the United States Computer Emergency Readiness Team (US-CERT). Check this out:

From: soc@us-cert.gov
Subject: Phishing incident report call number: PH0000005724464

US-CERT is forwarding the following Phishing email that we received to the APWG for further investigation and processing.

Please check attached report for the details and email source

US-CERT has opened a ticket and assigned incident number PH0000001057411. As your investigation progresses updates may be sent at your discretion to soc@us-cert.gov and should reference PH0000009366166.

Thank you,

US-CERT Operations Center
888-282-0870
soc@us-cert.gov
http://www.us-cert.gov

[Attached File: US-CERT Operations Center Report 9463207.zip]

Ignoring the use of three different PH numbers (I guess as in PHony incident numbers), the fact that the message headers reveal its origination in Indonesia taints the authenticity just a tad.

Just remember: The more an unsolicited email message tries to elevate your blood pressure, the more likely it's B.S.

Shame, Shame, Shame

There is a spammer out there who squeaks past the U.S. CANSPAM law by the thinnest of margins, yet he practices a technique that should have been outlawed: He floods the body of the message with hidden text content intended to trick spam filters, often called hash-busting.

He's doing this to advertise all kinds of products and services, including some very well-known brand names, such as Pimsleur language training. It's impossible to know if the spammer is an actual affiliate, or is using another route to generate leads for Pimsleur. Links in the messages do not go to Pimsleur (or whatever company is being promoted), but rather to domains whose registrations were minted fairly recently and are privacy-protected. The opt-out links go to the same domains as the offer links.

The particular hash-busting technique that this guy has been using for quite awhile is to load the hidden text at or near the end of the visible HTML, buried within a

Another spammer out there has been pushing a skin care line using slightly different hash-busting overloading. His technique uses a combination of syntactically-correct style sheet rules (although referencing HTML elements that don't exist in the message), plus multiple series of slash-delimited dictionary words and wide-spaced single words all within the same