Security News Collected by AWSODA-SYSTEMS: 2008-07-27

Here are the latest updates for security-news@awsoda.net

A phishing email uses a novel-sounding concept that can sound alarming enough to get unsuspecting users to click on the available links and land themselves in danger.

Trend Micro Content Security team recently came across a Bank of America phishing site which shows users that their online accounts are recently “logged on from an unregistered computer using a foreign IP without an International Access Code (IAC).” Here's a screenshot:

Figure 1. Newly discovered page warning the user of a possible intruder attempt at accessing his/her accounts.

When the verification link is clicked, the page opens a new window containing the phishing page. Users who have fallen for the breach alert will be more than willing to enter their credentials into the login page which, of course, turns out to be absolutely fake. Here is a screenshot of the phishing page:

Figure 2. The verification link in Figure 1 leads to this Bank of America phishing page.

A familiar but still effective phishing technique lends a false sense of credibility to this attack: the use of address bar spoofing to hide the real phishing URL. As seen in the screenshot below, checking the Properties of the phishing page (by right-clicking anywhere on the phishing page and then clicking Properties) shows that the real URL is different from that displayed in the URL address bar.

Figure 3. The URL of the phishing page in Figure 2 is fake. Here we see the real phishing URL in the page’s Properties section.

Users are reminded that banks have never been known to register their clients’ computers to their online banking systems. Although we have yet to see specific spam messages pointing to the site in Figure 1, an attack leveraging these made-up sites will not be too long in coming. Trend Micro Smart Protection Network already blocks this phishing Web site.

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'Phishing Site Claims Bank Monitors IPs'

Phishers Hit Multiple Banks with One Stone

A spoofed Web site that bears a close resemblance to the legitimate Internal Revenue Service Web page was recently encountered by the Trend Micro Content Security Team. Distributed through spam, the phishing URL http:// {BLOCKED}xxx.javabien.fr/, can be seen in the status bar when the cursor is hovered over the visible link as well as when the email is viewed via a text editor such as Notepad.

Figure 1 Sample of spam containing link to phishing site

The phishing site displays a message telling the user that they are eligible to receive a tax refund of a specific amount. But here comes the interesting part: the user is then asked to select the bank to where the supposed “tax refund” will be credited through a drop-down menu that is displayed in the page.

Figure 2 Screenshot of phishing site

Upon selecting a certain bank, the user will then be redirected to a spoofed login page of whichever bank they had chosen. Below are screenshots of spoofed login pages from the said list:

Figure 3 Spoofed Bank of America login page

Figure 4 Spoofed Capital One login page

Figure 5 Spoofed Wachovia login page

All spoofed login pages of course prompts the user to enter their account credentials. This is a really clever attack; phishers are now making the users unknowingly choose for themselves which phishing attack will apply to them.

The URL of the phishing site is now blocked by the Trend Micro Smart Protection Network.

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'Phishers Hit Multiple Banks with One Stone'

Another al Qaeda News Spam, Now on Video

It seems like al Qaeda are the terrorists of choice for spammers. Just recently, spammed messages claiming to contain news on Osama bin Laden and the al Qaeda terrorist network were found by Trend Micro researchers. Now here's another one, and it comes with a video.

The spam claims to be from El Comercio - a popular news site in Lima, Peru. It tries to lure users by placing a malicious link that supposedly leads to a video download of Al-Qaeda about their attempt to attack Peru last July 28, 2008.

Figure 1.1 Spam that claims to be from El Comercio

Aside from El Comercio, spammers also used CNN to lure users into clicking the malicious link. Below is a screenshot of the said spam email.

Figure 2.1 Spam that claims to be from CNN

Clicking the link to download the video opens an instance of the user's Internet browser and prompts the user to save the file.

Figure 2.2 Displayed message upon clicking the link on spammed messages

The video file Video_amenaza+Al-Qaeda.exe is detected by Trend Micro as TROJ_DROPPER.ODZ

Users are already protected from this attack by the Trend Micro Smart Protection Network. Spam runs banking on current affairs are really, old news. But as long as people keep falling for them, spammers will keep on using them.