4 X Security Team

Spammers radically changed their methods from what they used last year. If, at the end of June 2007, 60% of spammers used images in order to make people swallow the bait, the percentage dropped to 3% at the end of June 2008. On the other hand, after conducting a global study, BitDefender researchers noticed the revival of text spam – 70% of the spamming attacks are now text-based, compared with the 20% that was recorded last year.

"Plain-text continues to be the most prolific medium for e-mail spam istribution, especially due to its simplicity, reduced size and extreme versatility," said Vlad Valceanu, head of BitDefender AntiSpam Research Lab.
The methods used to spread malware in the first six months of 2008 were reported as being, in order, downloaders, malicious advertising, bundle applications, social engineering and information websites, autorun and file infectors, email spam and peer-2-peer networks.

As expected, considering the immense number of emails with a medical subject that are received by almost anyone, the team that works in the anti-virus field said that content related to drugs is the most used, worldwide, to spread malicious software. Replica watches placed second in the top of most popular subjects to be delivered by spammers via email.

Phishing tools were also popular in the first half of 2008. Those who were especially targeted were native English speakers from the US, UK or Canada, who were tempted with counterfeited offers, mainly from US banks and other financial institutions. Most of the messages were alarming, in order to make people react impulsively – they were relating about blocking or expiration of accounts, while also asking for private information that was to be used to enhance security.

"Spammers and phishers continued to improve their skills in replicating and forging legitimate message characteristics. However, the simple text e-mails proved their efficiency as well, rounding up the total figure of ID theft victims to 50,000 each month," added Vlad Valceanu.

[Source: softpedia]

According to research conducted by Internet security company TrendMicro, phishers are resorting to new ways of fooling users. The ever present URL to the phishing site has no longer been seen in numerous messages analyzed by TrendMicro. It would seem that instead the user is provided with a legitimate e-mail address.

A run of the mill phishing attempt involves the user receiving a spam message that directs that user to a phishing site. You will receive a message that goes something like "you need to update your bank account info, please click on the following link", but by doing so you will be directed to a web page that looks very similar to the one of your bank. And by filling in the requested information you are only playing into the hands of the phisher.

"But now, there’s no URL seen in new phishing email samples we’ve discovered. They display instead a legitimate email address. This is to trick users that the recipient of the user name and password they will send is a legitimate user, but looking at the source code of the mail, it would go to an individual email address, the phisher’s," says Aivee Cortez from TrendMicro.

One such spam message circulating on the Internet lately was informing users that they needed to upgrade their EarthLink account. As you might have already figured it out, the user is not asked to click on a link and visit a phishing site, but instead is asked to forward the username and password of the account to what seems to be the customer support e-mail address. Just to make sure the phishing attempt is successful, the message informs you that your account will be deleted unless you send out that information.

Enlarge picture

TrendMicro, company that specializes in Internet content security, reports that the Storm botnet is once again attempting to propagate its malicious software. The means to do so is by sending out spam messages which inform about a financial crisis that will engulf the world's economy. A link is of course provided and you are invited to click on it, but by doing so you may become infected with the Storm worm, and your computer will end up as just another zombie in the Storm botnet.



According to the spam message, the NACU (North American Currency Union) is secretly planning to bring the currencies of North America, Canada and Mexico together, and come up with a new currency called "amero".

Here is an excerpt from the spam message itself: "You can forget about dollars. The U.S. Government began to realize the plan to replace the Dollar with the "Amero", the new currency of the North American Currency Union. Canada, the United States of America and Mexico have resolved to unit in order to resist the Worldwide Financial Crysis. You can become acquainted with the plan of the implementation of Amero, just click on the icon underneath this text."

Users should be warned that there is no such organization, and there never was. It is all noting but a clever scheme that the spammer has come up with in order to make the message seem believable.

"Neither amero nor the North American Currency Union exists of course, as these remain ideas only, at least for today. Conspiracy theories abound, however; there are rumors about secret pacts between the United States, Canada, and Mexico, but these remain unsubstantiated. Last year, there were reports of the United States Treasury issuing amero coins, but this was later proven to be untrue," says Jake Soriano from TrendMicro.

As a rule of thumb you should not open unsolicited mail, but if you can’t resist the temptation, you should at least not click on any links provided in said mail. Keep in mind that believable, accurate news come from trusted sites and news portals, not from spam messages. Not only will you be misinformed, you will become infected and aid in the expansion of the Storm botnet.

[Source: softpedia]