Video Screencast Help
Security Response
Showing posts tagged with Spam
Showing posts in English
Kelly Conley | 15 Oct 2008 12:47:16 GMT | 0 comments

Symantec has observed an increase in the use of image spam attacks over the past few weeks. Symantec defines image spam as an unsolicited message containing an image in the body.

In August, image spam attacks accounted for approximately 1.6% of total spam. In September we observed that image attacks almost doubled, representing approximately 2.6% of total spam. Over 50% of image attacks observed are English, and the second largest group of messages is Russian. In the first ten days of October, image spam messages have averaged approximately 8.6% of total spam. This is the highest mark to date over the last 90 days. From May of this year up to September, image spam was relatively quiet. As stated above, these numbers have been increasing since mid-September. We have not seen image spam of this volume since February of this year.

Commonly seen image spam messages have included Russian online dating offers, random product offerings with an image opt-out, and the all too...

Kelly Conley | 06 Oct 2008 19:14:26 GMT | 0 comments

The trend of spam messages containing URL links to malicious code and/or carrying malicious payloads has dramatically spiked since May of this year. This trend is the focus of our October State of Spam Report, issued today. From June to mid September, the amount of malicious code detected in scanned email messages increased from a tenth of a percent (0.1%) in June to 1.2 % in the middle of September. Now, that doesn’t sound like much, but consider that this represents a 12x increase! The top ten of definitions detected by antivirus rules for this period were led by generic Trojan, Downloader, and Infostealer definitions—making up more than 30% of the malicious code detected.

Also noted in this month’s State of Spam Report is the increase in zombie activity. The report notes that while zombie activity decreased from July to August, it increased more than 100% between August and September. For this period, the EMEA region was the leading source of all zombie IP addresses....

Kelly Conley | 10 Sep 2008 16:34:38 GMT | 0 comments

We have observed a fraudulent spam attack masquerading as an email from Symantec. This email is in Portuguese and contains the Symantec logo and coloring, which make it appear as a legitimate email from Symantec. The “From” line is forged to add further credibility. The “Subject” and “From” lines appear as follows:

 

Subject:  Security Check
From: SYMANTEC <Worm@bda.267>

Needless to say, this is not from Symantec. The body of the message contains text that indicates that the Symantec Security Check System has tested your computer and found “X” number of dangerous imperfections. The email goes on to say that your computer is infected with the virus “Worm@bda.267.” Users are encouraged to click the provided link to download updates to protect their systems from further damage from this worm. Incidentally, there is no such virus as Worm@bda.267.

If the...

Kelly Conley | 04 Sep 2008 14:38:23 GMT | 0 comments

In August, the "Internet" category of spam showed an increase of nine percent from July and now makes up 27% of all spam messages. This increase is detailed in the Symantec State of Spam Report for September, which will be released today. The escalation of Internet spam can be attributed to the prevalence of malicious code being sent around via spam emails over the past month. It seems that spammers will stop at nothing to deliver their payload-various techniques in spam containing viruses were observed over "the month of the virus." These include the following methods:

  • Sensationalized "fake" news headlines
  • Use of seemingly real news headlines
  • Purported download for the latest version of Internet Explorer
  • Malware + spam + phishing = The triple security threat for financial institutions
  • Airline e-ticket connects malicious code and spam

Sensational (and in many cases...

Kelly Conley | 03 Sep 2008 17:34:51 GMT | 0 comments

The theme to Flash Gordon is going through my head. You can't hear it, but I can. He's the savior of the universe, king of the impossible, and he'll save ev'ry one of us.

These lyrics seem so appropriate when it comes to all of the .swf (Flash) spam that we're observing. I imagine the spammer looks upon .swf files as saving his spam by ensuring it will bypass filters. Is .swf the "king of the impossible," able to avoid detection? The answer is "no."


What we have observed are spam messages that contain a link to an .swf file. This file is hosted on a popular image hosting site. When clicked, the link redirects to various Web sites and so far we've seen medical supplement and adult-oriented sites as the destination of the redirects.

The .swf attack with the largest volume observed is the German pharmacy attack, with over 300 million instances seen. The body of this message is in German and includes a list of medications that are...

Kelly Conley | 29 Aug 2008 17:58:32 GMT | 0 comments

Notice! The virus-spreading spammer doesn't have your baby but is claiming to. In recent emails observed by Symantec, malicious code is being spread by hoax emails claiming to have pictures of your hijacked [sic] baby. The Subject line makes the claim that someone has  "hijacked" your baby and the attachment on the message is not a photo, but rather a zip file containing a downloader:


Subject: We have hijacked your baby
Content-Type: application/zip;        name="photo.zip"


The body will look similar to the following:


"Hey We have hijacked your baby but you must pay once to us $50 000. The details we will send later...
We has attached photo of your fume"


The email comes with an attached zip file called "photo.zip," which...

Candid Wueest | 27 Aug 2008 17:59:48 GMT | 0 comments

I must admit that I was puzzled for a second when I saw an email with a suicide note as a subject line in my spam inbox. I wondered what product they might try to sell with that note or which drive-by download site might be hidden behind it. So, I opened it. The email was actually written like a real suicide note.

In the text of the message, a young Swiss guy explains that he has had enough with the world and that he has given up his painful fight against the Russian cyber-criminals. With some side notes, he explains that he had at least profited a little from their own tricks and was able to transfer some cash for himself from Swiss online banking accounts. Of course, he explains, all in the name of the greater good.

The mail then takes a tangent and tells a story about him catching his girlfriend red-handed with another guy, which finalized his...

Kelly Conley | 21 Aug 2008 07:20:52 GMT | 0 comments

In the past few days Symantec has observed virus spam masquerading as news articles regarding the current Georgia-Russia conflict. We felt it was important to blog about this because this particular event is garnering a lot of media attention and holds a very high profile. Because of this, there is an extremely high potential for the spreading of malicious code by spam email using information on this event as a lure.

The messages themselves contain an attachment, along with instructions and passwords for the download of the attachment. The subject line appears to be a legitimate news story about the Russia/Georgia conflict. One subject line that has been seen reads: “Subject: Journalists Shot in Georgia.” A short description of a “news event” related to the Russia-Georgia conflict is contained within the body of the message.

The use of the attention-grabbing subject line seems to be intended as a social engineering tactic to entice recipients to click the link...

Kelly Conley | 05 Aug 2008 14:52:39 GMT | 0 comments

As we enter August, Symantec takes note in the State of Spam Report that spammers are continuing to attempt to entice users to open their messages by sensationalizing false news events. Popular targets of this headline or tabloid spam include current public events and figures, such as Obama and McCain.

In July, some of the subject lines observed were:

 

  • Beijing Olympics cancelled
  • Beijing postpones Olympics due to McCain-Dalai Lama meeting
  • Mccain Says Unsure If Obama A Secret Hippopotamus
  • Kick-up - Obama speaks in London - video

 

In the samples observed, the URLs were hosting malicious code (malware). There is a continuing link between spam and other security threats with a penchant for spammers to...

Silas Barnes | 11 Jul 2008 16:40:35 GMT | 0 comments

Everyone knows that in a matter of hours, hype can turn a small event into something much larger in the minds of society. Enter the latest round of malicious spam we have seen here at Symantec—the death of the Internet.

 

The following spam subject lines have been seen:

 

Secret Plan To Kill Internet By 2012: Leaked?

PLAN TO KILL THE INTERNET BY 2012- Documented

2012: The year the Internet as we know it dies...

2012: The Year The Internet Ends

 

This certainly sounds devastating because many of us spend a rather large amount of our time, both as part of work and as part of life, online. Addition information on this apocalyptic event continues in the various body texts we have seen, including:

 

Every significant Internet provider around the...