Security Response

When one thinks of Christmas, an aura of emotion arises. We are reminded of our family reunions, Christmas carols, that aroma of turkey being roasted, the cakes and pastries - don’t forget the Christmas gifts! But before we can wish you a merry Christmas we would like to caution you as you prepare your Christmas shopping list.

Please be careful, especially when you do your Christmas shopping online. Spammers are offering a plethora of fake offers, replicas, medication, and loans at unbelievably low interest rates, as is customary, during this season. Don’t get carried away by their cheap offers because no haute couture brand offers their products at such throw-away prices. We again would like to remind you not to get lured into giving your email credentials without first finding out that the Web site you are shopping on is legitimate and real.

We would like to highlight a few more tricks that spammers have pulled out of their hats this Christmas...

In October 2010, a phishing site of a bank was observed that used fake offers of mobile phone airtime as bait. A similar trend was reported earlier in the phishing of a social networking site. To read more on the trend, please refer to “Fraudsters Offering Free Mobile Phone Airtime”.

In this particular attack, the phishing site spoofed the login page of a popular Italian bank. Upon entering the login credentials, the phishing page requested that the customer choose from a list of four mobile service providers. After the service provider was selected, the page requested the customer’s mobile phone number and the amount of airtime to recharge. The phishing page claimed that 40 Euros would be given as a bonus in addition to the amount selected for recharge. This fake offer of a bonus is the bait used by fraudsters in the hopes of tempting customers to give away...

Since the last week of August 2010, Symantec has been observing a massive phishing attack on a popular Indian bank. To date, we have recorded over one thousand phishing URLs that have spoofed the bank’s website. This has increased the total count of phishing attacks on Indian brands from the previous month by a whopping 192 per cent.

In this case, users who clicked the phishing URLs are prompted to verify their accounts to continue access of online services. Fraudsters typically use this strategy in an attempt to con users into giving away their confidential information. The fake verification asks for the user’s ID with password, transaction password, ATM/Debit card number, and mobile number.

After the sensitive information is entered and the “Verify” button clicked, the user is automatically redirected to the page shown below. Here, the user is asked to enter their...

中国のスパマーたちは、間もなく訪れる中秋節（Mid-Autumn Festival）と国慶節（National Day）を利用しようと活発な動きを見せています。今年は、9 月 22 日が中国の中秋節（月祭り）にあたります。また、10 月 1 日は、中華人民共和国の建国（1949 年 10 月 1 日）にちなんで国慶節と定められています。市民も企業も、この時期に贈答品を贈り交わす習慣があり、スパマーたちはこの数週間にいろいろなアイデアを駆使しています。これらのスパムメッセージは、ほとんどが卸売業者からのものです。電子メールの本文には、中秋節と国慶節に向けた贈答品の宣伝や、割引商品の案内が記載されています。シマンテック製品では、各種のスパムフィルタ手法によってこうしたスパムメッセージを遮断できます。

シマンテックで確認されたサンプルを以下に示します。

ヘッダー:

差出人: <詳細は削除済み>

件名: 最新套餐

翻訳:

件名: 最新の詰め合わせギフト

本文の翻訳:

<詳細は削除済み> 茶

中秋節と国慶節の贈答品、弊社が負担します!

（全国 888 セット限定）

「お茶とギフト」: 最高級 <詳細は削除済み> 茶

ヘッダー:

差出人: <詳細は削除済み>

件名: 中秋節の贈答品

本文の翻訳:

「香港 <詳細は削除済み> 月餅」
中国の月餅、卸売（中秋節の贈答品）

<有名銘柄の月餅のリスト、菓子店の宣伝>

共同注文の場合/詳しくはお問い合わせください! 電話番号: <詳細は削除済み>

Ms. Huang

...