BBB “Your Accreditation Terminated” Spam Spreads Cridex Worm

Spammers are extorting the Better Business Bureau brand in a new spam campaign focused on infecting computers with the Cridex worm.

The spam messages do their best to entice users to click the embedded hyperlinks by claiming that their BBB accreditation has been terminated due to consumer complaints. However, recipients should be able to tell that the email is a fake since it is riddled with mindless grammar & spelling mistakes. ("Beaureau"? Really?)

Below are two variants that are currently circulating:

Your Accreditation Terminated

The Better Business Bureau has been temporary Terminated Your Accreditation
A number of latest complaints on you / your company motivated us to transitory Abort your accreditation with Better Business Beaureau. The information about the our decision are available for review at a link below. Please pay attention to this question and let us know about your mind as soon as possible.

We kindly ask you to visit the SUSPENSION REPORT to respond on this claim

We are looking forward to your prompt response.

If you think you got this email by mistake – please forward this message to your principal or accountant

Faithfully yours

Dispute Consultant
Better Business Bureau

 

Dear Owner:

Your accreditation with [COMPANY] was Terminated

A number of latest complaints on you/ your company motivated us to transient Abort your accreditation with Better Business Beaureau. The details of the our decision are available at the link below. Please give attention to this problem and notify us about your mind as soon as possible.

We pleasantly ask you to overview the ABORT REPORT to reply on this situation.

If you think you received this email by mistake – please forward this message to your principal or accountant

We are looking forward to your prompt reaction.

Looking for info on additional ways your BBB Accreditation can boost your business? Visit the BBB SmartGuide.

Sincerely,
– Online Communication Specialist
bbb.org – Start With Trust

Users that make the mistake of following one of the links in the emails shown above will be directed to a third-party website hosting the infamous BlackHole exploit kit, which will attempt to take advantage of system vulnerabilities in order to drop Worm: Win32/Cridex.E on the visiting machine.

Upon infection, Cridex will modify the system registry to ensure it executes whenever Windows starts, inject itself into a variety of running processes, connect to a remote server to provide an attacker remote control, and copy itself to any removable drives attached to the affected system.

Keep Your PC Safe!

Given that this threat requires user-interaction, avoiding it should be relatively simple.

• Manually type in the URL of the website you wish to visit instead of clicking links in emails, especially if they are unsolicited.


• Do not download or open any files attached to unsolicited emails (or at least be sure to scan them first).


• Always keep your operating system and installed third-party software patched and up-to-date.


• Always run antivirus software that offers real-time scanning and keep the virus definitions current.

Too Late?

Did you already click the link in an email similar to the ones above?

Hopefully you’re running one of the 19 antivirus programs capable of detecting the Cridex worm, because you’re going to need to perform a system scan to detect and remove the infection. Hop to it!

[via Webroot]

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Malware is Everywhere [INFOGRAPHIC]

We all know that malware lurks around every corner, waiting for us to visit a booby-trapped website or open that zip file attached to an unsolicited email.

Cybercriminals across the globe have been busy creating and tweaking their malware creations, which they then unleash on unsuspecting users to do anything from steal sensitive data to demand ransom fees to partake in click fraud - and more.

What’s an internet user to do?

As they say, knowledge is power, and the folks over at Inspired eLearning have created the infographic to illustrate the dangers associated with malware along with steps that you can take to stay safe.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+

Malware Abuses Skype Chat to Spread Once More

Skype users should exercise caution when clicking links shared via chat as there has been an influx in malware using Skype in order to propagate.

Shylock Trojan

CSIS first warned of a new variant of the Shylock Trojan using Skype to spread thanks to its creators updating it with a plugin named “msg.gsm.”

Shylock typically spreads via drive-by-downloads, phishing emails, and removable drives attached to infected systems, but the new addition provided another infection method as it gave the Trojan the ability to abuse Skype’s chat feature to send messages containing links to malicious websites serving the malware.

Other functionality granted by msg.gsm includes sending IMs and transferring files, clearing chat and file transfer history, bypassing Skype’s connection warning/restrictions, and sending requests to a remote server.

That’s only a fragment of what Shylock is capable of, though. Shylock can allow attacker to perform a number of activities on an infected system, like inject malicious code into web pages, steal cookies, download and execute files, and more.

Thankfully, Microsoft has stated that they have managed to completely block Shylock (Microsoft detects it as Backdoor:Win32/Capchaw.N) on Skype, but the company still encourages users to avoid opening links from untrusted sources or visiting untrusted websites.

For those of you who may be concerned that you got hit with the threat prior to it being blocked, Microsoft suggests you watch out for the following symptoms:

• The presence of messages or files in your Skype conversation history that you do not recall writing or transferring


• Your Skype conversation history is empty


• You do not receive alerts or warnings from Skype, where previously you did so

Shylock is known for its advanced detection evasion techniques, so do what you can to prevent an infection (tips below).

Phorpiex Worm

Even if you do manage to avoid Shylock, you still have to worry about WORM_PHORPIEX.JZ, which TrendMicro says is also abusing Skype chat to spread.

Upon infection, Phorpiex will modify the system registry to bypass any firewalls and start whenever Windows does, open a backdoor by connecting to a specific IRC chat server and join the channel #go, send emails with malicious attachments containing a copy of itself, spread to accessible removable drives and download additional malware including a plugin appropriately named WORM_PESKY.A (“Pesky”) that will send out Skype messages reading:

LOL http://www.[REMOVED]x.uk.com/images/php?id=IMG0540250.JPG

Those of you who have read our guide on how to spot a dangerous image link will be able to tell that this link is not what it seems.

Pesky doesn't do much else beyond spam people with malicious chat messages; Phorpiex is the main threat here.

Protecting Your PC

So, now that you know what you’re up against, what can you do to protect your computer?

• Avoid clicking on suspicious links, regardless of where they come from. Both threats abuse Skype to send IMs, so the malicious link can come from one of your contacts if their machine has been infected.


• Do not download or open files that come from unknown or untrusted sources.


• Keep your operating system and installed third-party software fully patched and up-to-date to minimize the chances of a successful drive-by-download attack.


• Always run antivirus software and keep the virus definitions current.


• Use a Windows user account with limited privileges (i.e. no permission to install software).

What to Do if Your System is Infected

Already have the misfortune of encountering one of these threats?

For Shylock, Microsoft’s Threat Center states you can use Microsoft Security Essentials (or Windows Defender for Windows 8) to detected and remove it.

For Phorpiex, users can use antivirus solutions by TrendMicro, Microsoft, ESET or Ikarus to detect and remove it.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+

Spam Contributing to Increase of W32.Changeup Infections

Fraudulent spam messages purporting to be from financial institutions are one of the driving forces behind the recent uptick in W32.Changeup infections, report Symantec researchers.

In the spam message, users are instructed to download and open a file, securedoc.html.zip that’s attached to the email as it allegedly contains a secure message from their bank. In reality, that file contains a malicious executable file (.exe) that Symantec identifies as Downloader.Ponik.

Here is an example message that users should look out for:

Screenshot Credit: Symantec

Subject: You have received a secure message

You have received a secure message

Read you secure message by opening the attachment, securedoc.html. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it.

If you have concerns about the validity of this message, please contact the sender directly. For questions about e-mail encryption service, please contact technical support at 888.764.[REMOVED].

First time users – will need to register after opening the attachment.
Help – https://[REMOVED]/websafe/help?topic=RegEnvelope
About [REMOVED] Encryption – https://[REMOVED]/websafe/about

Should a user make the mistake of downloading and executing the file, they will be opening their system to a variety of malware infections. Downloader.Ponik kicks things off by connecting to a remote host to download the Gameover variant of the infamous ZeuS Trojan. Gameover download & installs W32.Changeup, Changeup then downloads additional threats, and so forth.

In addition to downloading malware, W32.Changeup is known for its ability to spread via removable and mapped drives by taking advantage of the Windows AutoRun feature. See Symantec’s write-up of W32.Changeup for more information.

Keeping Your PC Safe

Here are some tips to keep your computer safe from the Changeup worm:

• Do not download or install files attached to unsolicited emails. This is one of the most common infection methods used, and most companies do not send emails with file attachments.


• Always run antivirus software and keep the virus definitions current.


• Keep your operating system and installed third-party software fully patched and up-to-date.


• Scan removable drives before transferring or opening any files stored on them.


• Disable the AutoRun feature on your PC. (Instructions)

Is Your Computer Infected?

If you suspect that W32.Changeup has already made its way onto your system, you can run a full system scan using an antivirus solution capable of detecting the threat. The Changeup worm has been around for a few years now, so you have plenty of vendors to choose from:

• ESET [detected as Win32/VBObfus.GH]


• F-Secure [detected as Gen:Variant.Symmi.6831]


• Kaspersky[detected as Worm.Win32.VBNA.b]


• McAfee [detected as W32/Autorun.worm.aaeh]


• Microsoft [detected as Win32/Vobfus.MD]


• Panda [detected as Trj/CI.A ]


• Sophos [detected as W32/VBNA-X]


• TrendMicro [detected as WORM_VOBFUS]

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+

Dorkbot Worm Spreading via Skype Instant Messages

If you use Skype to stay connected to family and friends, be careful that you do don’t fall for an ongoing malware attack that starts off with an instant message like the one below:

lol is this your new profile pic? http://goo.gl[REMOVED]?img=[USERNAME]

Upon clicking the link, users eventually land on a download page for a file named SKYPE_[TODAY’S DATE].zip, which contains a malicious executable (.exe) file that will install a variant of the Dorkbot worm on the victim’s computer.

Once Dorkbot has been successfully installed on a user’s PC, it will open a backdoor to grant an attacker remote control of the machine. The Dorkbot worm gives attackers the ability to recruit the computer into a botnet & part-take in DDoS attacks, steal login credentials for a variety of websites (Facebook, Twitter, Google, PayPal, Netflix, etc.), inject iFrames into webpages, or download additional malware.

There have been reports that Dorkbot infections may result in the user being locked out of their machine thanks to the worm’s tendency to select ransomware as its choice of additional malware to download. Upon installation, the ransomware will hold the computer hostage until the user forks over a $200 fee.

Given that messages spreading the Dorkbot worm can come from friends on your Skype contact list and not necessarily random strangers, users are urged to remain vigilant when following any links that have been shared with them.

Tips to Keep Your PC Dorkbot-Free

1. Exercise caution when following shortened links shared via Skype or social network websites. Here are some tips on how you can investigate urls before clicking on them.


2. Do not download files from unknown or untrusted sources, and don’t forget to scan files before opening them.


3. If you plug a removable storage device into your PC, be sure to scan it with your antivirus software. Dorkbot – among other pieces of malware – are known to spread via USB thumb drives.


4. Always run antivirus software & keep the virus definitions up-to-date.

[via TrendMicro]

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

McAfee Warns of Bot Malware Spreading via Facebook Chat, Skype, GTalk, Pidgin & Other IM Services

McAfee is urging users to exercise caution when following links shared via chat as a crafty piece of malware is using a variety of instant messaging services to lasso as many systems as possible into its army of zombie computers.

The list of chat clients being exploited by this malware includes Facebook Chat, Skype, GTalk, Pidgin, MSN Messenger, Yahoo! Instant Messenger, and even ICQ.

The attack starts off with the user being presented with a chat window from an unknown contact containing a link to an “interesting” video, which is a common tactic used in Facebook scams.

Should the user make the mistake of following the link, the malware will be downloaded and installed on their machine [presumably via drive-by-download].  The malware is usually delivered in a file named Picturexx.JPG_www.facebook.com.

Once the malware has successfully infected a machine, it makes itself feel at home by:

• Bypassing the firewall directly with netsh using the command line “netsh firewall allowed program” and/or modifying the firewall policy & making a registry modification to add itself as an allowed program


• Editing the Windows registry to ensure it runs whenever the system is turned on or restarted


• Checking for anti-malware programs such as Microsoft Security Essentials, Kaspersky Antivirus, ESET Smart Security (or NOD32 Antirvirus), Avira Antivirus, and Windows Defender so it can disable them


• Changing the start page for Internet Explorer and modifying the preference files for Google Chrome and Mozilla Firefox

As if that weren’t bad enough, the bot malware receives commands from a remote attacker and begins pumping out malicious chat messages to others in order to collect more victims.

There is a light at the end of the tunnel, though. McAfee says that removing this malware from your system is relatively easy.

“We kill the running instances of this process using Process Explorer or Task Manager.” Niranjan Jayanand explained in a McAfee blog post on Wednesday, “The start-up entry made by the malware must be cleared as well to avoid its reloading after rebooting.”

To avoid having their computer recruited by the botnet malware, McAfee advises users to avoid clicking links from unknown sources and keeping their anti-malware/antivirus software up-to-date.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.

IRS Phishing Emails Link to Malicious Websites, Spread Cridex Worm

Any type of correspondence from the IRS tends to grab our attention. You know it, I know it, and judging by spam recently intercepted by researchers, cybercriminals know it too.

In their latest attempt to spread malware, spammers have started firing out bogus IRS notification emails stating that a recent tax payment was rejected, but the reason why won’t be revealed unless you click the link to view a Microsoft Word Document.

Here’s the email:

From: Internal Revenue Service (alerts[at]irs.gov)
Subject: Rejected Federal Tax transfer

Internal Revenue Service
United States Department of the Treasury

Your Tax payment (ID: [RANDOM NUMBER]), recently from your bank account was returned by the The Electronic Federal Tax Payment System.

Rejected Tax transaction

Tax Transaction ID: [RANDOM NUMBER]
Reason of rejection: See details in the report below
Federal Tax Transaction Report tax_report_[RANDOM NUMBER].doc (Microsoft Word Document)

Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

Spoiler: there’s no Word document.

In fact, when you click the link, you will be taken to a malicious site housing the Black Hole exploit kit, which will attempt to exploit vulnerabilities in Adobe Reader/Acrobat and Microsoft Windows Help and Support Center to drop malware identified by Microsoft as Worm:Win32/Cridex.E on the victim’s machine.

The attack is carried out silently in the background as the user is presented with a plain looking ‘Page Loading…’ page. Here's to hoping that users who click the link have antivirus capable of detecting the threat installed on their PC.

What to Do with IRS Spam

If you happen to receive the email above or another IRS phishing email:

• Do NOT click on any embedded links or download any files attached to the email.


• Do NOT respond to the email or provide any confidential information.


• Report the email to the IRS by forwarding it to phishing@irs.gov.


• Delete the email immediately.

[via Webroot][via Dynamoo]

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.

AICPA Spam Threatens to Revoke License, Launches Malware Attack

Cybercriminals are sending out hoards of bogus emails purporting to be from the American Institute of Certified Public Accountants in an attempt to trick certified public accountants into visiting a malicious site to plant malware on their machine.

The email, spotted by internet security researchers at both Webroot and Barracuda Labs, claims that the recipient has been busted for their involvement in income tax fraud and warns that failure to refute the allegations within the allotted timeframe will result in their license being revoked.

That’s a pretty good lie to feed to someone who you want to click before thinking. The legitimate looking HTML layout probably doesn’t help either.

Here’s a copy of the email (note that the wording and number of days given to respond may vary from email to email):

Image Credit: Barracuda Labs

Subject: Your accountant CPA license termination

You are receiving this message as a Certified Public Accountant and a member of AICPA.
Having trouble reading this email? View it in your browser.

Revocation of Public Account Status due to tax return fraud accusations

Dear accountant officer,

We have received a complaint about your alleged assistance in income tax return fraud for one of your employers. According to AICPA Bylaw Section 700 your Certified Public Accountant status can be revoked in case of the occurrence of submitting of a misguided or fraudulent tax return for your client or employer.

Please be informed of the complaint below and respond to it within 14 days. The failure to respond within this time-frame will result in cancellation of your Accountant license.

Complaint.doc

The American Institute of Certified Public Accountants.

Email: service@aicpa.org
Tel. 888.777.7077
Fax. 800.362.5066

To no surprise, the “Complaint.doc” link in the email leads to a compromised WordPress site that displays a segment of the same speech to the user while the malware attack is silently performed in the background.

Should the attack be successful – which it may very well be if you don’t keep Adobe Flash and/or PDF reader fully patched and run antivirus on your system – then Worm:Win32/Cridex.E will be installed on your PC to partake in evil activities like traffic monitoring, data harvesting, arbitrary file downloading and whatnot.

Any login information grabbed by Cridex will be uploaded to a remote sever controlled by the attackers, which the malware religiously connects to every 20 minutes.

What to Do If You Receive AICPA Spam

If you receive an email similar to the one outlined above, you are advised to:

• Avoid clicking on any of the embedded links.


• Delete the email immediately.

The AICPA is aware of this phishing scheme and they have been in touch with law enforcement.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+

Malware-Laced Traffic Ticket Spam Coming to an Email Inbox Near You

Don’t be fooled by any spam emails claiming that you’ve been busted for speeding.

Cybercriminals are giving traffic ticket spam another go, which means you will have the option to click on a malicious link or download an attached file laced with malware. It all depends on which spam message you get.

Regardless of the delivery method, the goal is still the same: infect as many computers as possible.

Below are examples of the traffic ticket themed emails currently making rounds, courtesy of computer security firms Webroot and Sophos.

NYC Traffic Ticket Spam Makes a Comeback

First up, the sample traffic ticket intercepted by Sophos:

Subject: NYC Traffic Ticket N(ID:  XXXXXXXXXXX)

New York State * Department of Motor Vehicles
UNIFORM TRAFFIC TICKET

NEW YORK STATE POLICE * POLICE AGENCY

Local Police Code

THE PERSON DESCRIBED ABOVE IS CHARGED AS FOLLOWS

Time: 7:18 AM
Date of Offense: 9/12/2011

IN VIOLATION OF
NYS V AND T LAW Description of Violation:
SPEED OVER 55 ZONE
TO PLEAD, PRINT CLICK HERE AND FILL OUT THE FORM

If the email seems familiar, it’s because it’s almost identical to the New York Traffic Ticket spam I wrote about in October 2011. The only real difference here is that the payload is delivered through a malicious link pointing to a site housing the Blackhole exploit kit versus a file attachment.

Upon visit, the exploit pack will attempt to exploit vulnerabilities within Adobe Flash or PDF to install malware on the target’s machine.  Sophos detects the threats associated with this attack as Troj/SWFExp-AI and Troj/PDFEx-GD.

Speeding Violation Spam Claims to Have Video Evidence

The traffic ticket spam email provided by Webroot was new to me. Instead of simply saying you had a ticket, it claimed to have video evidence that you had broken the law! Clever move, spammers.

Traffic police violation center.

Hello, your vehicle has been identified on Friar's Way as violating the red light traffic signal on [RANDOM DATE]. Please find the camera recording of your vehicle attached to this notification.

You can comply with this Violation notification as follows: Pay the sanction and surcharge, indicate you are not the driver, or contest responsibility.

Sun, 15 Jul 2012 15:04:04 +0400

Now, I’m sure most of us would want to see this alleged “proof,” but hold on just a second... did you see the name of the attached file (click to see the VirusTotal report, the file name is at the top)? It’s clearly not a police video.

Nope, it’s just the Gamarue.I worm, which is often the malware of choice attached to spam – just check a few other posts on our blog.

Don’t fall for any of these spam tricks, folks. If you really were busted for a traffic violation, any follow-up correspondence is likely to arrive via good ol’ snail mail. Think about it: when exactly did you disclose your email address to the authorities?

It’d still be a good idea to keep your OS up-to-date and run antivirus just in case you have a brief lapse in judgment. ;)

Photo Credit: amandabhslater

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.

New W32.Gammima.AG Variant Goes After Diablo 3 Accounts

Are you a Diablo 3 player?

Make sure you keep your operating system up-to-date and the virus definitions for your antivirus software of choice current.

Symantec researchers have identified a new W32.Gammima.AG variant that intercepts Diablo III communications to help thieves gather the login credentials they need to hijack player accounts.

Of course, the reason for this new & improved version of the malware is most likely due to the Real Money Auction House, which allows D3 players to use real money to purchase game items and gold.

W32.Gammima.AG’s focus isn’t limited to just Diablo 3, either. Gamers that play Arad, Lineage, Maple Story, The Kingdom of the Winds and World of Warcraft are also said to be targeted as well.

Researchers didn't disclose how they encountered the malware, but Gammima is known to spread through local drives and copy itself to removable storage devices. It's always wise to watch what you download and take the necessary precautions to protect yourself against drive-by-downloads.

Protect Your Diablo 3 Account

To protect their gaming accounts from cybercriminals, Symantec recommends that users:

• Keep their computer operating system fully patched and up-to-date.


• Run antivirus software and keep the virus definitions current.


• Use the account protection features offered by Blizzard Entertainment, which include Battle.net Authenticators (mobile app or physical key-chain) and option to receive SMS alerts of account changes. Blizzard requires the use of an authenticator to add/remove money to your Battle.net account balance anyway.

I personally have been using the Battle.net Authenticator mobile app since I first started playing, despite not having any intention to use the Real Money Auction House and it’s not that much of a pain to enter the code during login. Better to be safe than sorry!

[via Symantec]

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.

More "Bad Photo" Spam Hitting Inboxes, Inviting Users to Download Malware

Head's up, everyone! There’s another round of “bad photo” spam hitting inboxes.

This time the emails attempt to piqué your curiosity by either warning that a “police investigation is under way now” or that a set of revealing photos of your girlfriend have been leaked online.

Both emails encourage you to download an attached zip file named “Photo.zip.”

From: Kenny Kaps (KennyKapspery@gmail.com)
Subject: You can’t say I haven’t warned you, now enjoy the consequences.

Hello racer1164,

I got to admint your GF has a nice butt:) I just don't know how these photos leaked online. I don't think your GF in in adult business, isn't she?? anyway I received this picture from three of mine FB buddies today. It's in attachment

From: Chastity Rodeigues
Subject: The police investigation is under way now. You’ll be really sorry about what you’ve done.

Hate to bother you brianhaugen26,
Why did you have to put these photos online? All the hell is gonna break loose now, don't you understant? Take them down immediately! Don't tell me you don't know what photos I'm talking about! Check attachment!

If you guessed that these file archives contained malware, you’re right. A VirusTotal scan of the file attachments found that they both harbored malware that Microsoft detects as Win32/Gamarue.I.

Microsoft’s analysis of Gamarue.I states that upon infection, the malware makes registry edits, connects to a remote server to download additional arbitrary files and copies itself to removable drives when the opportunity presents itself.

That being said, if you receive any email messages similar to the ones shown above (or ones we’ve previously written about), it is recommended that you:

• Refrain from downloading or opening any attached files.


• Delete the email immediately.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Phony Amazon Order Confirmation Emails Help Spread Malware

Once again, cybercriminals are attempting to use the insane popularity of Amazon to trick users into following questionable email links.

Only, the latest variant of Amazon spam doesn’t just direct users to a pharmaceutical website like the bogus cancellation notices did.

No, instead the fake Amazon order confirmation messages will lead you straight to a malicious site that will attempt to install malware on your computer.

The Bait: Bogus Amazon Order Confirmation Email

Characteristics of the spam messages spotted in the wild:

• The sender's name is “Amazon.com.”


• Subject lines used:  “Your Amazon.com Kindle e-book order confirmation” or “Your Amazon.com order confirmation.”


• The billing address, price and ordered item appear to be randomly generated.


• All of the embedded links point to third-party websites (compromised WordPress sites) and NOT Amazon.com.

The Attack: Courtesy of BlackHole Exploit Kit

Should you make the mistake of clicking on a link within a fraudulent Amazon order confirmation email, you will see a blank page reading:

“Amazon.com Order confirmation

Loading your book

Order ID: Loading…

Print Date/Time [timestamp]”

Meanwhile, the Blackhole exploit kit will work silently in the background, attempting to exploit vulnerabilities within the Microsoft Windows Help & Support Center, Adobe Flash Player, Adobe Reader and Adobe Acrobat to drop malware identified as TROJ_CRYPTOR.TH (TrendMicro) & Win32/AutoRun.Spy.Banker.P (NOD32) on your system.

Keeping Your PC Safe

To avoid falling for this attack, it is recommended that you:

• Keep your computer’s operating system and software fully patched with the latest updates.


• Always run antivirus software that offers real-time scanning and keep it up-to-date.


• Avoid clicking links within emails; type the URL of the website you want to visit directly into your browser address bar.

What to do with Amazon Spam

If you received this email or one similar to it:

• Do not click on any links.


• Report the email to Amazon.


• Delete the email.

[via Webroot & GFI Labs]

Email Screenshot Credit: Webroot

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+

Worm Spreading via Facebook Messages & Chat

It may be worthwhile to put our URL investigative tips to good use before following a shortened URL shared via private messages or chat on Facebook.

TrendMicro warns that malware is currently being spread via private and instant messages on Facebook containing a short link leading to a file archive, “May09-Picture18.JPG_www.facebook.com.zip.”

If said archive is unzipped and the contents opened, the system will be infected by a worm identified as WORM_STEKCT.EVL, which will disable whatever antivirus software is installed on the affected machine and connect to a remote site to send and receive information.

One of those “pieces of information” is another worm identified as WORM_EBOOM.AC.  Once WORM_EBOOM.AC is on your system, it will become your virtual social stalker and monitor all of your posting/browsing activities on Facebook, Myspace, Twitter, WordPress and Meebo. Occasionally it may fire off a message or two of its own that include a link that will help spread the infection.

Tips to Stay Safe

Not really into the idea of either of these worms making their way onto your PC? I don't blame you, so here are a few bits of advice on how to stay safe:

• Be cautious of links you follow and make an effort to do a little homework on links that appear suspicious.


• Don’t accept prompts to download/save a file if you didn’t initiate the download process and never download files from untrusted sources.


• Always use antivirus software and make sure it’s kept up-to-date.


• Minimize your chances of being messaged by a spammer/scammer by changing your Facebook privacy settings to only allow Friends or Friends of Friends send you messages.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

BBB Warns of Phishing Emails with Malicious File Attachments

The Better Business Bureau is warning small businesses and consumers across the country about a phishing email campaign using the BBB's trusted name to dupe users into downloading malicious file attachments.

In the attack, users receive an email stating that a complaint has been filed against them with the Better Business Bureau and details of the complaint are included in a zip file attached to the email:

Subject: BBB assistance Re: Case #508067
From: Better Business Bureau (abuse@bbb.org)
Thu, 10 May 2012 17:40:47 +1200

Hello,

Herewith the Better Business Bureau informs you that we have been sent a
complaint (ID ) from a customer of yours in regard to their dealership with
you.

Please open the COMPLAINT REPORT below to findthe details  on this question
and suggest us about your position as soon as possible.

We hope to hear from you shortly.

Kind regards,

Arnold Melendez

Dispute Counselor
Better Business Bureau

The attached file, named “BBB report.zip” contains malware that Microsoft Security Essentials detects as Gamarue.F, which is the same piece of malware currently being spread by DHL spam.

Once Gamarue.F infects your machine, it will edit Windows registry files to make sure it runs on system start up, connect to remote servers to download additional arbitrary files and copy itself to removable drives.

What Should You Do if You Receive a BBB Phishing Email?

The Better Business Bureau has offered the following advice to anyone that receives an email that looks like it is about a BBB complaint:

• Avoid clicking on any links or file attachments.


• Read the email carefully to pick up on any signs that it may be fake: poor grammar, spelling mistakes or use of generic greetings such as “Dear member” instead of your actual name.


• Delete the email from your computer completely by hitting the "delete" button and emptying your computer’s “trash can” or “recycling bin.”


• Keep your antivirus software current and run a full system scan.


• Contact your local BBB office if you’re not sure whether or not the email is authentic.


• Forward the email to the BBB’s security team at phishing@council.bbb.org . (Note: There’s no reason to resend the email if you receive a “bounce” message.)

Have you received any BBB spam?

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

DHL Spam Delivers Malware Right to Your Email Inbox

Stay on your guard, another round of DHL spam is hitting inboxes.

Why? To infect your computer with malware of course!

Yes, the real delivery associated with DHL spam is the Win32/Gamarue.F worm contained within the “DHL delivery ticket.zip” archive attached to the email.

Should Gamarue.F may its way onto your PC, it will connect to remote servers to download arbitrary files and spread to removable storage drives when the opportunity arises.

According to a VirusTotal email scan report, only 13/42 antivirus applications will detect the malware, so here’s to hoping you have one of them should you make the mistake of downloading and opening the file.

Thankfully it won’t be terribly difficult to spot the DHL spam emails if they’re anything like the two copies we got. Although the spam messages came from spoofed DHL.com email addresses (MaximilianGiannavola[AT]dhl.com & MeredithVink[AT]dhl.com), they were addressed to one of the other recipients, which were all visible in the “To:” field.

Here’s a copy of one of the emails we received:

Dear [EMAIL], with this message we notify you that shipment at your destination, tracking ID  #348175, has FAILED  due to an address mismatch. To claim your parcel please  print out the attached document and contact DHL US support

Feel free to contact us with any further questions.

If you would like to speak to a DHL Express Support Agent, please call the DHL Service Desk at 1-800-527-7298.

What to Do If You Receive DHL Spam

Did a DHL spam message like the one shown above arrive in your inbox? We advise you to do the following:

• Avoid downloading or opening any attached files.


• Delete the email immediately.

DHL is aware of the emails going around (after all, this is not the first batch to be sent) and have already posted an advisory notice on their website.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

LinkedIn & BBB Spam Driving Traffic to Compromised WordPress Sites Spreading Cridex Malware

Cybercriminals are actively spamming out fraudulent emails purporting to come from trusted companies like the Better Business Bureau and LinkedIn in order to direct users to compromised WordPress sites housing exploit kits.

Both TrendLabs and M86 Security have taken notice to the mass compromise of websites running on the popular WordPress blogging platform and the corresponding spam campaign that’s striving to infect as many computers as possible with the Cridex Trojan.

The attack starts out by the user receiving a spoofed email stating they've received LinkedIn invitations and have pending messages or that a customer has filed a complaint about their company with the BBB, as the sample email shown below claims:

Screenshot Credit: TrendLabs

Subject: Better Business Bureau complaint

Attn: Owner/Manager

Here with the Better Business Bureau would like to inform you that we have received a complaint (ID XXXXXXXX) from one of your customers in regard to their dealership with you.

Please open the COMPLAINT REPORT below to find the details on this matter and inform us about your point of view as soon as possible.

We are looking forward to your prompt reply.

Regards,
Gerard Johnson

Dispute Counselor
Better Business Bureau
Council of Better Business Bureaus

4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

When the user clicks on the link to review the (non-existent) complaint - or pending LinkedIn messages - they will be taken to one of the compromised WordPress sites, ultimately leading them to the residing [Phoenix or Blackhole] exploit kit  that would attempt to leverage vulnerabilities within Adobe Reader and Acrobat (CVE-2010-0188) and Windows Help Center (CVE-2010-1885) to infect the target machine with WORM_CRIDEX.IC (Cridex).

When executed, Cridex will attempt to download its configuration files from a remote server.

Cridex is said to have capabilities similar to ZeuS and SpyEye banking Trojans, including the ability to:

• Take screenshots of every webpage accessed by the user in real-time.


• Blacklist and redirect URLs.


• Intercept browser requests and change the displayed content according to its configuration file in order to trick the user into entering private information.

All of the information captured by Cridex is then uploaded to a remote C&C server.

To avoid being hit by this malware attack, users are advised to exercise caution when following links within unsolicited emails. Traps like these can typically be avoided by taking a moment to hover your mouse over a link to see what the true destination URL is.

WordPress site owners can minimize the chances of their website being compromised by avoiding WordPress plug-ins with known vulnerabilities, using strong FTP credentials and exploring the numerous ways to help secure WordPress.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Don’t Download ZIP Attached to ‘Photo from your Ex’ Spam

Did you get an email allegedly containing a photo from your ex? Don’t let curiosity get the best of you (or your PC) and download any files attached.

Spammers are determined to trick users into believing that some random person is forwarding them an unflattering picture shared by an ex in hopes of them downloading malicious files containing malware.

Since yesterday morning, we’ve received 3 emails tied to this spam campaign:

Email #1:

 From: ToniFanucchi (BrigitVittekamsew[at]mail.com)
Subject: Your ex sent me this pciture of you.

Hi [EMAIL],
Your ex sent me this (in attachment). She might be a b*tch all right, but I laughed hysterically. You should kill her now probably :).

Email #2:

From: SavannaLandon (PagetPellegrinny[at]mail.com)
Subject: “Your photo from your ex”
Hi [EMAIL],
I got this photo from your ex. You look really bad naked. See attach.

Email #3:

From: AleaseCanupp (LizaManselhw[at]mail.com)
Subject: “You should kill your ex after this photo”
Hi xtimehealsx@yahoo.com,
I have this picture of you from your ex. I know this is cruel but I laugh like mad when I saw it.

All three emails had an archive named “Photo.zip” attached, which contains the Gamarue.B worm that we’ve seen in similar spam messages.

As we’ve previously warned, once Gamarue.B makes its way onto your PC, it will modify registry keys to ensure it runs on Windows start up, connect to a remote server to download additional malware and copy itself to removable drives to spread its infection even further.

If you receive any emails claiming to contain a photo from your ex, it’s strongly recommended that you do NOT download any files attached to it and delete the email immediately.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Don't fall for 'Is it really you in this picture?' spam

“Is it really you in this picture?”

That was the subject line for one of three “bad photo” spam messages that we’ve encountered over the last few days.

For months, cybercriminals have been launching an assortment of phishing attacks and scams that lure victims in by claiming they’ve found a funny picture or bad blog about them. Typically the scams have been conducted on Twitter, but it was only a matter of time before cybercrooks decided to give email a try.

Although, when delivered via email, the goal is not necessarily to hijack your social media accounts, but infect your computer with malware that’s capable of doing much more damage.

Here are the two variants of the 'Is it really you in this picture?' spam campaign that we received:

From: CecilAgredano(at)mail.com
Subject: Is it really you in this picture?

Cheers [EMAIL], what the hell is this photo supposed to mean? Who's that b*tch with you???

From: TheclaVescovi(at)mail.com
Subject: Is it really you in this picture?
What's up [EMAIL], O boy you look so funny naked! Don't share your naked photos again : )

Both emails had a file archive named “Photos.zip” attached to it. Of course, the archive was housing malware, which was identified as the Gamarue.B worm. (If the name seems familiar to you, it’s because Gamarue is the exact same malware being pushed in the USPS and “parking violation” spam messages we recently warned you about.)

Remember, it’s never a good idea to download and open files attached to unsolicited emails as the chances are high that it contains malware.

If you receive an email from an unfamiliar email address asking if it’s really you in a picture, claim they were sent a photo of you from your ex or that they “can’t believe what they see in this picture,” it’s recommended that you either delete the message or scan the file before downloading it.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Twilight Author's Site was Compromised to Serve Malware

If you’ve recently visited the website of Stephenie Meyer – author of the insanely popular Twilight book series – then you will want to scan your computer for malware.

Researchers at Avast! antivirus security firm recently found that hackers had injected malicious JavaScript code into Meyer’s official website that exposed unsuspecting site visitors to the Crimepack Exploit Kit.

Like other exploit kits, the Crimepack Exploit Pack attempts to leverage system vulnerabilities – which, of course, are usually associated with Java or Adobe PDF Reader – in order to plant malware on the target’s machine.

There's no word on how long the malicious code was present on Stephenie Meyer's site, but the website has been scrubbed of the evil code. Unfortunately, those who had horrible timing of paying her site a visit during the attack are still stuck with the aftermath of playing computer clean-up.

The internet is a dangerous place and this should serve as a reminder that it is critical that you keep your computer operating system and software up-to-date with the latest security patches. Running antivirus software at all times will definitely help, too.

Failure to do so can easily result in a system infection.

Image of malicious Javascript credit: Avast!

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Spammers Modify Content in USPS Spam, Continue to Spread Malware

Head’s up, everyone!

It appears that cybercriminals have switched up the body of the malicious USPS spam messages that they’ve been pumping out for the last few months.

The latest variant we received was titled, “USPS Delivery failure” and did not have a spoofed USPS.com or .gov sender’s address like the other spam messages did. Instead, this bogus USPS message appeared to come from "LilianaLevielle[at]riaa.com".

In addition to the sender address change, cybercrooks opted to use fake tracking numbers in lieu of a failed delivery date.

Here’s a copy of the email:

Dear [EMAIL ADDRESS THAT ISN’T MINE],

Your item delivery tracking number 0720275 has failed. We were unable to deliver the package to the address specified. You can adjust the shipment details online by filling out the form attached to this message. Thank you.

USPS Customer Service®
1-800-ASK-USPS®
Mon-Fri — 8:00am - 8:30pm ET
Sat — 8:00am - 6:00pm ET
Sun/Holidays — Closed

Of course, there’s no “shipment details adjustment form” in the USPS report.zip file that’s attached to the email.

A scan report of the file attachment reveals that it’s housing the Gamarue.B worm, which the same malware being spread by the parking violation spam message we wrote about yesterday.

After it infects a PC, Gamarue.B will modify registry keys to ensure it runs on Windows startup and open a backdoor to download additional malware and allow an attacker to remotely control your PC. Depending on the configuration, Gamarue.B is also known to copy itself to removable drives in order to spread the infection.

If you receive this new USPS spam email, be sure to toss it into your email’s trash folder without downloading or opening any attached files.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.