The Mobile Malware Landscape

Everyone is aware that your home PC is at times vulnerable to spyware, and viruses, but not everyone is aware that their mobile phones could be at risk too. There are in fact around 300 different viruses in circulation that target your mobile or smart phone. That is a pretty small number considering there are several hundred thousand that'll target your home computer. That's still a good amount. The one thing to realize about these bits of mobile malware is that they're all still written by "hobbyists" that are not (yet) looking for financial gain. When the concept of money making opportunity arises in the mobile malware sector, it will no doubt officially become a "market". There is still risk. Just like with your home computer, malware can seriously destroy your phone, steal your phone book, or cost you a lot in charges depending on what the virus is programmed to do. You can expect these to get much more elaborate as your cell phone more closely resembles your laptop in functionality.

P2P Identity Sharing

Anyone that's familiar with file sharing programs such as Bearshare, Limewire, Kazaa, or the original, Napster, obviously knows that they're a place for sharing all sorts of files. The most popular being music files. Along with movie files, and the occasional cracked software, oh, and don't forget all of the virii pretending to be music files, movie files, and the too good to be true Adobe CS3 Master Collection w/ KeyGen. However, too few people are aware that they're sharing far more than what's in their "shared" folders.
With very little know how, and requiring just as little time, information that makes identity theft way too simple is very easy to come by on these Peer to Peer networks, and the scariest part is that you may be offering up your sensitive information for anyone to take right now!
So, what kind of information can be found using these file sharing communities? Well, I did just a 3 minute search yesterday, and I was able to find tax returns, with Social Security Numbers, direct deposit information (routing and account numbers), home addresses, phone numbers, dependent information, along with medical records, billing info, school transcripts, and loan information, just to name a handful of things. That is incredibly scary! I've read reports et al. about this type of thing in the past, but since I was asked to do some research for our local ABC affiliate, I gave it a try, and it blew my mind. Anyone with a little knowledge, and a black heart could mess up an entire family, in some cases, in less than an hour.
Now, how does this happen, you might ask? Well, it happens when someone that is running this software misconfigures it to allow, usually, the entire hard drive to be shared with everyone on the P2P network. This kind of mistake can happen pretty easily, because the shared folders are quickly configured early on in the installation process, and can be blown through without even thinking about it. One of my theories as to how it happens in many cases is that parents allow their kids to "play" on the same computer that they keep all of their important documents, and one day Jr. just had to have that new Fiddy Cent song, installed the software, quick-clicked through the installation process to get to the downloading as fast as possible, and left everything on that computer up for grabs. What makes it worse is that even when you close these programs out, they continue to run, and share files. Make sure you don't leave these things running in the background. You can usually see a small icon in the system tray at the bottom of the screen, or in some cases, you may want to ctrl-alt-del to your task manager, and check your running processes.
How can you avoid sharing important information with the villains of the interweb?
-Don't use file sharing programs (Unless you're downloading Metallica, of course)
-Don't keep sensitive materials on the same computer as your children use. Or simply don't keep them on the computer at all, back them up to CD or DVD, or 5.25 floppy, what ever's handy.
-Monitor what programs are running on your computer, and use appropriate anti-virus/ firewall software.
Also be aware that if this software is installed on your computer, there are ways for more advanced hackers to get information off of your computer even if you take these precautions, far less likely, but still possible regardless.
You can read about the first man arrested for file-sharing identity theft in Seattle earlier this month here.

Return of the Kitty Cat Spammers

Well, 2 days ago I commented on this quick blast of spam containing a picture of a number, and a random image of a cat playing with a ball of yarn. Well, it just happened again. Another number, and an image of two arrows. What are they up to?!

This Just In...

Well here's my first second post in one day. I've just noticed a strange image spamming its way into mailboxes. The image, seen, here suddenly began appearing in our traps about 20 minutes ago, and since the rule was written to block it, we've seen about 10,000 of them.
There's no other content besides the cat, and another image of a number. Apparently sent via botnet, these emails appear to come from many different sources, addressed to many others.
Also, the subject line reads "Test Image Include".
This seems like an interesting "test" if it is one, even though they may have a lot of IPs at their disposal, it seems like they might be exposing a good deal of them. Or, it could be a mistake, seeing as though they came on very heavy for about 15 minutes, and now it seems to have stopped.
This was a strange one.

Phishing vs. Pump and Dump

The SANS ISC webblog brought up an interesting idea today. In the wake of the Ameritrade info theft, theories are surfacing with the thought that perhaps penny stock pump and dump schemes may be more lucrative than identity theft.
Ameritrade had reported that even though Social Security numbers and birth date information were stored on the same server that was hacked for names, and email addresses, they were untouched. Is it possible they were better protected than the other information on this server, or was it because the hackers were uninterested in this information, planning instead to target a more specific, targeted audience with a future stock scheme? A strong theory, in my opinion, given the fact that cybercrime is moving to new levels of intricacy every day. Many attacks being multi-leveled, and very sophisticated, often gang run, and very difficult to trace.

Spike in Citizen's Bank Phishing Emails

After lying dormant for nearly 10 hours, a phishing campaign targeting customers of Citizen's Bank came back with fervor a couple of hours ago with a rate of around 500% of what we were originally witnessing last week. All of the emails claiming to be from the bank's "Money Manager GPS Online Services" shared the same body content, and a few slightly modified subject lines. A link within the emails direct recipients to a good handful of different domains, all listing citizen's bank as a sub-domain. Allowing the sender to trick the recipient's eyes away from the actual domain they were being directed to. All of these emails are currently being blocked to our customers, but with a push like this, a lot of them are likely finding their way into email boxes.

Ameritrade Hacked

"TD Ameritrade Holding Corp. said Friday one of its databases was hacked and contact information for its more than 6.3 million customers was stolen.", is a quote from an article released by Ameritrade today. They claim that no financial loss has, or will occur as a result of the stolen information. However, Ameritrade clients have reported receiving unsolicited spam because of the theft.
Ameritrade hired computer forensic specialists to analyze the theft. They have reported that information such as names, email addresses, and physical addresses were stolen, but there is no evidence that other important information such as social security numbers, account numbers, or birthdates was stolen.
Hopefully no identity theft took place as they claim, and the attackers simply made off with a rather large harvested email list. That doesn't help Ameritrade client email inboxes, but it would certainly save their bank accounts.
Here's the link to Ameritrade's press release on the matter: http://www.amtd.com/newsroom/releasedetail.cfm?ReleaseID=264044

Anti-Spam/Scam Sites Attacked by Storm

Well, if you ever wondered what the Storm Worm was good for besides propagating itself, here's a good example. It seems that several anti-spam/ anti-scam sites have been the victim of DDoS attacks over the past couple of weeks, no doubt the work of Storm's evil network of compromised zombie computers.
A DDoS or Directed Denial of Service attack is designed to bring down a website, or network by flooding it with simultaneous connection requests from other computers. With the number of Storm infected computers in the millions, this has been a nuisance to say the least to people and organizations that are fighting the good fight. Websites such as CastleCops, and 419eater were shut down last week due to these attacks.
CastleCops is an excellent site that reports on various internet scams, such as reported phishing sites aptly named "Fried Phish".
419eater, is a site that has been around for a very long time. Started as one man's mission to give a little back to those in Nigeria that are working so hard at stealing your money. Also known as scam baiting, 419eater essentially leads the scammers down a long annoying path to aggravation. There a lot of good documented correspondences with the 419ers on the site that you would certainly find entertaining. It has turned into a fraud awareness knowledge base that'll keep you on your toes.
Among these sites, Scamwarners, and Artists Against 419 were also affected by the attacks.

China's Irony

It occurred to me yesterday, as I was looking over some of the latest stats on various things, how completely ridiculous the Great Firewall of China really is. First of all let me inform you, if you don't know already, China has in place something known as the Golden Shield Project-aka The Great Firewall of China. Essentially what it does is censor the internet to the people within China. It was put in place by the People's Republic of China government, and filters such things as the usual, obscenity, pornography, and criminal activity. Things such as that of the outlawed qigong group Falun Gong, as well as disallowing any reference to the Tienanmen Square protests, freedom of speech, sites dealing with democracy, Marxism, or any teaching of the Dalai Lama. So, as you can see, they're being pretty tight over there. Except - when you look at the huge amount of Chinese domains sending me all of this spam, and hosting a huge amount of the domains that hold malicious content. Such as that of the Storm Worm. China has been in the top three of spam producing countries for several years. At present, Symantec reports that spam messages with URLs linking to Chinese domains are up %700 from two months ago ( from July to August).
I don't know, I'm not normally one to take on an entire country like that, but I just found it kinda silly, and ironic.

More to Come, After These Messages...

Some people may have seen some interesting spam emails yesterday, or perhaps rather, really uninteresting. Emails sent through a botnet, as most are nowadays, arrived in many mailboxes, with one random word in the subject, and another single random word in the message body. They didn't contain any images, or malicious code, just a single word.
I had also seen a campaign yesterday before that, where you could see an image placeholder/link, and another http link below that to a different location. The links were broken, and the images weren't included. An obvious botched campaign, as all of the link locations were quickly blacklisted, and unusable in the future. After seeing this one, I automatically thought that maybe this one word spam thing also forgot to add their image spam, but Trend Micro thinks that maybe it's being used to test the waters, and retrieve valid addresses for something around the corner.
The random word thing is nothing new in the spam world. It seems to be involved in much of the spam that comes through. Whether it be image spam, attachment spam, or simple text spam with a little 0bfu.$c@tiOn thrown in. It's used to try to throw off spam filters that are looking at content for legitimacy, looking for word grouping, and sentence structure, and various algorithms, and what-nots. My personal favorite is when they use random passages from two separate novels, so that it reads like a Madlib.

But you employ capable man? Return: with Vega itself, whatever he cried the anticlimax, room, a shrewd eyes tragic and nobles, and a drop his. I wonder you did you get the short of the last the transmuter, in the Foundation I am growing ocean order him

Sorry to go off on a tangent there. Maybe we are in for something here shortly, and if they were searching for valid addresses for this next campaign, they probably have had enough time by now to put them in place, and are geared up for the next run, so get ready, I'm sure it'll be exciting!

Back to Work

Well, I hope everyone was able to stay away from work, at least briefly during the extended holiday. As expected, the spammers like to get a little more time in during these holiday weekends, counting on the good guy army to be thin.
This past labor day was no exception, as they came at us with several big spikes, on each day of the weekend, and Monday. There was a good supply of image spam, including an incline in adult oriented image spam over the past month or so. Which is kind of curious, as the referrals paid to spammers by these sites, are minuscule compared to other things such as pharmaceuticals. One of the former favorite spam types, by the spammers themselves, was the mortgage referral. However, with the trouble that the sub-prime mortgage companies are now in, has obviously affected the spammers desire to push for these companies. Perhaps they went back to their old stand-by, with the adult sites. I'll be looking further into the current trends. Another interesting spike I saw happened yesterday for a couple of hours, midday. I saw an increase of 419 Scam style emails. It got up to a 586% rise from normal. I'll be watching that too.
The Russian gang responsible for the Storm Worm had a few new tricks, and an old one. Including an email promoting music videos from your favorite artists, they tried to hook "infectees" with the offer of software beta testing, and they revisited the 4th of July holiday, with a Labor Day themed email. The link in the email takes you to a happy little graphic. Unfortunately, underneath the surface, there is nothing happy going on, as after you get to that next page, you're being infected by several different exploits all at once.
This is definitely growing into the largest, longest, and most widely distributed Trojan campaign to date. Remember to avoid any email you weren't expecting, and always keep in mind they're using these social engineering tactics to try to get you to click on those links. Be skeptical.
Picture courtesy of McAfee