Security Response

Earlier this afternoon in Italy hundreds ofthousands of people received an email from a “friend” stating(approximately) the following:

You’re under investigation! Hide everything and be quick!!!Your name appeared this morning together with 150 more persons on thewebsite of CAFF in Rome. Check it by yourself, you’re on January’slist: the website is the following: http://www.site.tld/caff/

The email is relatively convincing and Symantec believes many users have actually visited the Web site:

The Web site look and feel is very similar to other Italiangovernment Web sites and also the choice of the...

As discussed in the past,cross site scripting (XSS) can be exploited by phishers to build reallyeffective attacks. Today we have analyzed another similar attack thatincludes some enhanced features. The attack was exploiting an injectionflaw in an Internet banking application, specifically located in themodule used to display warning messages to users.

The function took a single GET parameter:

https://www.well-known-bank.com/popup.asp?msg=[ASCII_encoded_message_to_display]

And then returned a page with the following in the body:

document.writeln([decoded_messages]);

Obviously the aim here is to have a single page display warningsthat are available to every module in the application. Because theinput was not properly sanitized the attackers used...

As anticipated in my first blog post,email service providers play a central role in the battle againstonline fraud. This is because they are often the only organization toown the data needed to support financial institutions and lawenforcement agencies in prosecuting criminals.

Most phishing sites are hosted on compromised Web servers and in thepast, stolen accounts were stored on local log files that phishers usedto save, using rather standard filenames (like “data.log” or “cc.txt,”where “cc” obviously stands for credit card). Web servers withdirectory listings that were enabled together with phishing kitanalysis quickly made this simple technique ineffective, becausefinancial institutions were able to read those files as well.Therefore, they were able to block stolen Internet banking accounts andcredit cards, thus...