Contributor: Avdhoot Patil
Celebrity scandals are always popular and phishers are keen on incorporating them into their phishing sites. Recently, we observed a phishing site featuring British singer and actress Rita Ora. The phishing site was hosted on…
In the last few weeks we have observed a drastic increase in “penny stock” spam emails. In 2011 Symantec published a blog entitled Global Debt Crises News Drives Pump-and-Dump Stock Scams, which also dealt with this type of spam.
Penny stocks, also known as cent stocks, are shares in small companies that trade at low prices, often as low as a few cents per share. Penny stocks are a very popular topic used by spammers. The spam emails advertise the cheap shares and state that the company is on the verge of becoming very successful and that the value of the shares will rise significantly. The emails make out that the company is more valuable than it actually is and implies that they have just created some major product or are on the verge of a breakthrough and that the share value is tipped to rise dramatically. The aim is to increase sales of the stock, which in turn raises the value, then the fraudster can sell their penny stocks for significantly more than they paid for them. This stock fraud method is known as “pump and dump.”
We are seeing various spam methods being used in stock spam such as broken words, obfuscation with irrelevant line spaces, and insertion of randomized characters in the header or body of the emails etc.
Figure 1. Penny stock spam emails
Symantec is observing an increase in spam volume related to stock spam, which can be seen in the below graph.
Figure 2: Volume trend of stock spam email
Below are the most frequently observed subject lines in these attacks:
Symantec advises users to be cautious when handling unsolicited or unexpected emails and to update antispam signatures regularly. Symantec is closely monitoring these “pump and dump” spam attacks and will continue monitoring this trend to keep our readers updated.
The 58th season of the UEFA Champions League is coming to an end with the final being played on May 25 at Wembley Stadium in London. Nowadays, cybercriminals are gaining a lot of interest in football, at least inasmuch as how to exploit interest in foo…
Contributor: Binny Kuriakose
People dream big when buying expensive items like a car or a property. When those dreams are seen with very affordable price tags it certainly attracts everybody’s interest. There are lots of websites available …
Mother’s Day is celebrated in many countries on May 12 and it’s a day for children, regardless of age, to express their love to their mother by giving her a gift. Spam messages related to Mother’s Day have begun flowing into the Symantec Probe Network. Clicking the URL contained in the spam message automatically redirects the recipient to a website containing a bogus Mother’s Day offer upon completion of a fake survey.
Figure 1: Survey spam targeting Mother’s Day
Once the survey is completed, a page is then displayed asking the user to enter their personal information in order to receive the bogus offer.
Figure 2: Fake survey
Figure 3: Bogus Web page asking for personal information
We recently blogged about the persistence of spam with .pw URLs and not surprisingly a lot of the Mother’s Day spam messages contain .pw top-level domain (TLD) URLs. The following are some examples of the From header using .pw URLs that we have identified to date:
Figure 4: Another dodgy website related to Mother’s Day
Symantec is observing an increase in spam volume related to Mother’s Day, which can be seen in the following graph.
Figure 5: Volume of Mother’s Day spam
The following are some of the Subject lines observed for these spam attacks:
Symantec advises our readers to use caution when receiving unsolicited or unexpected emails. We are closely monitoring Mother’s Day spam attacks to ensure that readers are kept up to date with information on the latest threats.
Have a safe and happy Mother’s Day!
Last week, Symantec posted a blog on an increase in spam messages with .pw URLs. Since then, spam messages with .pw URLs have begun showing up even more.
Figure 1. .pw TLD spam message increase
Symantec conducted some analysis into where these attacks are coming from in terms of IP spaces. As expected, Symantec observed a large quantity of mail being sent from an IP range and then moving to another IP range. While this is an expected behavior, there was an interesting twist. There were multiple companies (with different names) hosting .pw spammers using the same physical address in Nevada.
Examining messages found in the Global Intelligence Network, Symantec researchers have found that the vast majority of spam messages containing .pw URLs are hit-and-run (also known as snowshoe) spam. The top 25 subject lines from .pw URL spam from May 1, 2013 were:
In addition to creating anti-spam filters as needed, Symantec has been in contact with Directi and working with the registrar to report and take down the .pw domains associated with spam. Symantec believes that collaborating with the registrar is a more progressive and holistic approach to solving this problem.
For that past several days, Symantec has observed an increase in spam messages containing hexadecimal obfuscated URLs. Hexadecimal character codes are simply the hexadecimal number to letter representation for the ASCII character set. To a computer, he…
寄稿: Avhdoot Patil
フィッシング詐欺の世界では最近も変わらず、サッカーが大人気のようです。2012 年にも、サッカーを利用したさまざまなフィッシング攻撃が確認されましたが、フィッシング詐欺師は早くも 2014 年の FIFA ワールドカップに熱い視線を注ぎ、有名選手やサッカークラブを狙っています。リオネル・メッシ選手のファンを狙った詐欺や、FC バルセロナを利用した詐欺は、そういったフィッシングの一例です。たくさんのファンが付いている有名選手を利用すれば、標的も膨大な数にのぼり、結果的に個人情報を収集できるチャンスも大きくなることを詐欺師は知っています。2013 年 4 月にもこの傾向は続き、同じようなフィッシング詐欺の手口が横行しています。今回のフィッシングサイトは、フランスにある無料の Web ホスティングサイトを利用していました。
このフィッシングサイトでは Facebook のログイン情報を入力するよう要求します。ページにはリオネル・メッシ選手、FC バルセロナ、あるいはクリスティアーノ・ロナウド選手が目立つようにデザインされています。フィッシングページには彼らの画像が掲載され、いずれかの正規の Facebook ページであるかのような印象を与えます。なかには、「first social networking site in the world（世界で最初のソーシャルネットワークサイト）」というタイトルの偽サイトまでありました。ユーザーは、Facebook ページにアクセスするために Facebook のログイン情報を入力するよう求められます。ログイン情報を入力すると、ログインが有効であると思い込ませるようにリオネル・メッシ選手、FC バルセロナ、またはクリスティアーノ・ロナウド選手の正規のコミュニティページにリダイレクトされます。この手口に乗ってログイン情報を入力したユーザーは、個人情報を盗まれ、なりすまし犯罪に使われてしまいます。
図 1. リオネル・メッシ選手の画像が掲載された偽の Facebook ページ
図 2. FC バルセロナの画像が掲載された偽の Facebook ページ
図 3. クリスティアーノ・ロナウド選手の画像が掲載された偽の Facebook ページ
インターネットを利用する場合は、フィッシング攻撃を防ぐためにできる限りの対策を講じることを推奨します。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
シマンテックは、URL のトップレベルドメイン（TLD）に .pw が含まれるスパムメッセージの増加を確認しています。元々はパラオを表す国別コードトップレベルドメインでしたが、現在は Directi 社を通じて、「Professional Web」を意味するドメインとして誰でも利用できます。
図 1. TLD が .pw のスパムメッセージが急増
まず過去 90 日間の状況を見てみると、.pw は TLD 別の分布リストで 16 位でした。
図 2. 過去 90 日間の TLD 別の分布リスト
ところが、直近の 7 日間を見ると、.pw を含む URL が 4 位に急上昇しています。
図 3. 過去 7 日間の TLD 別の分布リスト
Global Intelligence Network で見つかったメッセージを調べたところ、URL に .pw を含むスパムメッセージの大多数は一撃離脱タイプのスパム（「かんじきスパム」とも呼ばれます）であることが判明しました。
.pw を含む URL スパムについて、過去 2 日間の上位 10 件の件名は以下のとおりです。
図 4. .pw を含むスパムメッセージの例
シマンテックでは、引き続きこの傾向を監視し、こういった攻撃を絞り込むためのフィルタの作成を続ける予定です。また、企業や個人ユーザーの皆さまは、シマンテックインテリジェンスレポートに掲載されている基本的なセキュリティ対策（ベストプラクティス）を実施するようお勧めします。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
Contributor: Avhdoot Patil
Phishers have recently gained a lot of interest in football. Various phishing attacks using football were observed in 2012. Phishers have already shown their interest in the 2014 FIFA World Cup, football celebrities, and football clubs. Scam for LIONEL MESSI Fans and Scam for FC Barcelona are good examples of phishers using football celebrities and football clubs. Fraudsters understand that choosing celebrities with a huge fan base offers the largest amount of targets which could increase their chances of harvesting user credentials. In April 2013, the trend continued with phishers using the same strategy. The phishing sites were in French on a free web hosting site.
The phishing sites prompted users to enter their Facebook login credentials on pages designed to highlight Lionel Messi, FC Barcelona, or Cristiano Ronaldo. The phishing pages contained images of Lionel Messi, FC Barcelona, or Cristiano Ronaldo and tried to create the false impression that they were the official Facebook page for either Messi, FC Barcelona, or Ronaldo. Some of the fake sites were titled, “first social networking site in the world”. Users were prompted to enter their Facebook login credentials in order to connect to the Facebook page. After a user’s login credentials have been entered, users are redirected to a legitimate Lionel Messi, FC Barcelona, or Cristiano Ronaldo community page to create the illusion of a valid login. If users fell victim to the phishing site by entering their login credentials, phishers would have successfully stolen their information for identity theft purposes.
Figure 1. Fake Facebook phishing page featuring Lionel Messi
Figure 2. Fake Facebook phishing page featuring FC Barcelona
Figure 3. Fake Facebook phishing page featuring Cristiano Ronaldo
Internet users are advised to follow best practices to avoid phishing attacks: