Security News Collected by AWSODA-SYSTEMS: 2008-06-15

Here are the latest updates for security-news@awsoda.net

A spam that promises job openings are making rounds today, Sunbelt first reported. The bogus job offer comes from CareerBuilder.com and entices users to submit their résumés to a certain email address.The email message includes details like job description, qualifications, and other requirements to make it look legitimate. Here's a sample:

This is not the first time that malware authors targeted job hunters. Monster.com, a popular job recruitment site that houses a lot of curriculum vitaes and contact details was previously victimized by phishers as well. The job recruitment site also suffered from a major security breach, which was the working of a spyware detected by Trend Micro as TSPY_MAMAW.A.

Users are advised to be wary in sending their contact details because they may end up giving away their credentials instead of getting a job.

ShareThis

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'Spam Now Hiring'

Spammers Celebrate Classmates' Day!

Before one could get hired, spammers made sure you remember your school days. And they do this by way of celebrating Classmates’ Day, as seen on the spreading message below:

{Classmates

Clicking on the continue link takes you to a legitimate looking Classmates.com Web page, which prompts you to download a file to be able to see the video. In true spammer-malware author fashion, the downloaded file is an executable, which Trend Micro detects as a TSPY_PAPRAS variant.

This post will be updated as more information on the analysis of the downloaded file comes in.

ShareThis

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'Spammers Celebrate Classmatesâ€™ Day!'

Stock Spam Still Alive, Now Pushing AGMS

Pump-and-dump is not going out of style any time soon.

Content Security was able to catch spam that advertises the stocks of Angstrom Microsystems (NASDAQ: AGMS), which it claims are soaring and that now would be a good time to invest. This is after news of the company’s latest installation project was released to the public. This recent endeavor, at least according to the spam emails, will likely make Angstrom Microsystem’s stock prices soar.

Spam has often been used to influence stock prices, mostly to lure novice investors to purchase “hot” stocks. Interesting enough, this does lead to a short-term increase in share price. In most instances, however, these prices experience a sharp decline afterwards. This is one reason why it’s not usually in the interests of the company to send stock spam.

Moreover, the practice of sending stock spam is frowned upon by the industry, so as to discourage the manipulation of stocks by people with malicious intent. PinkSheets, a site dedicated to the listing of stocks, even marks stocks advertised by spam with a Caveat Emptor (Buyer Beware) mark.

Misspellings in these spam are enough to arouse suspicions with regard to its origins, as these are actually telltale signs that spammers are tying to bypass spam filters. Spam really is not a good source of information for investment purposes, so you’d be better off asking your trusted stock broker instead. Note that Angstrom has already commented on this spam run.

ShareThis

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'Stock Spam Still Alive, Now Pushing AGMS'

Storm Makes Fake Quake Felt

In early June, Storm creators inundated inboxes with love-themed email messages, as they are wont to do. Now, three weeks later, a new deluge of Storm spam is bringing news of a "new" earthquake that supposedly struck China.

There are several subject lines used, mostly referring to the earthquake. A sample of a spammed email message is as follows:

This does not seem to refer to the month-old Sichuan earthquake that devastated parts of the said country May 12th, but is rather bogus news meant to cast the upcoming 2008 Olympics in dangerous light (as can be inferred from a most telling line in the quoted text below). The link in the message body points to a Web site, where the following text appears (emphasis ours):

Strongest earthquake hits Beijing A new powerful disaster just occurred in China. The most deadly, 9 magnitude, earthquake took away million of lives in the heart of China, Beijing. Rapidly growing panic paralyzed life of Chinese capital. 2008 Olympic Games are under the threat of failure. Click on the video to see the details of this terrible disaster and choose either Open or Run.

The above text is followed by a supposed video which, when clicked, downloads a file named BEIJING.EXE. This is a malicious file detected by Trend Micro as WORM_NUWAR.YH.

Carrying "news" in spammed email messages that it issues is another old trick from Storm's social engineering book. After hitchhiking on real news the first time (after which it earned its "Storm" brand), Storm's subsequent headlines did not necessarily have to be true, as long as they still hinted of gloom and doom. These methods have been noticed as warnings regarding missile strikes and World War III were propagated.

Thus the latest development goes in this long-running malware family, which has so far been the most active in maintaining its social engineering calendar, churning out spam and malware on (or in anticipation of) red-letter dates — or, in this case, stringing together sensational headlines that trivialize genuine tragedies.

While not from the Storm botnet, aftershocks of last May’s real earthquake came in the form of a scam, targeting would-be donors to the rescue efforts in China. Of course, it seems particularly insensitive to either target those who want to help, or make up an incident that could revive fears so soon after such an event just came to pass for real, but compassion is not something one could expect from criminals.

Users of Trend Micro products with Smart Protection Network are already protected from the abovementioned spam. We recommend that others be careful not to click haphazardly on similar-sounding email messages that are unsolicited, as their curiosity and/or good intentions might work in malicious users’ favor.

ShareThis