Trojan phishing attack claims multiple victims
129867
From Russia without love Security watchers have discovered a string of malicious websites that install Trojan code, allowing hackers to compromise end-user banking credentials for more than 50 financial institutions and ecommerce websites.â¦
748717
All phishing attacks launched across the Internet come from one of just five networks of zombie PCs, according to research published by security firm CipherTrust this week.
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
528680
(InfoWorld) - Phishers have been using compromised MySpace.com accounts to attack unsuspecting Web surfers, security experts said Thursday. The attack is thought to have infected several thousand PCs according to reports from ISPs, said Johannes Ullrich, chief research officer for the SANS Institute. Ullrich has documented the issue on the SANS Internet Storm Center blog. Lawrence Baldwin, chief forensics officer with security vendor MyNetWatchman, discovered the threat Tuesday, and The Washington Post reported on it late Wednesday. Criminals have managed to install fake navigation bars on the top of MySpace.com user profile pages that, when clicked, lead to malicious computers that attempt to infect the victim's computer. The attack uses several known Internet Explorer flaws that have been fixed, so users who have installed the latest Microsoft patches are not at risk, security experts said. The code was installed on "maybe a few dozen," MySpace.com pages, most of which have been removed by administrators at the social-networking site, Ullrich said. MySpace.com representatives did not respond to requests for comment on Thursday. Two components comprise the attack. It attempts to install malicious botnet software on victims' computers, and it uses these infected computers to try to steal MySpace credentials in a phishing attack. Computers that are compromised by the attack become infected with malicious botnet software known as "flux bot," which makes them unwitting participants in the phishing scam. After the malicious Web site attempts to install the flux bot code, it then presents victims with a fake MySpace.com login page, which tries to extract their MySpace.com user name and password. Baldwin allowed one of his test computers to be infected with flux bot and found that attackers were remarkably successful at stealing passwords. "I operated as a flux node for about 12 hours and did a full audit of all the traffic coming into my machine. I was probably getting close to 60 MySpace users an hour surfing to my flux node. And at least a quarter of those actually gave up their credentials." Baldwin estimates that the attackers were using another 200 compromised flux bot machines in their attack. Because MySpace.com allows users to install their own HTML code and isÂ visited by such a large number of technically unsophisticated users, it has becomeÂ an attractive target for these types of attacks. Last December, hackers created a worm that quickly spread across MySpace.com, stealing user names and passwords. That worm exploited a flaw in Apple's QuickTime media player.
546335
A malicious Trojan disguised as a Microsoft update is being served up from a MySpace page for which the name and password appear to have been phished. The problem highlights the trouble to which criminal abuse of MySpace can lead.
609035
The latest information on phishing indicates that fraudsters are increasingly using malicious software to direct users to their deceptive sites.
207163
Thousands of credit card numbers and other personal data may have been compromised.
239180
User-generated Web content is becoming a target for hackers and cross-site scripting attacks on Web sites can lead to malware taking over the browsers of machines that use the sites.
40373
(InfoWorld) - Six men have been charged with orchestrating a phishing scheme that targeted AOL users, the U.S. Department of Justice said Wednesday. The men are accused of harvesting thousands of AOL e-mail addresses and then infecting victims' PCs with malicious software that would prevent them from logging on to AOL without entering their credit card numbers, bank account numbers, and other personal information. Under the scam, victims would receive fake e-mail greeting cards that would silently infect their computers with the log-on software, according to a grand jury indictment. Victims were also spammed with phoney e-mail messages that claimed to have come from AOL's billing department. "Due to a central server meltdown, your credit card information was lost," one such e-mail read, according to the indictment. "In order to enjoy your AOL experience and keep your account active, you must enter your credit card information within 24 hours." Some of the fake greeting cards claimed to come from Web sites such as Hallmark.com or BlueMountain.com, the indictment states. AOL users appear to have been the primary targets of the fraud, but others may also have been targeted, according to Tom Carson, a spokesman for the United States Attorney's office for the District of Connecticut. "The investigation is ongoing," he said. "I think we can say the bulk of those targeted were AOL users, but we can't say with 100 percent certainty that they were the only victims," he said. The accused are believed to have defrauded thousands of individuals, U.S. Attorney Kevin O'Connor said in a statement. "These are insidious crimes that wreak havoc on the lives of victims, and we will seek strict terms of imprisonment." The alleged scam was conducted over a two-year period, beginning in 2004, the U.S. Attorney said. Proceeds from the crime were used to purchase gaming consoles, laptop computers and gift cards, the indictment states. The men were actually indicted on fraud charges last week by a federal grand jury in New Haven, but the charges were not made public until Wednesday, when three of the men pleaded guilty. The three who have pleaded guilty face between two years and nine and a half years in prison, Carson said. They are Charlie Blount Jr., 22, of Branford, Connecticut, Richard D'Andrea, 22, of West Haven, Connecticut, and Thomas Taylor Jr., 20, also of West Haven. They are scheduled to be sentenced in mid-December. The three men awaiting arraignment are Michael Dolan, 22, of North Miami Beach, Florida, Keith Riedel, 20, of Winter Haven, Florida, and Daniel Mascia, 22, of West Haven. Dolan had previously been sentenced to two years of probation after pleading guilty to accessing a protected computer without authorization.
169088
(InfoWorld) - An attack this week that targeted online customers of at least 50 financial institutions in the U.S., Europe, and Asia-Pacific has been shut down, a security expert said Thursday. The attack was notable for the extra effort put into it by the hackers, who constructed a separate look-alike Web site for each financial institution they targeted, said Henry Gonzalez, senior security researcher for Websense Inc. To be infected, a user had to be lured to a Web site that hosted malicious code exploiting a critical vulnerability revealed last year in Microsoft's software, Websense said. The vulnerability, for which Microsoft had issued a patch, is particularly dangerous since it requires a user merely to visit a Web site rigged with the malicious code. Once lured to the Web site, an unpatched computer would download a Trojan horse in a file called "iexplorer.exe," which then downloads five additional files from a server in Russia. The Web sites displayed only an error message and recommended that the user shut off their firewall and antivirus software. If a user with an infected PC then visited any of the targeted banking sites, they were redirected to a mock-up of the bank's Web site that collected their login credentials and transferred them to the Russian server, Gonzalez said. The user was then passed back to the legitimate site where they were already logged in, making the attack invisible. The technique is known as a pharming attack. Like phishing attacks, pharming involves the creation of look-alike Web sites that fool people into giving away their personal information. But where phishing attacks encourage victims to click on links in spam messages to lure them to the look-alike site, pharming attacks direct the victim to the look-alike site even if they type the address of the real site into their browser. "It takes a lot of work but is quite clever," Gonzalez said. "The job is well done." The Web sites hosting the malicious code, which were located in Germany, Estonia, and the U.K., had been shut down by ISPs as of Thursday morning, along with the look-alike Web sites, Gonzalez said. It was unclear how many people may have fallen victim to the attack, which went on for about three days. Websense did not hear of people losing money from accounts, but "people don't like to make it public if it ever happens," Gonzalez said. The attack also installed a "bot" on users' PCs, which gave the attacker remote control of the infected machine. Through reverse engineering and other techniques, Websense researchers were able to capture screenshots of the bot controller. The controller also shows infection statistics. Websense said at least 1,000 machines were being infected per day, mostly in the U.S. and Australia. Â
84253
Scammers are sending out fake security bulletins that attempt to install malicious software on victim's PCs.
145645
InfoWorld - The latest information on phishing indicates that fraudsters are increasingly using malicious software to direct users to their deceptive sites.
437150
US consumers and businesses have lost an estimated $US500 million ($688 million) to the internet scam known as &quot;phishing&quot;, with seven out of 10 lured to fake websites, according to a survey.
562547
Fake patches, rogue invoices make the rounds as spammers continue trying to fool people into installing Trojans on their PCs.
573269
Virus hijacks PCs and uses them to send short message spam to mobile phones.
704436
(InfoWorld) - A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday. This is the first time that Storm has taken to the Web for its victims, said Dan Hubbard, head of research at San Diego-based Websense. "The big news is that Storm has added infecting sites to its arsenal," said Hubbard. Storm debuted in January but only cracked the top malware lists early this summer, and has become infamous for its ability to adapt its infection strategies. "They have a knack for latching onto the latest newsworthy events and capitalizing on the public interest in them," Symantec researcher Hon Lau said last month. "And if no newsworthy events are happening at the time, then they will just make them up." Until now, Storm has infected users via files attached to e-mail or through links embedded in spam. The change noticed by Websense's scanners, however, means that Storm's backers have moved to other attack vectors -- in particular, compromised Web sites that sport malicious IFRAMEs. Users visiting such sites are instantly infected with the Trojan if their browsers are not patched against whatever exploit the IFRAME code is throwing out. According to Hubbard, several hundred sites have been compromised by Storm's makers, then seeded with IFRAMES that can inject the Trojan into vulnerable PCs. One such site was a Republican Party Web site for the 1st Congressional District of Wisconsin. Within hours after Websense notified the site's owners, however, it had been purged of the dangerous IFRAME code. By mid-morning Friday, it was safe to visit. Hubbard did not know how the site was compromised. The motive behind Storm's continued attacks and its expansion into new areas like this, said Hubbard, is a never-ending appetite for bots -- compromised computers that can be used for spamming or other criminal activities either by the original attackers or by others who lease sections of the botnet. "Storm's botnet is clearly the biggest around," said Hubbard, who estimated its size as "conservatively, in the hundreds of thousands, although some people have thrown out numbers like 1 million or 2 million or even 4 million." Earlier this month, in fact, MessageLabs pegged the botnet at 2 million machines. In the last few weeks alone, Storm has spread through e-mails touting a real-time scoreboard site for National Football League games, spam hyping a Web site that wished Americans a happy Labor Day holiday, and more mail that used YouTube videos as bait. Computerworld is an InfoWorld affiliate
176286
Servers that managed global internet traffic have been subjected to a concerted attack by hackers.