Category: Uncategorized

Clever new spam ruse

A new method of spamming is being used by the typical Viagra/Levitra/Cialis crew.

First, you get an email like this inviting you to join a Yahoo group:

Yahoogroups1234988

Cute. This is a form of reputation hijacking, where a completely legitimate service (Yahoo Groups) gets right through all spam filters.

Clicking “Join this group!” gets you to the standard Yahoo Groups page. Except it’s got an ad for spammed prescription meds.

Yahoogroups1234988a

Of course, the purpose is not to get you to join any group (or as a phishing attempt, as some might think). It’s simply a ruse to display an ad for spammed prescription drugs.

If you join, of course, you’ve just given a nice free gift as well — your email address to a Yahoo Group run by spammers.

Here’s the HTML code they’re using (for fun, see if you can spot the mistake they made).

Html2388812300

Reputation hijacking is a big part of the future of malware social engineering and spamming. Expect plenty more of the same.

Alex Eckelberry

SSH Scam sites update

Zlob Trojan Distributing site:
92.241.191.31 Cmplcoupler. com

Scam Internet Security Page:
84.16.228.142 Startedwebsite. com

404ErrorpageScam:
84.16.228.143 404dnswebsite. com

Security Guide Scam Page:
84.16.228.142 Linksyoulike. com

Ad-Server-Gate Pages:
84.16.228.143 Ygvtf. com
84.16.228.142 Mjuie. com

Protection Center Scam Page:
89.149.208.44 Websafenotice. com

Scam Security Toolbar site:
89.149.208.44 Baryouneed. com

IE AntiSpywareStore site:
208.72.168.94 Tryoutietool. com

Please stay clear of these sites.

Bharath M N

Blizzard of US Presidential malware

Following on F-Secure’s blog entry today, we’re certainly seeing a fair number of these. Subject lines include:

Obama’s Win Reshapes the Race
USA Election 2008 Results
Election Center 2008 – Election Results
Election 2008: Time lapse of U.S. counties
The new President’s cabinet?
Obama win preferred in world poll
Can Obama win popular vote but lose election?

And I’m sure more to come.

Be careful, alert your users, this thing is tricky..

Obama1238881238

Obama1238881238a

Obama1238881238b

Obama1238881238c

Obama1238881238e

Obama1238881238f

Obama1238881238g

Obama1238881238h

Alex Eckelberry

Halloween winners

Our contest winners for this year’s Halloween:

1st place went to Kara Kritzer in marketing:

Kara

2nd place went to Kendra Wallace (marketing) and Alanna Rubin (accounting) as dead dolls:

Kendra1231231

Alanna1231123

3rd place went Matthew Pratser (tech support) as the purple hippopotamus:

Matthew1231398813

4th place was tied – Amanda Dunphy (accounting) as a vampire and Eric Hanna (tech support) as Fatman not Batman.

Amanda12312312

Eric123138

Well done to the winners.

Alex Eckelberry

Let’s stop capitalizing “trojan”

If you write about malware, how many times a day do see something like this?

Trojan12398810

There’s absolutely no sound grammatical reason to consider the word “trojan”, in the context of malware, a proper noun.

This capitalization came from the original long-form, Trojan horse, which become shortened to “trojan”.

Spell checkers aren’t wrong to recommend capitalizing the word, since it very well could be a reference to a citizen of Troy (a Trojan), the Trojan horse, or even the USC Trojans. But I see no technical reason to capitalize the word itself in the context of malware, since it’s clearly a common noun.

One would capitalize Trojan when using the compound “Trojan horse” in the context of malware, given that this is the use of the original proper noun in an analogous context.

If you agree or think otherwise, comment!

Alex Eckelberry

EstDomains termination… stayed

Well, this is really frustrating. As DNW says it:

Domain registrar EstDomains might remain an accredited domain registrar after all.

Yesterday Domain Name Wire reported that EstDomains received a notice of termination from Internet Corporation For Assigned Names and Numbers (ICANN). ICANN cited the conviction of EstDomains’ president Vladimir Tsastsin for credit card fraud, money laundering and document forgery in February as the reason for the termination.

The company claims that Tsastsin resigned his position back in June, so the reasoning for ICANN’s termination is invalid. ICANN has issued a stay while it considers the matter. EstDomains will retain its accredited status during review.

More here.

You can see Estdomains’ request to ICANN here.

Alex Eckelberry

Murder of Stopzilla exec

A tragic story: Jessica (“Jess”) Kalish, an executive at IS3 (makers of the Stopzilla antispyware program) was found brutally murdered last Thursday. Police now allege that Carol Anne Burger, a Huffington Post writer from whom Jess was working through a divorce, killed her by stabbing her multiple times with a screwdriver (Burger has since committed suicide).

I first got to know Jess last December, when I blogged about the StopZilla toolbar’s use of Ask in its search results. She was a gracious, friendly, likeable person with a good sense of humor (and, endearingly, an appreciation of The Bard). Later, I met her in person in DC at the Antispyware Coalition meeting. Her equanimity and affable demeanor clearly brought value to her organization.

All of us here at Sunbelt extend our heartfelt condolences to her family and friends during this difficult and very sad time. I’m sure she will be missed by many.

Alex Eckelberry

A highly charged political blog entry

It’s the hip thing to do in tech these days:  Extoll the benefits of a candidate on your blog.

Well, I steer clear of politics on this blog. 

Except, there is one little thing: I live in Florida…

So, I’m going to play it safe and vote for both candidates!

See? Simple!

On another note, my father, God rest his soul, told me back in the 2004 election that what one of the parties needed was a jingle.

At the time, I thought it was rather quaint.  But having seen the incessant negative ads on both sides, I think of a kinder, gentler time — when all that really was required was a good jingle. So take some time this evening to take a look at a different time in our history of campaigns, at the LivingRoomCandidate.org.

See you on Tuesday.

Alex Eckelberry

Seen in the wild: Clever Bebo phish

You may receive a Bebo PM with something like this:

OMG TELL ME ITS NOT TRUE ABOUT YOU!
HEY DID YOU SEE WHAT THEY WROTE ABOUT YOU IN THEIR BLOG? LOL! TELL ME IT’S NOT TRUE. TAKE A LOOK AT AMYSBEBOBLOG. COM

Well, going to Amysbeboblog. com actually redirects to a Bebo phishing site.
Notice the domain, “beboq”.

Beboq1283881230900

Alex Eckelberry
(Credit to Johannes Betz for the tip)