Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Security Response
Showing posts tagged with Mail Security for Exchange/Domino
Showing posts in English
Mathew Maniyara | 09 May 2011 21:05:55 GMT

Gone are the days when phishing targeted financial brands alone. Phishers today are eyeing several other sectors to steal users’ confidential information. For the past few months, the gaming sector has increasingly been a target for phishers. Symantec is actively keeping track of these phishing sites that spoof gaming brands.

So what’s so lucrative about phishing for gaming site credentials? Gaming sites are popular with young generations who are passionate about playing and winning more and more games. Many of these gaming sites have a section for paid members that contain members’ exclusive games and added features. The primary motive of phishers is to lure users with the hopes of stealing their credentials to gain access to the members’ section. Since these credentials are in high demand, phishers also intend to sell stolen usernames and passwords on the Internet.

The following are some noteworthy statistics of phishing on gaming sites for...

Candid Wueest | 04 May 2011 22:25:31 GMT

We know that Facebook scammers can be very creative and that they are experimenting with new ways to achieve their goals. Besides the omnipresent malicious Facebook apps that will steal the user’s permissions to post to his or her wall, we currently see a rise in the number of manual script attacks, with a few hundred thousand users falling victim daily.

The user is lured with a message as bait to a prepared site. The all time favourite “See who viewed your profile” is used a lot these days, but we have seen others with free credits for social games and the like. This landing page could be a Facebook page, a Facebook application page, or a remote site on some domain. It asks the user to copy some simple looking Javascript to the browser address bar and to click the ‘Enter’ key.

The scammers want to ensure sure that the users are not strained by...

Eric Lin | 04 May 2011 10:09:29 GMT

Who was the one who held you in their arms when you let out your first cry in the world? Did you say “doctor?” Well, that may be true in some cases, but the more obvious answer is “mother.”

Dating back to ancient Greece, mankind held a festival worshiping Cybele, mother of the Greek gods. Mother’s Day is now celebrated around the world, mainly sometime in March, April, or May. The most common date is the second Sunday in May when, in most countries, mothers receive flowers and gifts in celebration of the day. How can spammers miss this special occasion when people are surfing the Internet to try and dig up a sweet surprise to express love and gratitude towards their mothers?

The following are Mother’s Day spam samples that Symantec has recently observed. There is a range of product spam, including flowers, watches, gift cards, and diet products. This latest spam campaign involved both dictionary and domain attack techniques,...

Samir_Patil | 03 May 2011 12:17:05 GMT

The first spam using the news of Osama Bin Laden’s death was seen in the wild within three hours of the event—Symantec reported this spam activity along with other spam samples in a blog entitled “Osama Dead” is No Longer a Hoax. As anticipated, we started observing a rise in malicious and phishing attacks.

Phishing attacks usually target big brands. In one such phishing attack capitalizing on Bin Laden news, spammers targeted CNN Mexico. The spam email contains a link to bogus “photos and uncensored videos” and redirects users to a phishing site:

The phishing site shows an auto-running Bin Laden related video in an iframe and asks the user to click on a link to download a “complete” video. Clicking on that link forces the download of an ....

Samir_Patil | 02 May 2011 20:55:28 GMT

That’s right, and this time it’s not a hoax! Bin Laden was killed by a CIA-led operation on Sunday night at a mansion in Abbottabad, north of Islamabad. In 2004, Symantec reported a hoax email attack with the subject “Osama bin Laden Captured” which contain a link to a Web site that hosted malware. Similar attacks that used such false information about Osama Bin Laden were also distributed in 2005 and 2006.

News targeting famous/notorious personalities are often used in scams. At this moment, we at Symantec Probe Network are observing a huge inflow of legitimate messages carrying links to the news. However, in all likelihood, there will be an increase in spam volume targeting this news.

In one of the spam samples, the message is poisoned using the news of Osama’s death. The news snippet is glued in an HTML <title>...

khaley | 29 Apr 2011 22:43:22 GMT

On Tuesday, April 26, Symantec hosted a live Twitter chat centered around our latest Internet Security Threat Report and the changing threat landscape. We’d like to extend a big thank you to those who participated and joined the conversation.

 Using the #SecChat hash tag in Twitter, we were able to guide a lively discussion around what’s top of mind with regard to the current security threat landscape for those of you in the security industry.

One aspect of the discussion focused on end-user security education and its importance, while others questioned whether dollars spent toward user education made any difference at all. We certainly heard all sides to the story. If there is anything people agree on it’s that the “user is like water, following the path of least resistance to their end goal,” in the words of one tweeter.

Those in support...

Suyog Sainkar | 28 Apr 2011 08:30:17 GMT

As we have seen with many major events in the past, news of the British Royal Wedding is currently being used by cyber criminals to bolster their spam campaigns and push rogue antivirus software through black hat search engine optimization (SEO) techniques.

Spam campaigns

We have blogged previously about “snowshoe” spammers targeting the upcoming British Royal Wedding of Prince William and Kate Middleton. Spam email messages advertising a replica of Princess Diana’s engagement ring that were observed in February are still making the rounds on the Internet, and the eve of the royal wedding is now upon us. Furthermore, as we had anticipated, we have recently observed additional spam campaigns making use of this significant event to promote various products.

In one such recent spam campaign, email promoting a "...

Dermot Harnett | 20 Apr 2011 21:44:04 GMT

On April 20, for the first time ever, gold rose above $1,500 an ounce as worries over the U.S. economic outlook boosted demand for the metal as a haven. Within hours, Symantec observed this spammer’s response: a hit-and-run spam attack with the Subject line “Subject: Is Gold Your Ticket To A Golden Future?”

Hit-and-run spam (or snow-shoe spam) is a threat known for its large volumes of spam messages in short bursts, where domains are quickly rotating and the sending IP hops within a certain /24 IP range.

Key characteristics include:

  • The message is in HTML
  • There is some type of word salad or word obfuscation injected between various tags and/or in the URL by means of multiple directories
  • The message is typically sent within the same /24 IP range
  • Domains are rotated quickly

The call to action for this particular attack is a URL in the message body which directs the recipient to a Web site where the...

Samir_Patil | 18 Apr 2011 22:14:14 GMT

Easter is a Christian holiday centered on the death of Jesus Christ and his subsequent resurrection several days later. Hence Easter is an important holiday for Christians. But what gets associated with Easter is beautifully decorated Easter eggs found on every decorated shop window this season, and of course the Easter Bunny! To celebrate Easter, people exchange Easter eggs and, with the evolution of time, today we have personalized e-cards and personalized gifts. Spammers have begun to exploit the season by sending personalized e-cards, gift cards, and replica-spam emails.

Here is a screenshot of a personalized Easter e-card:

Here are some of the headers used in Easter e-card spam:

Subject: Give your child the gift of amazement A Package from The Easter Bunny.

Subject: The Most Popular Gift for Kids this Easter 2011

Subject: Send A Personalized Easter Bunny Letter...

Dylan Morss | 12 Apr 2011 21:05:25 GMT

As I recently have sent off my tax forms in preparation for the US Federal tax deadline on April 18 this year, a recent phishing scam piqued my interest. This attack is taking advantage of the new tax year beginning for folks in the UK on April 6, 2011.

The message in question was being sent in the name of the HMRC, Her Majesty’s Revenue and Customs, in an attempt to lure users into divulging bank account information with the lure of unclaimed tax overpayment money.

The path of the message had an international flavor, beginning at what looks like a computer at a hotel business center based in the US, then going through servers in New Zealand, then back to the US through the mail servers of a large free email service, and then presumably into the inbox of a user based in the UK.

The URLs in the message also contributed to this internationalized scam by utilizing a domain based in Serbia which would redirect users when they unsuspectingly clicked on the...