Role Of Redirects In Spam

Spam is not a new problem for email user. Security company Kaspersky have written an analysis about redirects in spam.

Spammers frequently use redirects in their emails: after clicking on a link in a spam message, the recipient is often taken through a series of websites before reaching the destination resource.

There are many reasons for using redirects. In most cases, they help spammers to hide the data that enables spam filters to classify a message as unwanted – e.g., the website or contact phone number of the spammers’ customer. As a result, the recipient (as well as the spam filter) sees no links to the website being advertised in the message, no telephone numbers or email addresses that can be used to contact those who ordered the spam mailing. The message only contains a link to an intermediary resource. In addition, if the spammer is a member of an affiliate program, he will need to know how many users followed the link, because his income directly depends on that. As a result the chain of websites through which a user is sent may include redirector sites which function as counters.

The analysis can be read here.

Hotmail Security Updates To Prevent From Account Hijacking

Microsoft has made some security updates to their popular Hotmail web mail service. Seeing people posting to antimalware forums asking for help with their spam sending, hijacked accounts these new improvements will likely be nothing but a positive thing. Details about new security features can be read from Windows Live blog.

Symantec Internet Security Threat Report

Symantec has published "Global Internet Security Threat Report Trends for 2009" report. The report provides an overview and analysis of Internet threat activity worldwide, a review of known vulnerabilities, and highlights of malicious code. Other covered things are trends in phishing and spam. The report assess also observed activities on underground economy servers.

The report can be viewed here.

Comeback of mp3 Spam

Spammers have decided to dig up from the naftaline a trick they used over two years ago. Instead of easily detectable subjects and message contents just a small mp3 file has been attached to the spam message. A few seconds long mp3 file contains voice promoting Viagra pills and advertising site address that leads to infamous Canadian pharmacy sites.

Some related posts in security vendors' blogs:
http://www.symantec.com/connect/blogs/recycled-mp3-spam-cheap-pills
http://blog.trendmicro.com/mp3-spam-is-back/
http://www.viruslist.com/en/weblog?weblogid=208187948

SMS Spam In Finland

F-Secure writes in their blog about SMS spam that some Finnish mobile phone users have received. Message contains Finnish text that translates as "Video message, click" with a link to website (other variants may exist). If opened, the link directs user to "Mobile Tube" service. On the bottom of the page fine print in Finnish says that "the user has accepted a premium rate service, and if he wishes, he can cancel the contract".

"The scam works if the user has a WAP access point enabled, as is per default with most operators. The scammers will get the necessary information for billing just by having the user click a link and visiting the web page."

F-Secure reported of similar scam in their blog in July. However, this is the first time such thing appears in Finnish language.

"So whenever you see unexpected links via SMS, just delete the message and do not click them. If you clicked on a link, check if the page has an unsubscribe link. If it does, unsubscribe from the service and then file a complaint to your phone operator if you are billed by the premium service vendor", F-Secure guides.

FTC Shuts Down Web Hosting Firm

US Federal Trade Commission (FTC) has shut down web hosting provider Pricewert that operated at least under 3FN and APS Telecom names. FTC states that Pricewert was criminal ISP that sold services to other cyber criminals. Company hosted botnet servers and also helped in distributing spam, child pornography and rogue antivirus products.

It's not clear yet how the shutdown will affect. Similar shutdown happened in last November when net provider McColo was sent offline. That time spam amounts decreased a lot. Though 3FN was a major provider for Cutwail spam botnet it's possible that criminals have learnt their lessons and have programmed the botnet to use backup commands.

More on the subject:
Washington Post article
The Register article
Court documents

Spam Amount Increased And Then Decreased In February

The start of February saw Internet spam levels rise to as high as 79.5 percent of all e-mail messages due to a spike in botnet activity and spammers leveraging the financial crisis and Valentine's Day, according to MessageLabs (now part of security company Symantec).

This is despite the fact that spam levels declined by 1.3 per cent to an average of 73.3 percent for the same month, states the February 2009 MessageLabs Intelligence Report.

Source: PC World

Waledac Valentine's Day Theme

Valentine's Day is coming and that gives also coders of malicious software a chance spread their creations. Websense warns about new Waledac variant that is spread under Valentine's Day theme.

User is sent spam message notifying that there's an eCard waiting. Message contains a link where the card can be seen. "Once a user opens the URL in the spammed message, he is redirected to a site with 2 puppies and a love heart to give a Valentines theme. The user is then enticed to download a Valentines kit to prepare a present for a loved one, which is a new Waledac variant", writes Websense.

Spammers Take Advantage of Google Code Project

"Google’s code-hosting project is the latest free service to be abused by web spammers", writes Chris Barton, McAfee researcher. According to Barton bad guys are creating plenty of new projects with this type of website that redirects user to fake codec download site.

The assault follows a bout of the same kind of abuse against Microsoft's comparable MSN Spaces beta site dating back a year. Barton states that the difference is that Google appears to automatically index code projects.

Barton's blog post can be read here.

Google's Orkut Being Used To Spread Trojans

Security company Websense warns in its alert about spam that is disguised as an official email sent from Orkut, Google-owned social network.

A spoofed personal message, in Portuguese, is sent from a user allegedly on the Orkut network seeking love. The message contains several links that appear to lead to the official Orkut Web site. "Clicking on a link actually leads to a malicious executable file, which is a Trojan Downloader named "imagem.exe"", is told in the Websense alert. "The malicious file opens the legitimate Orkut network login page, and in the background downloads a password stealing Trojan named "msn.exe"."

Websense says that the trojans used in this attack are hosted on a compromised labor union web site from southern Brazil.

Amount Of Spam Rising Again

Amount of spam messages decreased to the one third of normal for a couple of weeks when criminal operator's lines were disconnected. Restart of botnets has been going on since Monday and spam amounts are rising rapidly again. Amounts would be even higher but the worst botnet is still offline.

American McColo operator operates many controller servers of the world's biggest botnets. According to security companies closure of McColo sent at least Srizbi, Asprox and Rustock botnets offline.

During couple of weeks criminals have moved some of their controlling operations to other parts of the world, to Russia for example. Criminals even used a backup connection they successfully got by tricking internet service operator TeliaSonera to transfer data to new host in Russia. Last Sunday spam amounts decreased to minimal level but rapid increase began on Monday. According to Messagelabs security company (now part of Symantec) the reason behind increase is that Asprox and Rustock botnets have returned online. Also, Cutwail and Mega-D botnets have increased their posting amounts.

Though the spam amount is increasing it's still under half of the peak a few weeks ago. Security companies say that's because the worst botnet Srizbi is still offline. Messagelabs says that even half of the world's spam is sent thru Srizbi. Security researchers have estimated that Srizbi would consist of even over 300,000 PC computers connected to the internet.

Symantec's Report Reveals: Increase Of Spam-Sending Zombie PCs In September

Symantec has released its monthly State of Spam report.

After a 37 percent drop in botnet-related spam for August, Symantec observed a 101 percent increase in September. The growth appears to be focused in Europe, the Middle East, and Asia, with South Korea experiencing the largest increase at 4,236 percent. It was followed by Kazakhstan (761 percent), Romania (607 percent), Saudi Arabia (555 percent), and Vietnam (540 percent).

Biggest amount of active zombie machines was in Turkey, 12 percent. It was followed by Brazil (9 percent), Russia (8 percent), United States (6 percent), India (6 percent) and China (6 percent).

Symantec says that it's difficult to determine an exact reason behind the one month increase but admits that it coincides with the increase in email messages carrying links to downloadable exploits which were characterized by their use of sensational news headlines. It also coincides with an increase in email messages carrying attached viruses in the form of zip and RAR files. When looking at the geography of the virus attacks versus the zombie data there can be seen similar increases in certain countries on both accounts.

O.J. Simpson Guilty Verdict Could Lead To Malicious Spam

IT security company MX Logic warns in its blog about possible spam related to the OJ Simpson guilty verdict from last week.

"It appears that some search engines are already being poisoned with links to malicious video downloads based off of certain search criteria related to the verdict. It is typical for these types of tactics to start bleeding into email as well", writes Sam Masiello, vice president of information security at MX Logic.

Similar to the CNN and MSNBC campaigns from August it is likely that these spam emails will use a lure to an online video to trick users into visiting malicious web sites that download alleged video codecs that are actually malware.

Microsoft Updated CAPTCHA protections - Busted Again By Criminals

Cat and mouse game of security has expanded itself to protections of web services. Earlier criminals developed a program that could pass Hotmail email service CAPTCHA tests. Microsoft updated protection but criminals have now busted the new protection too. Accuracy isn't big but it's enough for computer.

Internet's big free email services like Google's Gmail and Microsoft's Hotmail are attracting targets for criminals. These services are not put to block lists and email can be sent for free through them. The services use so called CAPTCHA tests to prevent mass account creation with criminals' automatic programs.

Security company Websense presents details about new attack in its blog. Microsoft's old CAPTCHA protections based on text scrambled with lines. Revised CAPTCHA contains badly twisted text but automatic program can now read this too.

Accuracy isn't big. According to Websense only every 8th or 10th attempt is successful (a success rate of 10 to 15%). For computer program this isn't obstacle since attempts can be made continuously.

This latest spambot targeting Microsoft's revised CAPTCHA system includes the combined features of spambots used to target Google's Blogger and Microsoft's Live Hotmail. Websense reported on these anti-CAPTCHA operations earlier this year (2008).

Bogus 'msnbc.com - BREAKING NEWS' Alerts

Websense® Security Labs™ ThreatSeeker™ Network has discovered a new replica wave of 'msnbc.com - BREAKING NEWS' alerts that are being sent out via spam emails. Similar to previous attacks related to 'Bogus CNN Custom Alerts', these emails contain links to a legitimate news page, but are designed to encourage users to download a malicious application posing as a video codec.

The malicious payload is only accessed when the user clicks on the ‘breakingnews.msnbc.com’ link, which takes users to a Web page named up.html. This page issues a pop-up encouraging users to download a ‘missing’ video codec, a file called adobe_flash.exe.


Here are some examples of the varied subjects used in this campaign:
msnbc.com - BREAKING NEWS: Arsenal buys Ronaldo from Man Utd
msnbc.com - BREAKING NEWS: Copycat murderer beheads woman on Greyhound bus
msnbc.com - BREAKING NEWS: Too much freedom will destroy America
msnbc.com - BREAKING NEWS: Mary-Kate Olsen responsible for Heath Ledger's death
msnbc.com - BREAKING NEWS: Stupid Asians lose lawsuits against Americans
msnbc.com - BREAKING NEWS: West Nile virus spreads in Europe

Storm Spreads Under Love Theme Again

Over a week ago MX Logic wrote in their security blog about new Storm worm variant claiming news of a new earthquake in China. Now a bunch of new domains has been added to spread Storm. Theme of Storm spam messages has been changed to love which is common theme for earlier Storm variants.

Below is an example of these new Storm messages:

From:
Date: 2008/6/29
Subject: Missing you


Missing you hxxp://latinlovesite.com/

Thus far identified domains are:

theloveparade.com NS ns5.lollypopycandy.com
latinlovesite.com NS ns5.lollypopycandy.com
youronlinelove.com NS ns5.lollypopycandy.com
yourloveletter.com NS ns5.lollypopycandy.com
makinglovedirect.com NS ns5.lollypopycandy.com
lollypopycandy.com NS ns5.lollypopycandy.com

It's difficult say how long this new theme will be used. China earthquake theme lasted from 6/18/2008 to 6/27/2008 so this new 'old' theme may not last much longer either.