Thursday, November 12, 2009

419 phisher mash-up


Well here's a new take on an old scam - well possibly two old scams in one as it has elements of both 419 advance fee fraud and phishing about it (click on the email screenshot to see it in its full glory - I added the red highlighting).

I must say I have never before had scammers offering to send me my own "account online log in and password". What's the betting there is a small charge to release the information?

Labels: , , ,

Links to this post:

Create a Link

Saturday, November 07, 2009

Cheapskate copycat 419 scammers

The following extraordinary sentence launched yet another tedious social enginering 419 scam in my spam box:

"Take notice that based on the UNITED NATIONS government inauguration of this committee which extended to all countries which combined with the United Nation Anti-crime commission to alleviate and redeem the image and past wounds of our dear citizens and foreign firms who were duped, defrauded, scammed and abandoned by some impostors who indiscriminately use the name of God, Office of governors, Presidency, Banks etc to slight down our dignities to international communities."

Most 419ers are clearly one sandwich short of a picnic as all they seem to do is replay the same old scams over and over. The 'clever' ones add daft little elaborations and the rest duly plagiarise them without actually understanding how dumb they end up sounding.

This cretin continued: "Many banks have been in bankruptcy today, Universal firms, Companies due to the activity of these hoodlums. However, investigation have shown that these people have dropped over 500,000 clients after collecting their money, many committed suicide and others living by the grace of God," [that comma ended the paragraph].

By the third paragraph, the bizarre language had actually become quite entertaining: "Meanwhile, we have a committee whose duties are to re-commend [sic] genuine contractors, loan bidders, next of kin (inheritance payment), foreign firms who have completed all the U.S government normal payment requirements but abandoned due to take over of some sacked officials who take Government papers to collect money and leave the beneficiary half way." He's obviously read far too many emails by his friends in the back-street Internet cafe, and mashed them all together in his tiny pin-head, as if that somehow enhances the magic.

After a boring fourth paragraph, we discover that his CAPS-LOCK key is evidently sticking: "We also have endorsed your payment to FALCON BANK TO PAY YOU THROUGH A DIPLOMATIC COURIER SERVICE without prejudice and will need a confirmation of all your communication until you finally receive your money so as to investigate more so to find out more facts on this issues, it will be well appreciated if you can provide us some vital information on how you have been scammed. The U.N government is using this opportunity to compensate the entire victim who some have duped."

The 'U.N Government'?! Gosh, I must have missed that election. Silly me.

"So you are advice to contact Mr. Felix De Lapaz to mail to you a certified check which can be cashed anywhere in the world and the amount is $250,000.00 U.S.D(TWO HUNDRED AND FIFTY THOUSAND UNITED STATES DOLLARS)." Now, just in case the rest of this tripe somehow escaped my beady and rather jaundiced eye, I clearly smell a very large malodorous rat as most of this cheapskate scammer's peers are offering me many MILLIONS (all in CAPS of course, spelt out for me word-by-word as if this somehow adds credibility to those crazy digits).

After asking me to cough up a little personal information ("Please fill the following form for documentations:"), the numbskull ends with this: "As soon as you give him the following he will mail your compensation cheque to you. THIS IS PROUDLY SPONSORED BY "THE U.N CAMPAIGN TEAM AGAINST ONLINE SCAMS"." So, this is a sponsored scam, eh? I'm sorely tempted to write back to see if I can discover how he managed to secure such high-powered sponsorship ... but then I come to my senses and realise that bozos like this are simply not worth the electrons.

Still, at least I got yet another entertaining case study out of it. And a wry smile.

Labels: , , ,

Links to this post:

Create a Link

Wednesday, November 04, 2009

Word-based email blacklisting

Using banned-word lists to block spam may be a simple and hence cheap control but it may be too crude or simplistic to work properly. Blocking emails with "teen" in them, for example, is perhaps not the smartest move made by New Zealand's Social Development Ministry.

Labels:

Links to this post:

Create a Link

Thursday, October 15, 2009

Yet another inept 419er

Some Nigerian thinks I was born yesterday:

Content-Type: text/plain Content-Transfer-Encoding: 8bit Message-Id: <20091014171244.7474f21fec20@kunde.business-light.com>
Date: Wed, 14 Oct 2009 19:12:44 +0200 (CEST)

From :The Honourable Officeof the Finance Minister.(FMF)In collabration with (CBN)Office.ATT : Honourable Contr(FMF/CBN) Payment Notification Update. In order to eradicate the fraudulent rampant extortion of money from contractors as transfer charges and taxes by non-exiting individuals and corrupt Government officials.I am obliged to reach you concerning the immediate payment of your fund by ATM Visa Card. Be- informed that this communication superside any other you must have had with any office in connection with your payment. Investgations reveal that you have paid some good money in the past as transfer charges and taxes which did not reflect in the bank treasury, that means officials concern have help themselves to the money at your own detriment. Now that your file has scaled their huddle and your file is on my table.I want to ensure the immediate payment of your fund by ATM Visa Card. You are thereby advise to re-confirm to me the following:Your full Name 2) Your Telephone and Fax number (3)Your receiving Address &Banking particulars. (4)Copy of your international passport. This is imperative to enable me confirm your informations and make my recommendations to Foreign Operation ATM Department of FMF for immediate payment of your fund by ATM Visa Card.Note:If your file returns to the cabinet without my recommendation you will end up not benefiting from the present batch of beneficiaries.PETER EZE,Minister Ministry of Finance FMFFederal Republic of Nigeria.Contact me via my private e-mail address;( petereze.eze@gmail.com)
The "non-exiting individuals" interest me but I'm not pleased my email address has "scaled their huddle", even if it does "superside" others.

Give it a break you idiots. We're tired of all this spam.

Labels: , ,

Links to this post:

Create a Link

Friday, August 07, 2009

Twitter admin email password reset incident

Last month a story broke about employees of the company behind Twitter being hacked. TechCrunch has published details of the incident, and the comments on their story identify some of the possible controls. In short:
- A Twitter employee uses Gmail
- Gmail has a password reset function that sends the user's password to a pre-registered email account
- The Twitter employee had originally configured Gmail to use a Hotmail email account for this
- The Hotmail account was unused for months and lapsed
- The hacker requested and obtained the same Hotmail email address [it looks like the hacker was able to guess the address, preumably it was a similar address to the Gmail account]
- The hacker told Gmail to reset and send him the Gmail account password via the Hotmail address that he now owns, which it did
- The hacker then logged on to the Twitter employee's Gmail account
- One of the emails he could now access was the original "Welcome to Gmail" type notice with the original password, so the hacker was able to reset the Gmail password back to the one the real user knew, before the real user noticed it had been changed
- Through information disclosed between Twitter employees by email, and by guessing his passwords to other Web systems, the hacker obtained a further bunch of confidential information including access to the email accounts of senior Twitter execs
- The hacker eventually disclosed the hack to the news media for some reason, causing public embarrassment to Twitter and fears about their evident insecurity

Labels: , , , , ,

Links to this post:

Create a Link

Office comms risks and controls

An article about responsible Twittering hints at a broader concern for all social media, and in fact all forms of communication between the office and the outside world. Examples in the article include people falsely claiming to represent their employers and disclosing sensitive information via Twitter, plus Twitter being used to direct potential victims to infectious sites hosting malware. People have done the same kinds of things for years using email, telephone, blogs, bulletin boards, IM, VoIP and so on - even letters in the post: the incidents are pretty similar though the communications media vary.

This obviously raises questions about how to reduce the risks without unduly interfering with legitimate business communications. Technical controls offer limited assistance e.g. blocking IM will block legitimate IM activities, and determined users can sometimes find ways around such blocks anyway. Automatically appended email disclaimers have dubious legal validity, particularly those that are written or modified by amateurs. Policies and procedures can help but only if employees are made aware of, accept and comply with them, which requires awareness activities (such as this month's NoticeBored module) and compliance activities (such as management oversight - basically taking an interest in what staff are doing at their desks).

Risk avoidance is arguably the most effective control, in other words discouraging or preventing unnecessary office communications outside the organization. However this is likely to have an adverse impact on legitimate business activities, and hence costs.

Since the controls are evidently not perfect, wise organizations make contingency arrangements in preparation for situations when the controls fail and incidents occur. Examples:
  • Incident notification and specific response procedures covering these kinds of incident;
  • Response procedures include 'damage limitation' using legal actions (e.g. those disclaimers and Non Disclosure Agreeand Public Relations (e.g. stock press releases ready to issue);
  • "Learning the lessons" which means using incidents (particularly those suffered by the organization but also its peers and others in the public domain) as case studies and training materials;
  • Disciplinary procedures taking account of incidents of this nature, typically using examples.

[Scary postscript: the Pentagon thinks there is value in 'instant comms', if only soldiers can be persuaded not to disclose little things such as battle plans ...] [Or is this just a crude attempt by the US to encourage foreign militia to permit their soldier to use Twitter ?]

Labels: , , , ,

Links to this post:

Create a Link

Thursday, August 06, 2009

Office and email security awareness


We've released a thoroughly refreshed and updated awareness module on office security, covering physical and IT security in the workplace. It includes email security and security for other forms of office messaging and inter-personal communications such as IM and VoIP.

Labels: , , ,

Links to this post:

Create a Link

Thursday, May 21, 2009

Appeals Court Protects White House Office E-mails

From today's GigaLaw news:

"A federal appeals court ruled that the office that has records about millions of possibly missing e-mails from the Bush White House does not have to make them public. The appeals court in Washington ruled that the White House Office of Administration is not subject to the Freedom of Information Act.

Read more: http://gigalaw.blogspot.com/2009/05/appeals-court-protects-white-house.html (Source: WPVI-TV)"

What is it with US public admininstration and cover-ups? Is the White House above the law? Does anybody (besides me, and I'm 10,000km away) care?

I shall remember this story the next time I hear an American lecturing about fraud and corruption in foreign parts ...

Labels: ,

Links to this post:

Create a Link

Tuesday, February 03, 2009

Botnets to watch in 2009

A news item about botnets from Secureworks includes some useful information about how botnets are used and protected. They are used to distribute spam (including money mule come-ons, fake pharmaceuticals, enlargement products, loans and more) and malware.

The estimated sizes of the botnets range up to about 175,000 compromised machines, with most being a few tens of thousands, well short of the millions that lurid mainstream news headlines sometimes claim. Still tens of thousands of broadband connected computers can do a lot of damage.

Labels: ,

Links to this post:

Create a Link

Friday, September 12, 2008

AsiaDomainNameRegistrar scam

An email allegedly from an Asian domain name registrar based in China caught my eye in the spam box today.  The email basically says an investment company intends to register NoticeBored.ASIA and NoticeBored.CN, and that we'd better act fast to stop it.

Dear Manager,

We received a formal application on intending to register "noticebored" as their domain name and Internet brand in China and also in Asia from an investment company pn Sept.7th,2008. During our audit period, we find that this Investment company has no trade mark, brand or patent. As a professional institution of domain name registration, we have reasons to suspect this investment company to be a domain name grabber. Therefore, we need your confirmation on two points as follows.
First of all, whether this investment company is your business partner or distributor in China?
Secondly, whether you are interested in registering these domain names?
(According to the rules of domain name registration, the investment company will be entitled to obtain a domain name but not need the permission from the original trademark owner.) If you are not in charge of this issue, please transfer this email to the right department.
This is a letter for confirmation. If the mentioned third party is your business partner or distributor in China or in Asia, please DO NOT reply. We will automatically think that this application was from your business partner after our audit period.

Hebe

Asia Domain Name Registrar
TEL : 86-21-312 609 71
FAX : 86-21-312 609 72
Email: hebe@asiadomainnameregistrar.com
Web:www.domainorg.net.cn

It's a scam of course, but one of the better ones having a certain ring of authenticity and credibility to it.

A quick Google search soon found a blog entry about it from where links led me to another.  Blog commenters note that the registrar is blatantly overcharging for domain registrations and, in any case, there are official ICANN procedures in place to deal with 'domain name squatting' and trademark abuse.  Needless to say, I shan't be responding to their email but our lawyers and I will be fascinated to see whether those domains are ever actually registered ...

Labels: , , , , ,

Links to this post:

Create a Link

Wednesday, September 03, 2008

Ice hockey coach emails himself to prison

The BBC reports that a father, concerned about his under-age daughter's relationship with an adult ice hockey coach, installed spy software on the family PC to monitor her online liaisons.  It soon became apparent from the emails and Messenger chat the pair were exchanging that they were having unlawful sexual intercourse.  The coach was arrested, charged and convicted of five counts of sexual activity with a child and jailed for 4½ years.

In a corporate setting, it is not entirely obvious to many IT, HR and information security professionals whether an employer has the legal right to monitor it's employees' use of email and other IT facilities in the same way, even if those facilities clearly belong to the organization and are provided to employees for work purposes.  In some countries, privacy laws constrain what employee monitoring employers can reasonably do but there are often exceptions to permit more intrusive monitoring in order to investigate suspected illegal activities - not random interception, perhaps, but targeted monitoring of specific individuals which the organization has good reason to believe are doing something illegal.  There may be further exceptions in relation to serious crimes such as pedophilia, allowing organizations and law enforcement to present pretinent information obtained by chance as evidence in court, even though they had no prior knowledge of the crime. [NB: this is not legal advice!  I am not a lawyer!  Consult a competent lawyer familiar with the laws in your country to find out what you can and cannot do.]

Labels: , ,

Links to this post:

Create a Link

New NB awareness module on email security

Email security is our topic for September's NoticeBored module. This is a core topic covering perennial issues worth reminding employees about every year.

By the way, we've had some problems with the blog feeds lately but hope things are working OK now. I'm also posting occasionally to the (ISC)2 blog in the company of other CISSPs and luminaries. Do take a look if you're not already subscribed.

Labels: ,

Links to this post:

Create a Link

Saturday, January 26, 2008

Another bad day at the office

A software error during routine maintenance caused an ISP, Charter Communications, to delete the contents of 14,000 customer email accounts.

"Charter gives each new Internet user a free e-mail account, but some customers opt to use other accounts instead. So every three months the company deletes inactive accounts, Lamont said. "During this maintenance we erroneously deleted active accounts along with the others," Lamont said. "It's never happened before. They are taking steps to make sure it never happens again."


The news article doesn't mention whether the "software error" was an unfortunate and evidently untested change to the maintenance scripts (indicating a hole in their change management processes), a genuine bug in the code (possible I guess), or a simple human error by an operator/systems manager (seems entirely possible). Since the lost email accounts disappeared forever in a puff of logic, it seems the ISP had no backups of customer data - not just 'no recent backups' but 'no backups whatsoever' (a gaping hole as far as their customers are concerned but no doubt a legitimate money-saving measure from the ISPs perspective).

This incident cost the ISP $50 credits to the affected customers, presumably rather less than 14,000x$50 ($700k) as some will defect before using up all their credit. The reputational damage could be even costlier, although the truth is that such unfortunate incidents can and indeed occasionally do strike most organizations.

The Silicon Valley piece ends rather lamely with "Computer experts advise backing up all important e-mail.", implying in effect that customers are to blame for losing their emails. In some ways that is true (presumably any small businesses or power users will have been using local emaiil clients such as Outlook to download and read their emails and so should have local backup copies) but I would advise Charter Comms to look long and hard at its information security arrangements.

Labels: , , , ,

Links to this post:

Create a Link

Wednesday, January 23, 2008

Do I look that stupid?

Look what just plopped into my inbox ...

Subject: Capital Investment and Management Request

Dear Friend,

I am a freelance, independent investment broker based here in Britain.

My client wishes to invest a part of his financial estate into productive ventures in your country under your direct supervision.

He looks to make this investment discreetly under discretionary asset Management arrangement, in the areas of agriculture, real estate, transport, oil and gas and other viable venture(s) which you might recommend. I have contacted you on the consideration that I could discuss with you on the possibility of my client placing this fund with you for management either in your existing establishment or other venture to be undertaken at your discretion under terms to be agreed upon. He Prefers that this investment be made in your country.

I would be expecting your response in order that we may discuss further in detail.

Please write through my email address so that we may work out modalities.

Yours faithfully,

Mr. William Smith


"Mr. William Smith" is clearly a pseudonym: no-one loves that word "modalities" quite as much as those kinky West African 419ers. What is it with "modalities"? Is it one of the standard English words taught in West African high schools? Or is it just a meme? I'll have to ask my Nigerian colleagues ...

Meanwhile, I reported the email to abuse@google.com with the original header and got a useful auto-reply:
Hello,

Thank you for your report. Your email has been provided to the Gmail Abuse team.

To help us process your request as quickly as possible, we recommend visiting the Gmail Privacy & Security topic at
https://mail.google.com/support/bin/topic.py?topic=12784

WHAT HAPPENS WHEN YOU REPORT ABUSE?

Your email has been provided to the Gmail Abuse team. Any additional information that you provide through the forms in the Gmail Security Center will be added to your original message, and will help us to more efficiently process your request.

Google takes abuse situations very seriously -- your claim will be given the highest priority. When submitting a claim through our Security Center, please include as much information as possible, so that the Gmail Abuse team can investigate thoroughly and work quickly to resolve your claim. As appropriate, we may warn users or discontinue Gmail service for the
account(s) in question. For privacy and security reasons, we may not reveal the final outcome of an abuse case to the person who reported it.
To read the Gmail Terms of Use, please visit http://mail.google.com/gmail/help/terms_of_use.html.

If your issue is not related to abuse, you may want to visit our Help Center at http://mail.google.com/support/, or by clicking 'Help' at the top of any Gmail page within your account.

We appreciate the urgent nature of your message, and thank you for your cooperation.

Sincerely,

The Google Team

Labels: ,

Links to this post:

Create a Link

Wednesday, December 12, 2007

Why HTML email is BAD

Click here for a full size screenshotThe screenshot above is an email spotted today in my spam box. It's a conventional phishing email with a classic call-to-action and a link whose URL takes victims to the phishing site rather than CitiBusiness.
What caught my eye, though, was the hex encoded gibberish at the bottom. I can't be bothered to convert it all to readable characters and probably don't have the skills necessary analyze it and figure out exactly what it's doing but the few unencoded words (api, update, end, exe, create, engine, close, define, revision, tmp, hex, URAW, rev., create, root:, LHY, serv, 22MP., source:, Y1TM, cvs, revision, 60T, 376T:) do rather give the game away: it looks like some sort of attempt to get victims' email software to execute code. My bet is that it exploits a bug in the way HTML emails are handled. Needless to say, my machine is configured to read emails as plaintext. I can live without the fancy text formatting, and malware, thank you very much.

Labels: , ,

Links to this post:

Create a Link

Tuesday, December 11, 2007

Email scams increasingly sophisticated

Two news stories illustrate the increasing sophistication of email security threats.

The New York Times describes the exploitation of someone's Web-based email account to send pleading messages to all their contacts, asking for money. The emails, of course, appear to come from the legitimate owner of the email address and are therefore more likely to be trusted implicitly by at least some of the recipients. This is far from the first time we've heard about hackers taking over webmail systems, eBay IDs and the like. How they acheive the take-over is not usually clear but there are several methods including brute-force guessing of the password, fooling the lame "I've forgotten my password" authentication checks, Trojan keyloggers and more.

Meanwhile, the Wall Street Journal reports on successful spear-phishing attacks against executive managers. The scammers send emails use the person's name and other identifying information (perhaps gathered from social networking sites or elsehere off the Web) to fool them into following dubious links. Their PCs are then infected with malware, typically keylogging Trojans according to the article. Thereafter, everything the exec types in (bank details, passwords, secret documents, whatever) is also available to the scammer. Nasty.

Both stories demonstrate the effectiveness of social engineering methods. We humans naturally trust our friends and acquaintances. Scammers who somehow succeed in appearing to be our friends and acquaintances are taking advantage of that trust.

UPDATE Dec 11th: The "I'm stuck in Nigeria - please send money" email scams evidently work just as well in India too.

Labels: ,

Links to this post:

Create a Link

Friday, October 05, 2007

Nigerian scammers head for the slammer

A major police operation has blown open a Nigerian 419 scam ring and seized thousands of fake cheques, passports and other collateral worth ~US$16m.

"The month-long investigation into the fraud uncovered more than 4,500 forged and fraudulent documents. UK officials are working with agencies in the US, Holland, Spain and Canada to tackle "mass marketing fraud". A handful of people have been arrested in the UK with almost 70 more held overseas."

As usual, the scammers have been exploiting naive victims using social engineering techniques, sometimes using dating websites (where people seem naturally more vulnerable to being spun a lie).

6th October update: Reuters reports:
"An international crackdown on Internet financial scams this year has yielded more than $2.1 billion in seized fake checks and 77 arrests in the Netherlands, Nigeria and Canada, U.S. and other authorities said on Wednesday."

The seized assets appear to have swollen from $16m to $2.1bn in a few days, an alarming rate of inflation.

Labels: ,

Links to this post:

Create a Link

Wednesday, September 19, 2007

Spam experiment on video

Will a can of spam blend? Find out here.

PS No matter how much you want to, don't try this at home.

Labels:

Links to this post:

Create a Link

Tuesday, September 18, 2007

419ers' conference

Such a shame: I missed the opportunity to attend a conference for Nigerian 419 scammers in Nigeria back in 2003. The 3rd Annual Nigerian Email Conference was held at the Abuja Sheraton, famed for its amenities.

Labels:

Links to this post:

Create a Link

eCriminals teaming up for more chaos

Symantec has disclosed some data supporting the widely-held belief that electronic crime is on the up, with eCriminals teaming-up to leverage their skills and information."

More worryingly, said Mr Beer, were signs that different sections of the underground economy were starting to collaborate to improve their chances of catching people out. Hi-tech criminals with information culled from job sites, online games or social networking sites were teaming up with phishing gangs and spammers, said Mr Beer. The end result was well-crafted e-mail campaigns that gained a gloss of credibility by combining several different bits of data.


Narrowly targeted phishing emails ("spear phishing") use information that the victims believe 'must be legitimate' to fool them into opening infected attachments, visit phishing/infected websites etc.

Email users must:

1) Avoid opening executable email attachments that turn up unexpectedly, even those that appear to come from a legitimate source such as someone they know (if they intend to open executable attachments, users should first phone the sender to confirm what was sent);

2) Avoid following URLs provided in emails, and watch out for URLs ;

3) Make sure their antivirus software is maintained constantly up-to-date;

4) Not fiddle with the security configuration of antivirus, personal firewall, email, browser and other software;

5) Take regular off-line backups of all important data, making sure that the data are correctly stored and can in fact be retrieved if (when!) needed;

6) Run anti-phishing utilities such as phisher site warning add-ons for browsers;

7) Most of all, remain alert to email security threats. Be EXTREMELY wary of providing any personal data (names, addresses, passwords, PIN codes, credit card numbers etc.) to a website or form provided by email. Corporate email users should report suspicious events to their IT Help/Service Desk or information security function the sooner the better - it may not be too late to prevent further damage.

Labels: , , ,

Links to this post:

Create a Link

Monday, September 17, 2007

Viagra spam from Pfizer computers

A story in Wired shows that even major corporates are vulnerable to hackers and spammers. At least 138 Pfizer computers have been blacklisted for distributing spam for drugs such as Viagra, a Pfizer product, and Cialis, a competitor's product. The computers have presumably been taken over as 'bots' or 'zombies', remotely controlled by the hackers and used to distribute spam. It is entirely possible that the compromised machines have access to Pfizer's valuable proprietary information. Previous stories about Pfizer employees using peer-to-peer software, for example, indicate the kinds of information security weaknesses that could have led to the infections but, not surprisingly, Pfizer is not saying much about it.

Labels: , ,

Links to this post:

Create a Link

Saturday, September 01, 2007

STBO on email security

A report into email vulnerabilities, 'sponsored' by a handful of email security companies, is available for free until 21st September although one has to register and is supposed to provide one’s email address plus other personal information to obtain it ... to save you the bother and risk that that entails, here are the report's three stunning conclusions:

"Develop comprehensive email security strategies that address both inbound and outbound vulnerabilities; Actively monitor, assess and address email vulnerabilities on an ongoing basis – new threats appear daily; Include email vulnerability assessment in an overall threat analysis, looking at threats across email and the Web as well as across desktops, laptops, servers and networks."


The report demonstrates a circular/specious argument by pointing out the differences between what "best in class" organizations are doing versus the rest. If one takes the trouble to wade through the report to find out how "best in class" organizations are identified, one finds (surprise surprise) that they are those who demonstrate the very practices that are called out. This is like me lining up a bunch of people against a wall by height, then making a big song-and-dance about the fact that the people towards one end of the bunch are 'height advantaged' or 'height challenged' (depending on which end I'm talking about) compared to the rest.

Of course the report is replete with plenty of impressive-looking statistics and graphs which are no doubt being quoted as fact ... by those email security companies who 'sponsored' the study.

Good thing it's free.

[STBO = Statin The Bleedin Obvious]

Labels:

Links to this post:

Create a Link

Email encryption

A short piece at Enterprise IT Planet looks briefly at the technical architecture options for email encryption e.g. endpoint-to-endpoint vs. endpoint-to-email-gateway. Thanks to input from the company behind PGP, the article only mentions PGP but similar principles and concerns apply to other email encryption protocols.

Labels:

Links to this post:

Create a Link

Thursday, August 30, 2007

You've got new mail!

CLICK TO ENLARGE

Labels: ,

Links to this post:

Create a Link

Wednesday, August 29, 2007

Beware free l(a)unches

Skimming through my inbox and spam box today, I've seen a few phisher emails like the following example:

Phisher example

The emails vary slightly in the names of the "beta software" (e.g. Investment Developer, Cooking Helper, Home Reno Planner etc.) and of course the senders and subject lines vary.

They all seem to point to an executable file at a numeric IP address, which is most likely another Trojan dropper.

This looks to me like another generation of the STORM worm.

Labels: ,

Links to this post:

Create a Link

Wednesday, August 22, 2007

Malware spam spewed forth

Click for a larger image
We've received loads of similar malware spams today, all basically the same structure with minor differences and spelling mistakes (see above).

The links vary but we understand that one (at least) attempts to infect visitors' PCs with a downloader Trojan. Good up to date antivirus software should trap it but do not rely on this as your sole control: it is not recognized by all antivirus programs.

A quick search of my spam/deleted box for emails containing the string "account number" reveals a whole bunch of em received so far today.

Senders include
Bartenders Guide
Cat Lovers
Cool Pics
Dog Lovers
Downloader Heaven
Entertaining Pros
Free Web Tools
Fun World
Funny Files
Game Connect
Internet Dating
Job Search Pros
Joke-A-Day
Mobile Fun
MP3 World
Net Gambler
Net-Jokes
Office Antics
Online Gamers
Online Hook-Up
Poker World
Pet World
Resume Hunters
Ringtone World
Web Connects
Web Cooking
Wine Lovers


Subject lines include
Dated confirmation
Internal Support
Internal Verification
Internet Techincal Support [sic]
Login info
Login information
Login Verification
Member Confirm
Member Details
Membership Details
Membership support
New member confirmation
New User Details
New User Letter
New User Support
Registration confirmation
Registration Details
Tech Department
Thank you for joining
User Info
User services
User Verification
Welcome new member


There are other variants in circulation too.

The spams are believed to be the result of a new mutant of the Storm worm that has been very active for weeks. SANS Internet Storm Centre has some technical info on it and there's more on F-Secure's blog.

The usual advice "Don't click on dubious links" applies here. Now might be a good time for your security awareness person to inform your fellow employees in calm, helpful tones about the threat. PLEASE do not add to the problem by circulating wild warning emails with "Please tell everyone you know!" or similar - leave the job to the professionals and the news media. Oh and don't forget to check that your antivirus software is updating itself regularly.

*UPDATE* Download a security awareness 'alert' about this, suitable for circulating to your fellow employees. NoticeBored customers: please contact us for the editable MS Word version.

Labels: , ,

Links to this post:

Create a Link

Wednesday, June 20, 2007

US email searches require a search warrant

A ruling by 6th US Circuit Court of Appeals has confirmed that email users have the same 'reasonable expectation of privacy' as they do in respect of their phone calls. A search warrant is therefore required before the Goverment (or indeed anyone I guess) can legitimately access and search emails stored by Internet Service Providers. Furthermore, I understand the owner of the emails must be notified and given the right to object.

"In considering the factors for a preliminary injunction, the district court reasoned that e-mails held by an ISP were roughly analogous to sealed letters, in which the sender maintains an expectation of privacy. This privacy interest requires that law enforcement officials obtain a warrant, based on a showing of probable cause, as a prerequisite to a search of the e-mails."


But remember folks, IANAL. I have no idea whether this ruling is also relevant to companies accessing employees' emails, for example.

Labels: ,

Links to this post:

Create a Link

Friday, April 20, 2007

The lure of VA Tech

Hot on the tail of the shocking massacre at VA Tech comes news of spammers and probably other scamsters using the incident as a lure for their evil deeds. According to a message on SANS Internet Storm Center today, spammers have sent emails inviting recipients to follow a link for video of the shooting ...

By the way, the SANS ISC makes a good default home page if, like us, you want to keep up with infosec news.

UPDATE: Wired has a piece on this too.

More network security links

Labels: ,

Links to this post:

Create a Link

Tuesday, April 17, 2007

Fortune 1000 companies botnetted

An article in the New York Times on spam and botnets quotes some ballpark figures:
- 11% of the 650 million computers on-line contain botnet code
- 250,00 new systems get botted every day
- 80% of all spam originates from botnets

That little snippet of news came from Support Intelligence, a commercial company that is monitoring the Internet for spam, botnets etc., analyzing the origins and publishing some of the more interesting details in their blog (as well as selling the data to their clients). Many big-name companies are named and shamed, in other words spammers have evidently infitrated major corporate networks, setting up botnets that spew forth spam through the corporate email systems, some of which run mainstream antispam software such as Ironport (perhaps it is configured only to spam-check inbound email?).

More network security links

Labels: ,

Links to this post:

Create a Link

Thursday, April 12, 2007

Anti-spam tips

A little CERT cyber alert on spam has been republished, expanding on the following nuggets of advice:
- Don't give your email address out arbitrarily
- Check privacy policies
- Be aware of options selected by default
- Use filters
- Don't follow links in spam messages
- Disable the automatic downloading of graphics in HTML mail
- Consider opening an additional email account
- Don't spam other people

More email security links

Labels:

Links to this post:

Create a Link

Wednesday, February 21, 2007

New NIST security standards

NIST SP 800-45 Guidelines on Electronic Mail Security advises on the installation, configuration and maintenance of secure email servers and clients. It presents recommendations to secure mail server operating systems and applications, protect mail servers, administer mail servers securely plus advice on protecting individual emails and securing mailbox access. The email security standard is a revised version of the original 2002 standard. Other newly-released NIST standards cover intrusion detection and prevention (SP 800-94), and securing 802.11i wireless networks (SP 800-97).

More email security, web/network security and wireless network security links

Labels: ,

Links to this post:

Create a Link

Friday, January 12, 2007

A Nigerian tragic comedy

I though I'd share the following email, which plopped into my inbox overnight, with you. It's one of the funniest I've seen in ages, a truly tragic comedy:

Mohammed M. Abacha.
NO.16.Queen's Drive Victoria Island,
Lagos-Nigeria.

Dear Friend,
as-Salam-u-'Alaikum!I heartily solicit for your honest/Godly assistance to safe our soul.Following the sudden death of my father General Sani Abacha the late formerNigeria head of state, in August 1998, I have been thrown into a state of utter confusion,frustration and hopelessness by the present civilian administration, I have been subjected to physical and psychological torture by the security agents in the country. As a child that is so must have heard over the media reports and the Internet on the recovery of various huge sums of money deposited by my father (General Sani Abacha) in different security firms abroad, some companies willingly give up their secrets and disclosed our money confidently lodged there or many out right blackmail. In fact the total sum discovered by the Government so far is in the tune of US$700. Million dollars. And they are not relenting to damage my family.

Further info.Website:
http://news.bbc.co.uk/1/hi/world/africa/564586.stm
http://www.dawodu.com/ekwueme1.htm
http://www.afrol.com/articles/13746

I got your contacts through my personal research, and out of desperation decided to reach you. I will give you more information as to this regard as soon as you reply. I repose great confidence in you hence my approach to you due to security network placed on my day affairs I cannot afford to visit the embassy so that is why I decided to contact you and I hope you will not betray my confidence in you. My father deposited the sum of US$350.000.00 million dollars with a security firm in abroad in which I want you to clear at least US$50 million first so that you will use part of the fund to clear the remaining fund and the security deposit company have affiliate collecting centre all over the global. whose name is withheld for now until we open communication. I shall be grateful if you could accept to conclude this transaction and keep this fund for safe keeping. This arrangement is known to you , my mum Zainab and our Attorney alone,so our Attorney will deal directly with you as security is up my whole being.I am seriously considering to settle down abroad in a friendly atmosphere like yours as soon as this fund get into your custody. I will require your telephone and fax numbers so that i can forward them to me to enable you and me to communicate immediately.
Listen carefully, I not in doubt of what my late father did, but I want you to understand that present President (Gen. (Rtd)) Olusegun Obasanjo intentionally dealing with my family based on the political misunderstanding he had with my late father of the past Nigeria is a wealthy country and no Government since 1977 to this day that is not dubious,
President (Gen. (Rtd)) Olusegun basanjo and his family today has syphoned the ecomony (fund) of this nation. I hereby take you back to the history of this nation (Nigeria) from 1977 to this day and you willunderstand my point.
President (Gen. (Rtd)) Olusegun Obasanjo made up his mind to damage my family out of his share wickedness. I am once in Nigeria Government and hereby giving you assurance that Nigerian are corrupt from the top to it's base. Please don't disclose the telephone number to the third part for the good interest of my family and the safety of this business.
Call my direct line +23450408864 or email: allajimohammed_abacha@yahoo.com.au for more info.

Sincerely yours,
Mohammed M. Abacha.

The email header (viewable in Outlook using View > Options > Internet headers) was interesting too. The "From:" address (which may well have been spoofed) was a US-based ISP. The "Reply-to" address was an address at Yahoo in the UK, different to the Australian Yahoo reply address included in the main body of the email. I've notified all three by the way so now the race is on between the processes that will delete the mailboxes, and the scammer's activities to gather personal information from those poor fools who might have fallen for his amusing sob story.

I think I'll print out and laminate this classic 419 email for the office wall. As well as being a useful lesson in security awareness, it's one of a dying breed (/wishful_thinking_mode)

More email security, IT fraud and security awareness links

Labels: , ,

Links to this post:

Create a Link

Monday, January 08, 2007

Charity phishing lure

Many of us will have seen the emails circulated just after hurricane Katrina struck, inviting us to visit a number of dubious websites to "donate" to the disaster fund. Well here's something similarly sinister that just landed in my inbox:


---------- Email received -----------

You have a personal invitation to join S.O.S. Children's Villages donation program.

Today there are over 143 million children orphaned worldwide. S.O.S. Children's Villages is working hard to provide homes for these children, protecting them from abuse and exploitation, and giving them a place to call home...

Help us to help children in need. Any contribution you are able to make helps make a difference in the lives of children, giving them a new, loving home, a proper education, and health-care - in short, giving them the chances in life they deserve.

S.O.S. Children's Villages' work is built upon the generosity of our donors all over the world and all contributions, large or small, regular or occasional, go towards helping us make a difference to children's lives. What better way to secure the future of our world than supporting the world's children?

Give the Gift of Hope - Make a Donation to Help Orphaned Children! <- There was a dotted-decimal URL here>

Our online donation form is a fast, convenient and secure way for your online donation. When making your online donation, you can either specify a continent where you would like your contribution to go, one of our featured projects, or decide to help where you money is needed most.



Thank you for wanting to contribute to give children a new home and a family.


Sincerely,
S.O.S. Children's Villages International.

---------- End of email -----------


I believe S.O.S. Children's Villages is a legitimate global charity based in Austria. However, the URL embedded in the email was a numeric dotted-decimal URL that is registered to an ISP in Japan - it is most likely a compromised system being used by fraudsters, not a genuine charity server. The (probably spoofed) sender's email address belongs to a domain registered by an Indian biometrics/security company (nice touch!) that is not currently in use. I discovered these facts simply with a bit of digging on Google, Wikipedia and using the handy IP/domain lookup WHOIS function provided by DNSstuff. I also did a quick search on the wonderful HoaxBusters site but this particular type of scam isn't listed.

By the way, this was an HTML email. Outlook normally hides the actual URL under the link text, in this case the line "Give the Gift of Hope...". If you hover the cursor over the link, a 'tooltip' appears, showing the true URL (this works in Mac Mail too, I believe). I have my Outlook set to display all emails as plain text by default (Tools > Options > Preferences > E-mail Options > Check the option to "Read all standard mail as plain text") which means it displays all URLs in angle brackets. Sure, I sometimes need to click the option to "Display as HTML" emails from people I trust but on balance, I prefer to check the true URLs of links I might be following.

I've taken the precaution of removing the embedded URL from the email above just in case it installs a Trojan on your machine. Needless to say, I will not be visiting it on this occasion.

This kind of social engineering attack using a charity as a lure is particularly nasty as it plays on the goodwill and naivite of ordinary people like you and me. I hope this topical little example, or something similar from your own inbox, finds its way onto the security awareness pages on your corporate intranet as a warning to your colleagues. Tell your family and friends too. I'm sure it will not be the last one we see.

More links on phishing and security awareness.

PS I have notified the charity, the ISP, the biometrics company and HoaxBusters, offered my help and directed them to the excellent Anti-phishing Working Group for professional assistance

PPS The charity's Internet Manager has indeed confirmed this is a fake that started circulating last Friday. Anyone who wants to donate is invited to visit www.sos-usa.org.

Labels: , , , ,

Links to this post:

Create a Link

Monday, December 25, 2006

Congressional aide socially engineered

A congressional aide has admitted asking two jokers at Attrition.org to hack into his college's network and adjust his college grades. The jokers (who he evidently believed to be l33t hax0rs, except that he would have not the foggiest idea what those words mean) led him into believing they would do what he wanted, and in the course of the incident, got him to reveal his Social Security Number and other personal information to make their hacking job easier. The email exchange is very amusing: the victim had no clue that he was being taken for a ride, even providing photographs of a [secret] squirrel at one point to validate his location. Be sure to read the news piece on Network World that revealed the victim's details and printed his admission and apology for making a big mistake ... and led to him being fired ... but his 15 minutes of fame now include a Wikipedia entry.

More social engineering, hacking and accountability resources

Labels: , , , , ,

Links to this post:

Create a Link

Friday, December 15, 2006

Spear phishing case study

In Spam that delivers a pink slip, Computerworld presents a case study on an organization whose staff received spear phishing emails. "Last week, a handful of employees at Dekalb Medical Center in Decatur, Ga., received e-mails saying they were being laid off. The subject line read "Urgent - employment issue," and the sender listed on the message was at dekalb.org, which is the domain the medical center uses. The e-mail contained a link to a Web site that claimed to offer career-counseling information. And so a few employees, concerned about their employment status and no doubt miffed about being laid off via e-mail, clicked on the link to learn more and unwittingly downloaded a keylogger program that was lurking at the site." The article seems a little confused about the distinction between spammers and fraudsters but is basically sound. Other local hospitals were reportedly targeted so it is possible that this was in fact simply an ordinary spam, but the potential for delivery of keyloggers, rootkits and other malware is plain to see.
More malware, email and social engineering links

Labels: , ,

Links to this post:

Create a Link

Sunday, December 10, 2006

You've got infected mail!

Attackers are actively exploiting an MS Word zero-day vulnerability by tricking users into opening malicious Word files using a form of social engineering. Infected files may arrive as email attachments from people you know and trust, as well as from those you’ve never heard of. It’s not yet clear whether Microsoft will release a patch on Tuesday: if not the fix may slip to January unless M$ releases an interim emergency patch. It all depends on the quality of their coding and the speed of their QA and release processes. Meanwhile take extra care with email attachments, even from friends and colleagues, and make sure your antivirus software is bang up to date. We'll be releasing an updated malware module early in the new year and a new module on application security shortly afterwards: don't let your organization become a statistic or case study!
More social engineering, incident management, bugs!, secure software development and malware links

Labels: , , , ,

Links to this post:

Create a Link

Friday, December 08, 2006

419 scam nets $200k

If you're not a regular reader of the Manawatu Standard, you might have missed a sad story about a 71-year old New Zealand lady and her son having been taken in by 419 scammers to the tune of over $200,000 to date. Even with advice from the New Zealand police, still they play along. "The pair are trusting who they believe to be the Central Bank of Nigeria to 'investigate' the fraudulent email scam and have paid a further $10,000 for the privilege." Psychologists probably have a term for the situation the pair are in. Over the course of 18 months, they have fallen for the scam hook, line and sinker to the point that they barely even acknowledge the possibility of fraud that is as clear as day to most of us looking on. They forlornly hope that the last payment to the 'investigator's will bring a resolution, and if it doesn't, their natural inclination is to pay again, whether it's 'court fees' or 'late payment charges' or whatever.

More links on IT fraud and social engineering

Labels: , ,

Links to this post:

Create a Link

Wednesday, November 29, 2006

CERT podcasts

Thanks to a tip-off from Gideon Rasmussen on the insider threat email reflector, I've come across a series of information security podcasts by CERT, aimed at 'business leaders'. The podcast on security Return On Investment (ROI) contains an interesting comment relating to research by "a couple of economists at the University of Maryland named Lawrence Gordon and Martin Loeb" who are said to have determined that a security control investment should only go ahead if the cost is no more than 37% of the expected return. I find this a very curious statement: from a purely economic point of view, almost any net positive return is financially worthwhile provided that (a) there is sufficient funding available for the investment (i.e. it is not outranked by other higher return investments) and (b) the projected costs and returns are realistic ... which is perhaps the issue here. Security projects in the main create returns by reducing risks and hence reducing projected future losses compared to the do-nothing option. The economists seem to be saying the security and risk professionals are seriously overestimating projected savings. They may have a point.
More security awareness and risk management resources

Labels: , , ,

Links to this post:

Create a Link

Saturday, November 25, 2006

Scambaiter interview

This Way Up on National Radio in New Zealand interviewed Mike Berry, a famous scambaiter, about his activities. Mike clearly has a lot of fun baiting the 419 scammers through his 419eater.com website, even getting one to send impressive wooden sculptures of Creature Comforts characters and a Commodore 64 computer ... but there's a serious undercurrent to the story. Estimates vary but thousands of dollars are thought to be lost to 419ers every day. Thousands of New Zealanders and millions of Americans fall prey every year, getting drawn-in like obsessive gambling addicts convinced that the next payment will secure the promised windfall. Mike has received death threats. Later in the podcast, Liz McPherson of the NZ Ministry of Consumer Affairs warns the public about falling for the scams and promotes the NZ Ministry of Economic Development's consumer affairs scamwatch website.

More email security, IT fraud and social engineering resources

Labels: , ,

Links to this post:

Create a Link

Tuesday, November 21, 2006

SANS (finally) recognizes the human factor

The latest SANS Top 20 hotlist of information security vulnerabilities at last includes "humans" on the list of horrors alongside the usual range of Windows, UNIX and other technical security weaknesses. SANS specifically identifies the vulnerability to 'spear phishing' (i.e. highly targeted phishing/spoof email attacks), which is of course just one of a very large class of potential vulnerabilities. According to a recent article in Infoworld, SANS' Allan Paller feels that, in the face of ever increasing security threats (agreed), technical information security is improving (possibly true) whilst human being remain as weak as ever (hopefully not for NoticeBored customers!). Some of us have been saying that for years, and rather than simply 'blaming' users for being naive, a few of us are even doing something about it ...
More security awareness resources

Labels: ,

Links to this post:

Create a Link

Friday, November 17, 2006

419 baiters' flash mob this weekend


Some people clearly take the 'sport' of scam-baiting (i.e. retaliating against the 419 advance fee fraudsters) very seriously. A flash mob taking place this weekend is an opportunity to learn about 419ers and the techniques for taking their fake banking and lotter scam sites offline. The Artists Against 419 website is one of many scambaiter sites combining education with ironic humor.

More IT fraud links

Labels: ,

Links to this post:

Create a Link

Thursday, September 28, 2006

Being born yesterday

Hackers are so desperate to exploit vulnerabilities such as the VML bug, they are becoming quite incoherent in their excitement. Here's the text of an email I just received:

Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).


Using the new bug in the Windows, these viruses infect the computer unnoticeably.
After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail
addresses

Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service


Needless to say, I didn't open the attachment (which had already been quarantined by the antivirus software, in any case). Phew, that was a close one!
More Bugs! and malware links

Labels: , , , ,

Links to this post:

Create a Link

Wednesday, September 06, 2006

NIST guide to email security

A new draft Special Publication from NIST addresses email security. SP 800-45A has the depth and breadth we have come to expect from NIST with over 140 pages covering security breaches such as the following examples:
- Since exchanging email with the outside world is a requirement for most organizations, email is allowed through their network perimeter defenses. Because of this, attackers are increasingly using email as a vector for their attacks. At a basic level, viruses and other types of malware may be distributed throughout an organization via email. Increasingly, however, attackers are getting more sophisticated and are using email to deliver targeted zero-day attacks to users in an attempt to compromise their workstations. If successful, the attackers will then have an attack platform within the organization’s internal network.
- Given email’s nature of human to human communication, it can be used as a social engineering vehicle. Email can allow an attacker to exploit an organization’s users to gather information or get the users to perform actions that further an attack.
- Flaws in the mail server application may be used as the means of compromising the underlying server and hence the attached network. Examples of this unauthorized access include gaining access to files or folders that were not meant to be publicly accessible, and being able to execute commands and/or install software on the mail server.
- Denial of service (DoS) attacks may be directed to the mail server or its support network infrastructure, denying or hindering valid users from using the mail server.
- Sensitive information on the mail server may be read by unauthorized individuals or changed in an unauthorized manner.
- Sensitive information transmitted unencrypted between mail server and client may be intercepted. All popular email communication standards default to sending usernames, passwords, and email messages unencrypted.
- Information within email messages may be altered at some point between the sender and recipient.
- Malicious entities may gain unauthorized access to resources elsewhere in the organization’s network via a successful attack on the mail server. For example, once the mail server is compromised, an attacker could retrieve users’ passwords, which may grant the attacker access to other hosts on the organization’s network.
- Malicious entities may attack external organizations from a successful attack on a mail server host.
- Misconfiguration may allow malicious entities to use the organization’s mail server to send email-based advertisements (i.e., spam).
- Users may send inappropriate, proprietary, or other sensitive information via email. This could expose the organization to legal action.
Comments on the draft are welcome before October 6th.
More email security resources

Labels: ,

Links to this post:

Create a Link

Wednesday, July 12, 2006

6 Notes security bugs

A clutch of six critical security vulnerabilities in IBM Lotus Notes reminds us that Microsoft is not the only company producing buggy software with security holes that need patching.
More email security resources

Labels:

Links to this post:

Create a Link

Wednesday, June 21, 2006

The reality of identity theft

To Catch a Thief is a blogger's story about how her identity was stolen and abused by criminals a year ago. There follows a harrowing and involved tale of the steps taken to investigate, report and stop the abuse. The victim hardly mentions the anguish the incident caused but it's not hard to imagine being in exactly the same position. Right up front she mentions having sent her credit card number by email (doh!) and when she paid for some shoes in a shop, the shop assistant curiously went behind the scenes with her card ... innocuous acts to someone who isn't security aware. [Whilst you are clearly security aware because you are reading this blog, I'd encourage you to read the story and pass-it-on to your less aware friends and relatives].
More IT fraud resources

Labels: , , ,

Links to this post:

Create a Link

Sunday, June 11, 2006

Insider security

The Definitive Guide to Security Inside the Perimeter is a "free" 200+ page eBook by Rebecca Herold (free except that you need to provide an email address and other information to the publisher and sponsor). It explains the security risks arising from insiders working within the organization, and outlines a broad range of controls. Security awareness and training are mentioned frequently, as you might expect.
More security awareness resources

Labels: , ,

Links to this post:

Create a Link

Tuesday, June 06, 2006

Information gushes forth

A Proofpoint/Forrester survey on outbound email content scanning found that around a third of the 400+ US and UK 1,000+ employee companies surveyed have been impacted by the exposure of sensitive or embarrassing information in the last 12 months. More than a third! They estimate that around one in five outbound emails contains sensitive information that poses a legal, financial or regulatory risk. Given that not all organizations scan outbound email content, the true figures seem likely to be even higher. About half of email that should be encrypted is encrypted. [The fact that Proofpoint sells email security solutions may put a question mark over the validity of the survey although it was conducted on their behalf by Forrester Research.]
More email security links

Labels: ,

Links to this post:

Create a Link

Spammer hammered

The Chicago Tribune is reporting a $1m settlement of two civil lawsuits by a notorious Texan spammer. Note to spam king: You got nailed outlines the spammer's unethical business practices and his apparent reformation (he is now trying to sell anti-spam consultancy ...). Would you employ a former cracker in your information security department? How about employing former bank robbers to advise on bank security? Or former pedophiles as school teachers?
More email security resources

Labels:

Links to this post:

Create a Link

Monday, June 05, 2006

Encrypted email - too hard?

Special delivery - secure email is a presentation by Fred Avolio of BAESYSTEMS about encrypted email, from a conference a year ago. It outlines the process of symmetric and asymmetric encryption used for secure message and key exchange, respectively, and briefly mentions the main options available for secure email. The big question remains: why do so few people use email encryption? Is it just ‘too hard’? Hushmail is one easy option - it's an encrypted webmail system. Just point and click!
More email security resources

Labels:

Links to this post:

Create a Link

Sunday, June 04, 2006

Okopipi anti-spam project

Blue Frog beget Black Frog beget The Okopipi Project, an open source project to implement FrogNet, a peer-to-peer version of Blue Security's Blue Frog anti-spam response. The Okopipi wiki (tagline: "United they spam, divided they fall") explains what's going on.
More email security links

Labels:

Links to this post:

Create a Link

Friday, June 02, 2006

Email Security School

Back in March 2005, SearchSecurity.com released a 3-lesson Email Security School on email security. Each lesson consists of a webcast presentation by an email security guru, a technical paper and a quiz to check your comprehension.
More email security links

Labels:

Links to this post:

Create a Link

Blue Frog RIP Long live Black Frog

Google's growing collection of news items on the Black Frog project seem to indicate that Blue Frog's demise will not be in vain. A small community of designers and developers is working hard on the next incarnation of the anti-spam frog. As I indicated before, Blue Frog may have lost the battle but the war on spam continues.
More email security links

Labels:

Links to this post:

Create a Link

Email security awareness


June's NoticeBored security awareness module covers email security, one of our "core topics" that practically all security awareness programs are bound to cover. We look beyond the obvious issues such as spam, malware and phishing to aspects such as libel, harrassment and unauthorized contracts.
Email security links

Labels: , ,

Links to this post:

Create a Link

Friday, May 19, 2006

SpamMotel

An interesting development of the idea to set up email redirections to mask your real email address comes from SpamMotel. When you set up a new email address, you can enter notes. Emails received at that address automatically have the notes prepended before being forwarded to your real email address. That way, it's simple to record when and why you set up the email address and who you gave it to, so if it gets spammed you know who to blame.
More email security resources

Labels:

Links to this post:

Create a Link

Thursday, May 18, 2006

Blue Frog in the blender

Having interviewed the CEO of Blue Security, Wired is reporting that the anti-spam initiative is shutting up shop in the face of an onslaught of spam and Denial of Service attacks affecting Blue Security's clients and Internet Service Providers as well as the company itself. Although this brings the David and Goliath battle to a sad end, the war against spammers continues. Further concerted action by ISPs and legislative action seems likely. Meanwhile, the spam filtering industry is doing a roaring trade.

Previous blog entry

Labels:

Links to this post:

Create a Link

Sunday, May 07, 2006

Blue Security struggle continues

The Blue Security spam war rages on. An update on the Blue Security website identifies the spammer responsible (he is evidently taunting Blue Security using ICQ) and outlines the methods used to attack Blue Security and its user community. Despite my dire prediction of May 2nd, the Israelis behind Blue Security are valiantly defending their systems against the onslaught and Blue Frog users are evidently hanging in there. Meanwhile, the spammers have taken to spewing out even more spam using Blue Frog users' email addresses as the forged senders' names causing collateral damage in the process. All in all, an ugly situation.
More anti-spam resources

Labels:

Links to this post:

Create a Link

Wednesday, May 03, 2006

BlueSecurity back on air

The Blue Security story has set tongues wagging on Slashdot. There seems to be a consensus vitriolic loathing of the spammers, as one might expect, but mixed feelings about the value of spamming-the-spammers. Details about the incident itself though are rather sparse at present, although BlueSecurity is defiantly back on the air as I write this, and blogging hard about continuing the fight. They are showing true grit and getting wide support so the fight is far from over yet.

Labels:

Links to this post:

Create a Link

Tuesday, May 02, 2006

Toast the Blue Frog

Further to our blog entry of April 10th, we received the following spam today:
Hey, You are recieving this email because you are a member of BlueSecurity (http://www.bluesecurity.com). You signed up because you were expecting to recieve a lesser amount of spam, unfortunately, due to the tactics used by BlueSecurity, you will end up recieving this message, or other nonsensical spams 20-40 times more than you would normally. How do you make it stop? Simple, in 48 hours, and every 48 hours thereafter, we will run our current list of BlueSecurity subscribers through BlueSecurity's database, if you arent there.. you wont get this again. We have devised a method to retrieve your address from their database, so by signing up and remaining a BlueSecurity user not only are you opening yourself up for this, you are also potentially verifying your email address through them to even more spammers, and will end up getting up even more spam as an end-result. By signing up for bluesecurity, you are doing the exact opposite of what you want, so delete your account, and you will stop recieving this. Why are we doing this? Its simple, we dont want to, but BlueSecurity is forcing us. We would much rather not waste our resources and send you these useless mails. Its simple, we dont want to, but BlueSecurity is forcing us. We would much rather not waste our resources and send you these useless mails, but do not believe for one second that we will stop this tirade of emails if you choose to stay with BlueSecurity. Just remember one thing when you read this, we didnt do this to you, BlueSecurity did. If BlueSecurity decides to play fair, we will do the same. Just remove yourself from BlueSecurity, and make it easier on you. Sergio Sheldon

Regardless of the veracity of the spammer's claim, regardless of the mechanism of the (alleged) compromise, I for one am not willing to take the risk. Blue Security is toast. Bye bye blue frog.

Labels: , ,

Links to this post:

Create a Link

Monday, April 10, 2006

Blue Security

*** UPDATE: Please see our May 2nd blog entry ***

A considered and thought-provoking paper from Marcus Ranum reviews the spam response system from Blue Security. The system combines the advantages of a widespread user base monitoring their inboxes for spam (which guards against malicious or inept spam reporting), with automated responses that aim to flood spammers with complaints (in effect, a denial of service attack but with self-imposed ethical limits i.e. one response per complainant). A further key feature is the manual intervention before the multi-barrel bit-guns are unleashed: the Blue Security team contacts the relevant domain admins/users to ask for an explanation, and gives them an opportunity to respond. If the spammer machine is in fact a zombie that has been compromised by a hacker and used by a spammer without the legitimate owner even being aware of the issue, the contact gives them the chance to take their machine off the web and clean it up.

Spammers are cordially invited to cleanse their mailing lists of Blue Security registrants, which unfortunately implies that other email addresses are fair game. The system designers have paid attention to the potential security implications of allowing spammers access to opt-out mailing lists, and use cryptographic techniques to obfuscate the list. However, personally, I would question the need for this function, and hence the associated residual risk, at all. Those spam recipients who do not actively opt-out are clearly disadvantaged. The merest hint of a business model starts to rear its ugly head at this point.

Active response is generally frowned-upon by the professional information security community in principle but it sounds to me as if Blue Security may have invented a workable and ethical scheme.
More email security resources

Labels: ,

Links to this post:

Create a Link

Saturday, April 08, 2006

Fighting the spamalanche

Abuse is an open source program to respond automatically to spam messages, automatically composing responses to go to the abuse addresses listed for the IPs of the sending machines. As the senders are commonly compromised zombie PCs, informing the owners and getting the machines cleaned up helps fight the avalanche of spam, and has other security advantages.
More email security links

Labels:

Links to this post:

Create a Link

Monday, March 06, 2006

Keeping Up with the Phishers

Phishing has been described in several NoticeBored modules. It is still hot news. Spear phishing - the targeting of specific individuals such as executives of a particular organization using hand-crafted email lures - remains a serious threat. Read Keeping Up with the Phishers for an excellent description of the problem.
More malware and authentication resources

Labels: , , ,

Links to this post:

Create a Link

Wednesday, February 08, 2006

Reporting spam

If you receive spam, you can do something positive about it other than clicking the ‘Please unsubscribe me’ or similar links (which in some cases merely confirm your email address to the spammers). Report it to the spam reporting websites such as SpamCop and Abuse.net (the latter has a lot of helpful information about spam) or forward it with the original header to your authorities such as the U.S. Federal Trade Commission (spam@uce.gov). But please be responsible in this: only report spam if you are certain it is truly spam i.e. there is no possibility that you requested it. Our NoticeBored newsletters are only sent to our customers and to others who have double-opted-in to our newsletter mailing list. We never send spam - in fact, we are actively fighting spam. We really detest spam. Yet some people who sign up for the newsletter find it is being blocked by spam filters somewhere upstream of their inbox. That happens, presumably, because other users who use the Topica email system have sent spam and have been reported as such, meaning that our emails unfortunately get tarred with the same brush. We would be extremely disappointed if anyone reported our newsletter as spam.
More email security resources

Labels:

Links to this post:

Create a Link

Friday, February 03, 2006

F-Secure phished

Finnish antivirus vendor F-Secure has published an advisory about fake emails sent out in its name that contain malware. The emails contain the line: "I have enclosed a screen capture of the problem so your team can get it fixed if you deem it an issue." The attachment (presumably) contains not a screenshot but a new variant of the Breplibot worm. This is essentially the same phishing technique often used to send keylogging Trojans to bank customers. The email uses social engineering techniques to fool recipients into doing something silly, in this case opening the attachment.
More malware, social engineering and authentication links

Labels: , , , ,

Links to this post:

Create a Link

Monday, January 30, 2006

Microsoft phished?

The above go.microsoft.com link in a Microsoft Partner Programme email redirects to a Security Assessment Tool hosted at www.SecurityGuidance.com. The domain looked a bit odd to me so I checked on whois the domain registration details. The domain belongs not to Microsoft but Ziff-Davis ... which seems rather odd for a Microsoft branded page and a Microsoft security tool. The 'tool' itself appears to consist of a questionnaire about visitors' security arrangements, exactly the kind of information someone with malicious intent might want. The FAQ on the site notes that Microsoft has a relationship with Ziff-Davis, but why should I trust the information on a dubious website? My advice FWIW - steer clear.
More security awareness links

Labels: ,

Links to this post:

Create a Link

Wednesday, September 21, 2005

Self-phishing for educational purposes

Several organizations have started using (simulated) phishing attacks against their own employees as a security awareness activity. The New York State Office of Cyber Security and Critical Infrastructure Coordination, for example, sent staff an internal email asking them to enter their passwords into a ‘password checker’. 17% of their 10,000 users succumbed and were given additional education. When the exercise was repeated a month later, the phishing email phooled just 7% who were presumably given stronger, more explicit advice and encouragement by management regarding their future career prospects.
More authentication resources

Labels: , , , ,

Links to this post:

Create a Link

Thursday, September 01, 2005

Fraudulent charity requests

Even as the flood waters are still rising in New Orleans, the American Red Cross has already spotted at least one fraudulent email and website soliciting donations for victims of hurricane Katrina. Phishers and fraudsters evidently have no qualms about preying on the kind to siphon off funds for the needy. Report any Red Cross emails that do not refer to www.redcross.org to the Red Cross CISO (infosec@usa.redcross.org).
More IT fraud resources

Labels: ,

Links to this post:

Create a Link

Tuesday, August 09, 2005

Going on holiday? Think security!

Out of Office (OoO) automatic replies to incoming emails are a menace to mailing lists and can cause security issues, primarily disclosure of sensitive information. It is quite common for those going on vacation or traveling on business to want to tell other people that they are not around to respond to inbound emails, and it is quite easy for end users to configure OoO replies themselves. Unfortunately, OoO information is of interest to spammers and social engineers as well as legitimate email correspondents. ‘As I will be away from the office from date1 to date2, please address your queries to XXX@company.com or phone (123) 456 789. John Doe, Security Manager’, for example, gives away quite a lot of useful information unnecessarily. Advice on how to configure email systems for OoO replies is given in this IETF draft proposal (an incomplete work-in-progress but well worth a read). As so often in information security, the technical controls should be complemented by suitable policies, procedures and awareness of this issue.
More email security resources

Labels: ,

Links to this post:

Create a Link

Friday, July 29, 2005

Email disclaimers

We've all read those pseudo-legal statements at the end of most corporate emails but do they carry any weight? Stupid Email Disclaimers takes a look at the issue and makes some interesting points for discussion with your corporate counsel.
More email security resources

Labels:

Links to this post:

Create a Link

Wednesday, July 20, 2005

Hoax-Slayer

The free Hoax-Slayer Newsletter explains email scams, Internet frauds and other such nasties to the general public. A nice easy way to keep up with things.
Other IT fraud resources

Labels: ,

Links to this post:

Create a Link

Tuesday, July 05, 2005

PayPal phishers get more creative

PayPal has settled a class-action claim, the claims period for which expired in October 2004. According to the claims administrator, phisher emails are circulating that cite the original case and direct victims towards a false claims site where, as usual, they seek to obtain their personal information.
More email links here

Labels: ,

Links to this post:

Create a Link

Tuesday, June 28, 2005

Targeted attacks pose new security challenge

Computerworld reports that "'We're clearly seeing a trend away from broadcast attacks to much more targeted and much more sophisticated types of attacks,' said Andreas Wuchner-Bruhl, head of global IT security at Novartis Pharma AG, a drug maker in Basel, Switzerland. 'Dealing with it is much tougher.' That's because 'the cons in the attacks are so much better customized' for the specific companies they target, said Lloyd Hession, chief information security officer at BT Radianz, a New York-based provider of telecommunications services to the financial industry. 'The chances of them being successful are much higher' than in large-scale attacks, he said." The potential for malware attacks targeting specific companies, or even individuals, looks clear to us, and we're not just talking about phishing/pharming type attacks. We can forsee worms, for instance, that are slow spreading, benign and cryptic (thereby largely evading the interest of the antivirus community) unless/until they find themselves inside the target organization whereupon they spring to life with devastating concequences. A senior manager at antivirus supplier Sophos with whom we discussed this very point three months ago did not see this as a serious threat but we beg to differ.
More email and malware resources

Labels: ,

Links to this post:

Create a Link

Friday, June 24, 2005

Implement Sender ID or be labelled a spammer by Microsoft

Cnet News is reporting that Microsoft intends to mark all emails not carrying the Sender ID tag as spam on entry to the Hotmail and MSN networks. The fact that Microsoft remains the main supporter of Sender ID, and that an IETF working group on it was dissolved last September due to their inability to agree on the details, means that those of us not using Sender ID need not be unduly worried at this point ...
More email security links

Labels:

Links to this post:

Create a Link

Tuesday, June 21, 2005

Email exam misery shared

USATODAY.com reports that 119 University of Kansas students who failed classes last semester inadvertently found out who shared their misfortune. The email informing them was sent "To:" all 119 students so all recipients could see who else received the email - if it had been "BCC'd" (Blind Carbon Copied) instead, the recipients might have remained anonymous.
More email security links

Labels:

Links to this post:

Create a Link

Friday, June 17, 2005

UK agency warns about emails bearing gifts

"Employees are tricked into installing the malicious programs by cleverly-crafted e-mails loaded with infected documents. In some cases, the attackers download publicly-available documents off the Internet, load the documents with the Trojan horse, then e-mail them to carefully-selected employees who would be likely to open such a file. To make the notes even more realistic, the e-mail appears to come from a co-worker." So says the UK's NISCC (National Infrastructure Security Coordination Centre - home of the UK WARPs) in a generic public warning.
More email security and malware links.

Labels: ,

Links to this post:

Create a Link

Wednesday, June 15, 2005

A clutch of Microsoft patches

Hurray! It's patch Tuesday! Microsoft has released patches for a clutch of security issues including one affecting Outlook Web Access and another affecting Outlook Express. It's important to keep up with security patches to minimize the risk of compromise by worms or hackers attacks. If you/your organization uses OWA or Outlook Express, or indeed other vulnerable software that has just been patched, you may only have hours or days before exploits begin causing problems. Act now to prevent breaches.
More email security links

Labels: ,

Links to this post:

Create a Link

Tuesday, June 14, 2005

Phishing antidote

In "Man Bites Phish", Robert Cringely suggests a novel approach to the phishing problem: visit the phisher sites and enter realistic-loooking but inaccurate junk information. The idea is that the phishers will give up trying to separate the wheat from the chaff if enough people send them junk data. Given their motivation to steal money, the phishers may not be too bothered but the problem is that there are few other effective approaches against phishing.
More email security links

Labels: , ,

Links to this post:

Create a Link

Thursday, June 09, 2005

Phishing for domain registration info

As well as phishing directly for personal information such as bank account details, credit card numbers etc., it appears that phishers are also trying to fool domain owners into relinquishing control of their domains, potentially in order to redirect legitimate traffic through the phishers' systems. CIRA, registrar for the .ca domains, released this news bulletin on June 8th.
More email security and IT fraud links

Labels: , ,

Links to this post:

Create a Link

Tuesday, June 07, 2005

Bin Laden email Trojan

According to CNET News and The Register, a Trojan attached to an email promising pictures of the capture of Bin Laden has been contained, presumably by effective antivirus software.
More malware links and email security links

Labels: ,

Links to this post:

Create a Link

Thursday, June 02, 2005

Nigeria overwhelmed with spam

A new OECD report into the spam problem notes that developing nations lack the resources to cope with spam. Whereas the costs of spam filters, wasted bandwith and wasted disk space are not a significant issue for organizations in the developed world, places like Nigeria are being overwhelmed. [Given the volume of 419 scams still originating in that part of the world, some might call this peotic justice ... but spam is an indiscriminate problem and does not just affect the fraudsters].
More email security links

Labels:

Links to this post:

Create a Link

Wednesday, June 01, 2005

Email security awareness

We have just released the latest NoticeBored Classic security awareness module on email security. Email security is one of our core awareness topics - almost everyone in business these days uses email and should be aware of the security risks they face. Our core modules are updated and re-released every year.
Click here for our email security links collection

Labels: ,

Links to this post:

Create a Link

Thursday, May 26, 2005

CERT vulnerability bulletins

US CERT issues a handy email update of vulnerabilities announced in the previous week. They mention patches, workarounds and other actions to help mitigate risk.
More infosec risk management resources

Labels: , ,

Links to this post:

Create a Link

Thursday, April 28, 2005

Benefits and risks of free email services

US-CERT Cyber Security Tip ST05-009 outlines the pros and cons of free web-based email accounts such as Yahoo, Hotmail and gmail. Three primary risks are identified: "security" (meaning confidentiality through SSL), privacy (confidentiality of personal and commercial information) and reliability (service availability).
More email security resources

Labels: , , ,

Links to this post:

Create a Link

Saturday, April 09, 2005

Virginia spammer gets nine years

Jeremy Jaynes is apparently the first person in the US to get a prison term for spamming. Seems the authorities are getting tougher on spammers. 'Bout time.
More email security resources

Labels:

Links to this post:

Create a Link

Tuesday, March 29, 2005

Blogging guidelines

Blogs like the one you are reading are great for free speech and personal expression, but are not necessarily in keeping with corporate security, marketing and legal requirements. The link above, itself a blog entry, points to a number of blogging guidelines published on the web. These should prove useful if you are considering your own corporate policy in this area. [NoticeBored's May module on email security will provide further guidance].
More email security links here

Labels:

Links to this post:

Create a Link

Wednesday, March 09, 2005

Anti-phishing Act of 2005

Senator Patrick Leahy has (re-)introduced his Anti-Phishing Act to the U.S. Senate. The act outlaws phishing (emails that mislead victims into visiting fake websites) and pharming (attacks that redirect visitors' attempted connections to a legitimate website, sending them to a fake website). "The Anti-Phishing Act of 2005 would enter two new crimes into the U.S. Code. The first prohibits the creation or procurement of a website that represents itself to be that of a legitimate business, and that attempts to induce the victim to divulge personal information, with the intent to commit a crime of fraud or identity theft. The second prohibits the creation or procurement of an email that represents itself to be that of a legitimate business, and that attempts to induce the victim to divulge personal information, with the intent to commit a crime of fraud or identity theft."
More malware links here and more IT fraud links here

Labels: , ,

Links to this post:

Create a Link

Sunday, February 27, 2005

Great website for vulnerabilities and threats

A recent Secunia alert warns about the Bropia.M worm that is spreading a Trojan inside a PIF carrier file using MSN Messager i.e. an example of a blended threat. Secunia’s website carries a vast amount of news on newly discovered information security threats and vulnerabilities and is well worth an occasional browse, if not signing-up for their email alerts.
Click here for more malware links

Labels: ,

Links to this post:

Create a Link