Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Security Response
Showing posts tagged with Symantec Protection Suites (SPS)
Showing posts in English
Samir_Patil | 07 Sep 2011 00:04:33 GMT

Thanks to Amit Kulkarni for his contributions to this blog.

Since its launch, the Apple iPhone has been on the wish lists of most consumers.  The iPhone 4 has already made an impression in the marketplace, so it is obvious that spammers will make the best of this opportunity.  Symantec observed spam tactics just before the release of iPhone 4 and is expecting an even greater spam volume when iPhone 5 is released to the market.

The next generation of iPhone is expected to hit the market in September and spammers don’t want people to wait until the official release. Below is a sample of spammer hype campaigning to lure people into their trap. As usual, the bait is a survey one has to complete to be eligible to own “this coveted piece of art!”


 
When...

Mathew Maniyara | 05 Sep 2011 21:32:40 GMT

Thanks to the co-author of this blog, Wahengbam RobinSingh.

Phishers are constantly looking for new ideas in their efforts of tricking end users. In August, Symantec observed a phishing site that utilized a number of new tricks. The phishing site masqueraded as a well known software company and claimed to offer associated software products at discounted rates. The phishing page highlighted these fake offers as “summer offerings” and stated that customers could save 80% on their purchases. Users were prompted to enter their billing information, personal information, and credit card details to complete their purchases. The personal information that was requested consisted of the user’s email address and phone number. The credit card details that were asked for were the card number, CVV code, and card expiration date. If any users had fallen victim to the phishing site, the phishers would have successfully stolen their confidential information for...

Vivian Ho | 25 Jul 2011 19:45:15 GMT

The five-time Grammy award winner Amy Winehouse was found dead in London on July 23rd. Symantec has already observed spammers who are trying to capitalize on related news headlines by sending out malicious threats less than a day after the news was released.

The two samples given below are examples that we have observed. These Portuguese-language attacks use similar spam techniques. All samples are sent from randomized individual email accounts with various subject lines related to the celebrity’s death in an attempt to lure interested readers to open a malicious URL. Immediately after the link is clicked, a pop-up window is shown, which asks users to download a file that is loosely disguised as an image or video file, for example (anything other than an executable).

The file is given a name that is related to the celebrity, and of course isn’t an image or video file, but a malicious binary. Symantec has detected the threats in these samples as...

Mathew Maniyara | 14 Jul 2011 10:10:36 GMT

Apple's MobileMe is a collection of online services and software. Among its various services is a file-hosting service called iDisk. Recently, Symantec has recorded phishing sites that spoofed iDisk’s Web page. The phishing sites were hosted on a free Web-hosting site.

So, what’s in this service that interests phishers? The service is based on a paid subscription, with which files of up to 20 GB can be uploaded and shared. Phishers are looking to gain access to this service for free. This is an example of a phishing attack targeting user information for reasons other than financial gain.

The phishing site prompts the user to enter their password for logging in. (In this case, the user ID was already populated on the phishing page.) After the password is entered, the page redirects to the legitimate Web page of Apple MobileMe with an error message for an invalid...

Carlos Mejia | 11 Jul 2011 14:03:17 GMT

It’s been a week since the 2011 edition of the oldest international soccer tournament in the world began, held this year in Argentina. I’m talking about the Copa America. This event is hosted by a South American country every three or four years during the summertime and lasts almost a month. Some say that this tournament is the American equivalent of the UEFA Euro Cup.

South American families and friends hang out together to enjoy the games, and users look for news and the latest results over the Internet. Just as with other important sporting competitions, Symantec has been observing spammers taking advantage of this event to announce multiple unsolicited offers and discounts that are purportedly linked to the soccer tournament.

The spam sample below invites users to visit a Web page that is offering medical equipment. The site also offers more products and discounts that are valid only during the tournament time.

Translation ...

Samir_Patil | 06 Jul 2011 12:26:09 GMT

We have recently observed a run of spam that is trying to capitalize on the new social networking platform provided by Google, named Google+. The spam samples are similar to other social network spam messages, which are discussed in one of our previous blogs. Currently, Google is trialing their new venture with limited users; therefore, participation is by invitation only. Hence, it is expected that we’ll see bogus Google+ invites distributed as spam in the wild.

The message in this latest spam campaign looks like a legitimate invite from an already registered user, and it provides an invitation link. However, if one takes even a cursory glance at the URL in the status bar, it shows that the link doesn’t relate to Google in any way.
The headers in the spam samples are as follows:

Subject: Welcome to the Google+ project
From: [removed] (Google+) <[removed...

Samir_Patil | 05 Jul 2011 12:29:52 GMT

He was seen several years ago. Now, he is back with the name “Don Gunshot”!

Luring people with promises of huge sums of money in return for bogus favors is the classic method adopted by the Nigerian/419 type of spammers. It is one of the oldest forms of spamming; very rudimentary, yet creatively lethal. This revisited scam tactic uses coercion to force people to pay up or else they will (apparently) face dire consequences. From a lighter point of view, however, it is a bit more humorous than scary.


 
The above email is indeed a perfect example of a scammer trying to blackmail someone they don’t know from Adam. The spammer does not know you, but he pretends to have received blood money to kill you. He blackmails you with threats of dire consequences if you even try to whisper the secrets explained in the mail. Forget the police, and if you dare to try and tell...

Suyog Sainkar | 30 Jun 2011 17:31:45 GMT

As most all of us will know, the United States’ Independence Day is on the fourth of July, which is only a few days away. Independence Day is commonly associated with fireworks, parades, barbecues, fairs, ceremonies, get togethers, and various other public and private events celebrating the national holiday. Many people also utilize this time for vacation trips, especially if it’s a long July 4th weekend. However, not everyone goes out of town or participates in special events. Some people actually take advantage of the nice holiday weekend to stay at home and catch up on other activities, which may include shopping. Since sales levels are usually lower during holiday weekends, stores and online shopping sites offer lots of exciting deals. In any case, today’s technology makes it possible to shop online from anywhere—even while on a beach vacation, say!

The spammers, as always, have exploited this likelihood and are distributing spam messages...

Sammy Chu | 29 Jun 2011 20:36:34 GMT

With our globalized economy, non-English email between international organizations has become the norm for business communication. However, at the same time, non-English spam is also becoming more and more of a problem for national and international enterprises.

For the past several months, Symantec has noticed an increase for Chinese language spam, as shown in the graphic below:


 
What’s interesting about this increase is the resurfacing of a body-obfuscation technique that is being used by Chinese spammers—the technique is called “invisible text.” What is “invisible text,” exactly? Invisible text is the body text that’s the same color as the background; therefore, it is invisible to the human eye.

Below are some samples that Symantec has observed. The first sample is a typical Chinese seminar (training course) promotion spam...

Samir_Patil | 29 Jun 2011 20:03:55 GMT

Yes, of course! This is what the email is all about! Or, is it?

The 2011 Wimbledon Championship has begun in full gusto and like any other major sporting event, we have been observing spam flowing in the wild that targets Wimbledon 2011. Spammers are exploiting the event by sending online betting, casino, and even online pharmacy spam through email.
The Italian spam sample given below mimics a legitimate betting website (the name of the betting site is deliberately omitted). The email headers are spoofed in an effort to bolster the legitimacy of the email; but the Sender domain has been registered only recently and shows hit-and-run spam characteristics. The spammer says, “Bet risk free! Even if you lose the bet, 20 Euros will be reimbursed.”

The spam sample given below explains the steps that users would supposedly need to take to acquire the “bonus”:

1. Sign up and make a deposit into your account.
2. Place your first...