Video Screencast Help
Security Response
Showing posts tagged with Messaging Gateway
Showing posts in English
Samir_Patil | 19 Sep 2011 20:20:39 GMT

Thanks to Anand Muralidharan for contributing to this blog.

Recently there was a serious bomb blast outside the high court in Delhi, the capital of India. The blast happened on September 7, 2011, and the investigations are continuing with the National Investigation Agency (NIA). News of this terrifying event is being used by spammers to promote fake pharmaceutical products. In the past we’ve seen Mumbai terror attack news used by spammers for advertising pills—we blogged about it in Spammers Attempting to Cash in on Mumbai Terror.

Below are some spam subject samples:

Subject: Delhi explosion
Subject: Bombing at Delhi court kills 10

The domains that are included with these latest spam messages lead users to fake online pharmacies. Using domain names...

Samir_Patil | 09 Sep 2011 21:50:48 GMT

Thanks to Vivek Krishnamurthi for contributing to this blog.

Every sensitive event is an opportunity to exploit. With this motive in the background, it is not surprising to see spammers exploit 9/11.  With the 10th anniversary of the tragedy just a day away, spammers want to make the best use of this emotionally charged environment. 

Here are two examples of scams that Symantec has noticed in recent days that attempt to exploit the emotional scars left by 9/11:
First email example exploiting 9/11
Figure 1: First email example exploiting 9/11
Second email example exploiting 9/11
Figure 2: Second email example exploiting 9/11
The first sample tries to entice...
Samir_Patil | 07 Sep 2011 00:04:33 GMT

Thanks to Amit Kulkarni for his contributions to this blog.

Since its launch, the Apple iPhone has been on the wish lists of most consumers.  The iPhone 4 has already made an impression in the marketplace, so it is obvious that spammers will make the best of this opportunity.  Symantec observed spam tactics just before the release of iPhone 4 and is expecting an even greater spam volume when iPhone 5 is released to the market.

The next generation of iPhone is expected to hit the market in September and spammers don’t want people to wait until the official release. Below is a sample of spammer hype campaigning to lure people into their trap. As usual, the bait is a survey one has to complete to be eligible to own “this coveted piece of art!”


Mathew Maniyara | 05 Sep 2011 21:32:40 GMT

Thanks to the co-author of this blog, Wahengbam RobinSingh.

Phishers are constantly looking for new ideas in their efforts of tricking end users. In August, Symantec observed a phishing site that utilized a number of new tricks. The phishing site masqueraded as a well known software company and claimed to offer associated software products at discounted rates. The phishing page highlighted these fake offers as “summer offerings” and stated that customers could save 80% on their purchases. Users were prompted to enter their billing information, personal information, and credit card details to complete their purchases. The personal information that was requested consisted of the user’s email address and phone number. The credit card details that were asked for were the card number, CVV code, and card expiration date. If any users had fallen victim to the phishing site, the phishers would have successfully stolen their confidential information for...

khaley | 31 Aug 2011 03:12:41 GMT

Famous or infamous, when you make news, the scammers pay attention. While we have come to expect the famous and infamous to show up in malware attacks that use spam and SEO poisoning, we shouldn’t be surprised when scammers leverage the spotlight that current events shine on the infamous. As Samir Patil blogged on Monday, the Gaddafi family is showing up in 419 scams. After all, few of us know a real Nigerian prince, but most of us have heard of Gaddafi, know he is in a bit of trouble, and might have the resources to buy his way out of trouble.

I can’t predict how events in Libya will end for the Gaddafi family. But I do predict that they will become very popular not only in 419 scams, but in a variation called the inheritance con.

Like the 419/Spanish prison scam, the inheritance con goes way back. The most famous version is the Drake scam, which started shortly after the...

Timothy Lee | 24 Aug 2011 07:04:08 GMT

As you sit down and open Outlook to delete yet another “Satisfy her in bed tonight!” solicitation from Angelina Jolie, do you ever wonder if every spam email on earth looks the same? It is true that certain phrases in spam seems to resurface ad nauseum in every language imaginable, such as “replica watch”, “reloj”, and “ologi”. Ultimately however, just as with customs, food, and clothing, culture and lifestyle dictates people’s behavior and affects how they use computers. Spam works very much like advertising in that it also caters to different groups based on their cultural backgrounds and local trends for maximum scamming benefits. I will highlight an example of spam specific to Asian below to demonstrate how spam from the Far East differs from the typical med and 419 scams seen elsewhere.

Keiba (horse racing) scams

Japan has one of the biggest...

Vivian Ho | 25 Jul 2011 19:45:15 GMT

The five-time Grammy award winner Amy Winehouse was found dead in London on July 23rd. Symantec has already observed spammers who are trying to capitalize on related news headlines by sending out malicious threats less than a day after the news was released.

The two samples given below are examples that we have observed. These Portuguese-language attacks use similar spam techniques. All samples are sent from randomized individual email accounts with various subject lines related to the celebrity’s death in an attempt to lure interested readers to open a malicious URL. Immediately after the link is clicked, a pop-up window is shown, which asks users to download a file that is loosely disguised as an image or video file, for example (anything other than an executable).

The file is given a name that is related to the celebrity, and of course isn’t an image or video file, but a malicious binary. Symantec has detected the threats in these samples as...

Mathew Maniyara | 14 Jul 2011 10:10:36 GMT

Apple's MobileMe is a collection of online services and software. Among its various services is a file-hosting service called iDisk. Recently, Symantec has recorded phishing sites that spoofed iDisk’s Web page. The phishing sites were hosted on a free Web-hosting site.

So, what’s in this service that interests phishers? The service is based on a paid subscription, with which files of up to 20 GB can be uploaded and shared. Phishers are looking to gain access to this service for free. This is an example of a phishing attack targeting user information for reasons other than financial gain.

The phishing site prompts the user to enter their password for logging in. (In this case, the user ID was already populated on the phishing page.) After the password is entered, the page redirects to the legitimate Web page of Apple MobileMe with an error message for an invalid...

Carlos Mejia | 11 Jul 2011 14:03:17 GMT

It’s been a week since the 2011 edition of the oldest international soccer tournament in the world began, held this year in Argentina. I’m talking about the Copa America. This event is hosted by a South American country every three or four years during the summertime and lasts almost a month. Some say that this tournament is the American equivalent of the UEFA Euro Cup.

South American families and friends hang out together to enjoy the games, and users look for news and the latest results over the Internet. Just as with other important sporting competitions, Symantec has been observing spammers taking advantage of this event to announce multiple unsolicited offers and discounts that are purportedly linked to the soccer tournament.

The spam sample below invites users to visit a Web page that is offering medical equipment. The site also offers more products and discounts that are valid only during the tournament time.

Translation ...

Samir_Patil | 06 Jul 2011 12:26:09 GMT

We have recently observed a run of spam that is trying to capitalize on the new social networking platform provided by Google, named Google+. The spam samples are similar to other social network spam messages, which are discussed in one of our previous blogs. Currently, Google is trialing their new venture with limited users; therefore, participation is by invitation only. Hence, it is expected that we’ll see bogus Google+ invites distributed as spam in the wild.

The message in this latest spam campaign looks like a legitimate invite from an already registered user, and it provides an invitation link. However, if one takes even a cursory glance at the URL in the status bar, it shows that the link doesn’t relate to Google in any way.
The headers in the spam samples are as follows:

Subject: Welcome to the Google+ project
From: [removed] (Google+) <[removed...