Tag Archives: Email Encryption

??????????????????????????????

Hacker Medic April 21, 2014 No Comments

寄稿: Azam Raza

イースターは他の祝祭日と同様に歓喜で迎えるべき日ですが、プレゼントやショッピングを楽しみ、お祭り気分の広がる日でもあります。しかし、この祝日に広がるのはお祭り気分だけではありません。スパマーもその手練手管を駆使し始めており、イースターに向けてスパムの件数も急増しています。

シマンテックは毎年、イースターにちなんでさまざまなカテゴリのスパムを確認していますが、今年も例外ではありません。シマンテックがこれまで何年にもわたって確認してきたスパムと、今年見つかったサンプルから、何種類かご紹介します。

模造品スパム
大きな祝祭日にはプレゼントが付きものとあって、商品紹介スパム、特に模造品スパムはシマンテックが確認しているなかでも最も目立つカテゴリです。模造品スパムでは、偽物の高級腕時計や宝石類が、目を引くような件名や商品写真を使って宣伝されています。この手のスパムメールで使われているヘッダーには、次のようなものがあります。

差出人: “WorldOfWatches” <johnwatson@[削除済み]>
件名: Challenge Ends Easter weekend（イースターの週末、今こそチャンス）

差出人: “DailyPromos” <aacpu@[削除済み]>
件名: Our pick today is- easter14（本日の特選品 – Easter14）

Easter Spam 1.png

図 1. イースターにちなんだ模造品スパム

医薬品スパム
医薬品スパムも、祝祭日が近づくと増えるスパムカテゴリのひとつです。スパムメールには、処方箋不要で医薬品をオンライン購入できると称する医薬品販売サイトへのリンクが掲載されているのが一般的です。リンク先のサイトでは、季節のあいさつ文をバナーに表示して、お祭り気分を煽っています。

Easter Spam 2 edit.png

図 2. イースターにちなんだ医薬品スパム

医薬品スパムの下位カテゴリとしては、ダイエット薬スパムもお馴染みで、複数の言語で確認されています。スパムメッセージで宣伝されているダイエット薬は、認可されている医薬品から、外来植物の薬用抽出物と称するものまでさまざまです。この手のスパムメールで使われているヘッダーには、次のようなものがあります。

差出人: “Mackenzie Burns” <monday@[削除済み]>
件名: Begin eating this fruit and lose the fat before Easter Sunday（このフルーツを食べて、今からイースターサンデーまでに脂肪を落とそう）

商品紹介スパム
大手の小売店やブランドショップは、祝祭日に向けてディスカウントやセールを展開しますが、スパマーもそれに便乗しています。スパマーが有名小売店やブランドから発信されたように電子メールを偽装するのは定番ですが、たいていは偽サイトへのリンクが掲載されています。プレゼントのクーポン券進呈を謳う手口も広く使われています。この手のスパムで紹介されている商品は、子供のおもちゃから SUV まで多種多様です。この手のスパムメールで使われているヘッダーには、次のようなものがあります。

件名: Spring Sale Event on all Cars, Trucks, and SUVs!（乗用車からトラック、SUV まで、春の特別セール中!）

差出人: Auto-Dealer-Online <williamw@[削除済み]>

Easter Spam 3 edit.png

図 3. イースターのバナーが表示されている商品紹介スパム

Easter Spam 4 edit.png

図 4. 今年確認されたプレゼントクーポンスパム

名前入りギフト
最近、名前入りギフトが人気を集めており、イースターエッグやイースターバニーに名前とメッセージを入れられると宣伝するスパムがスパマーの間でも流行しています。ほとんどのスパムメールには偽サイトへのリンクが掲載されていますが、なかには不快なコンテンツにリンクされているものもあります。この手のスパムメールで使われているヘッダーには、次のようなものがあります。

差出人: Easter Bouquets <rebekkahFAjhLg@[削除済み]>
件名: Make the Easter bunny jealous! Easter flowers（イースターバニーに見せつけちゃおう! イースターに花束を）

Easter Spam 5 edit_0.png

図 5. イースターバニーから子供に名前入りの手紙が届くと謳うスパム

カジノスパム
オンラインカジノやギャンブルを扱ったスパムも祝祭日に増加します。カジノスパムは、サインアップ特典、報酬ポイント、当選のチャンスなどを餌にして被害者を誘います。この手のスパムメールで使われているヘッダーには、次のようなものがあります。

差出人: AU_AllSlots @ <AllSlots@[削除済み]>
件名: 25-free spins on Gold-Factory this-Easter（今年のイースターに Gold-Factory スロットでコイン 25 枚分を進呈）

419 詐欺スパム
ナイジェリアスパムは、宝くじの当選金や寄付金などを餌にして、どの祝祭日にも決まって登場します。シマンテックは、孤児院や慈善団体を詐称して不幸な子供への寄付金を募る 419 スパムを確認しています。個人情報を求めてくる迷惑メールは、常に慎重に扱う必要があります。この手のスパムメールで使われているヘッダーには、次のようなものがあります。

差出人: suzanne122@[削除済み]
件名: HappyEasterInAdvance,（一足早くハッピーイースター）

その他に今年シマンテックが注目したのは、外国語のイースタースパムの件数です。外国語でイースターにちなんだスパム攻撃は、その多くがプレゼントや商品の紹介であり、カップケーキやジンジャーブレッドの宅配スパムなどが確認されています。

ポルトガル語
差出人: “Cupcake” <contato@[削除済み]>
件名: Páscoa | 件名: Easter（イースター）

ロシア語
差出人: Пасхи <vamdetal@[削除済み]> | 差出人: pasha
件名: Скоро Пасха | 件名: Almost Pasha（もうすぐイースター）

差出人: Пряники <sladkie.pashi@[削除済み]> | 差出人: Gingerbread
件名: Кондитерская мастерская | 件名: Confectionery masterskaâ（お菓子工房）

シマンテックも、皆さまが素敵なイースターをお過ごしになれるようお祈りしたいと思いますが、こうしたスパム攻撃には十分にご注意ください。祝祭日を悪用した迷惑メールや予期しない電子メールには常に警戒が必要です。疑わしいメールに掲載されているリンクはクリックしないようにしてください。また、スパム対策シグネチャを忘れずに更新して個人情報を保護したうえで、楽しいイースターのひとときを安心してお過ごしください。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

?????????? 419 ??

Hacker Medic April 21, 2014 No Comments

養子を熱望している夫婦を狙って 419 詐欺のバリエーションを利用する、新手の詐欺が発生しています。その巧妙な手口に騙されて偽の養子縁組み話に乗ってしまうと、被害者は弁護士費用や行政手続き費用を支払うよう求められます。

最近の 419 詐欺のほとんどは、スパマー自身の独創性ではなく被害者の無防備さに頼っていますが、一部の詐欺師は被害者と直接の対話を進めることで信用を勝ち取ろうと考え始めたようです。十分に調査された手口で説得力もあり、ときには話に信憑性を持たせ、詳しく調べられてもボロが出ないように、実話を拝借する場合さえあります。

偽の養子縁組みを利用する詐欺は、古くからあったようですが、今回シマンテックが確認した事例では、実話のような詳しい情報が使われ、詐欺師は長期にわたって徹底的に被害者との対話を続けようとします。

図 1. 養子縁組み話を悪用する詐欺メール

海外の宝くじに当選した、あるいは裕福なアフリカの指導者が死去したなどという筋書きで前渡し金詐欺を仕掛ける典型的な手口の代わりに、今回の詐欺師は、変わったアプローチを取っています。それでも、詐欺を疑わせる兆候は多く見受けられ、たとえばメッセージは匿名の受信者に宛てて送信されています（ハッキングされた Web メールアカウントが利用されており、発信元はハンガリーですがイタリアを経由しています）。また、別の Web メールプロバイダに返信するよう求めてきます。いずれも、前渡し金詐欺によく見られる特徴ですが、詐欺師がどのような方法で金銭を要求してくるのか実際に調べてみることにしました。

この養子縁組み話に少しでも信憑性を持たせようとして、詐欺師は最終的に送金という段になるまでに、いくつもの手続きを用意しています。メールをやり取りするうちに（11 通の返信が必要で、期間は実に 2 カ月にわたりました）、子供の母親についても詳しく語られる一方、公的な斡旋を利用しない私的な養子縁組みに伴う規則についても説明がありました。さらには、偽の養子縁組み書類と新生児の写真まで送ってくるほど用意周到です。

図 2. 419 詐欺で養子縁組みの対象とされた乳児

図 3. 被害者の信頼を得るために用意された偽の養子縁組み書類

最終的に金銭を要求できると詐欺師が判断した段階まで進むと、ユーザーは「裁判所命令の作成ならびに文書費用」に充当するとして 2,500 ドルを要求されます。支払いは、金融機関の電信送金を利用して、1,500 ドルと 1,000 ドルの 2 回に分けて行うよう指示されます。このような支払い方を要求してくるのも、正規の取引であるかのように演出し、被害者がこの詐欺を本物と信じ込むようにするためだと考えられます。

図 4. 詐欺師が養子縁組みの費用を請求してくる

詐欺師が電子送金を受け取るための名前と住所を公開している場合は、その情報も偽物だと考えるところですが、今回示された住所を調べると、驚くべき事実が判明しました。

記載されている受取人の住所は、養子ならびに家族法を扱う弁護士事務所の住所だったのです（もちろん、この弁護士は詐欺とはまったくの無関係です）。ほとんどの詐欺師は、昔からの偽の名前を使って前渡し金詐欺を実行するものですが、実在の人物の身元を乗っ取って使うほうが、詐欺の説得力は増します。標的が無警戒であれば、受取人の名前を探し出して、その人物が本当に米国内で事務所を構えている正規の弁護士だと信じてしまうかもしれません。こういった要素が重なって、最終的にお金を支払うと、新たな被害者の 1 人となってしまいます。

このように養子縁組み詐欺を使うのは、419 詐欺の手口として新たな傾向ですが、詐欺師の一部はちょうど一周して以前の特徴に戻っただけなのかもしれません。筆者は 2 年前のエコノミスト誌によるインタビューで、前渡し金詐欺の詐欺師から送られてくるメッセージが、いかにも正規で本物らしく見える文面から、現実味に乏しいほどの大金で誘う、およそプロらしくない内容に移り変わった経緯を明らかにしました。自ら引っ掛かってしまうような被害者を狙っているため、どの詐欺メッセージも巧妙とはほど遠いものです。

今回の例は、前渡し金詐欺のすべてが、騙されやすい被害者だけを想定して手を抜いたものとは限らないことを思い出させてくれます。なかには、今回の養子縁組みのような作り話に何カ月も掛けて、説得力のある背景情報やそれらしい書類まで用意する創造的な詐欺師もいるということです。詐欺師の想像力と創造性が、これからも進化を続けることは間違いないでしょう。

Prepare-se para os Spams durante a Páscoa

Hacker Medic April 17, 2014 No Comments

A Páscoa, como muitas outras datas comemorativas, deveria significar um dia de alegria, o que obviamente remete a presentes, compras e festas. Porém, essa animação não é a única coisa que está sendo espalhada neste feriado. Os Spammers também começaram a difundir seu trabalho vicioso. A poucos dias da Páscoa, o volume de Spams cresceu significativamente.

A cada ano que passa, a Symantec observa certas categorias de Spam utilizando a Páscoa como tema central e este ano não foi diferente. Vamos ver abaixo alguns dos diferentes tipos de Spam que a Symantec coleta ano após ano bem como alguns exemplos coletados este ano.

Spams de Bens de Consumos

Com presentes sendo o item mais importante de qualquer data comemorativa, Spam de produtos (especialmente bens de consumo) é a categoria de Spam que a Symantec mais observa. Nesse tipo de Spam, itens como relógios e joias falsificadas são promovidos usando slogans e belas imagens de produtos. O cabeçalho do e-mail inclui exemplos como:

De: “WorldOfWatches” <johnwatson@[REMOVED]>

Assunto: Desafio termina no fim de semana de Páscoa

De: “DailyPromos” <aacpu@[REMOVED]>

Assunto: Nossa sugestão hoje para a Páscoa 2014

Easter Spam 1.png

Imagem 1: Tema de Páscoa replica bom spam

Spams Médicos e Farmacêuticos

Spams de remédios e farmácias são outra categoria de Spam que vemos muito quando chegamos perto das datas comemorativas. Esses Spams normalmente contém algum link para sites de farmácias que fingem vender medicações online sem a necessidade de receitas médicas. Esses sites normalmente exibem banners festivos para criar um clima mais realista.

Easter Spam 2 edit.png

Imagem 2: Temas médicos de Spam de Páscoa

Spams específicos para quem quer perder peso são uma subcategoria dos Spams médicos que são vistos em muitas línguas diferentes. Medicações para perda de peso exibidas nessas mensagens variam de medicações reconhecidas pelo mercado bem como extratos de ervas e plantas exóticas. O cabeçalho do e-mail inclui exemplos como:

De: “Mackenzie Burns” <monday@REMOVED>

Assunto: Começe a comer essa fruta diariamente e perca gordura antes da páscoa!

Spams de Produtos

Grandes lojas de varejo e marcas oferecem inúmeros descontos e promoções durante as datas comemorativas e os Spammers se aproveitam disso. Spammers geralmente constroem seus E-mails para que pareçam vir de conhecidas marcas e lojas de varejo, mas normalmente eles possuem links redirecionando para sites falsos. Ofertas para cupons de presentes também são muito comuns. Os produtos vistos nesse tipo de Spam variam desde brinquedos até Veículos. O cabeçalho do e-mail inclui exemplos como:

De: Auto-Dealer-Online <williamw@[REMOVED]>

Assunto: Promoção de Outono para todos os carros, Jipes, Caminhonetes e SUVs

Easter Spam 3 edit.png

Imagem 3: E-mail com banner de spam

Easter Spam 4 edit.png

Imagem 4: Spam de cupom de presente de Páscoa

Spam de Presentes Personalizados

Presentes e lembranças personalizadas também estão ficando populares este ano e Spams promovendo mensagens personalizadas em ovos de páscoa e coelhinhos da páscoa está se mostrando popular entre os Spammers. A maioria desses Spams possuem links para sites falsos e alguns deles redirecionam o usuário a sites com conteúdo inapropriado. O cabeçalho do e-mail inclui exemplos como:

De: Easter Bouquets <rebekkahFAjhLg@[REMOVED]>

Assunto: Deixe o coelhinho da Páscoa com inveja! Flores de Páscoa!

Easter Spam 5 edit_0.png

Imagem 5: Spam personalizado para crianças

Spam de Cassinos

Jogos online e Spams de cassinos aparecem em grande volume durante a época das datas comemorativas. Spams de cassinos provocam as vítimas com bônus na inscrição, recompensas em pontos e chances de ganharem fortunas. O cabeçalho do E-mail inclui exemplos como:

De: <suzanne122@[REMOVED]>

Assunto: Nessa páscoa, jogue gratuitamente no Cassino Gold Factory

Spam de Fraudes

Spams de fraudes monetárias rotinamente dão as caras durante essa época do ano. A Symantec observou muitos Spams fingindo serem de orfanatos ou instituições de caridade buscando doações para os menos afortunados. E-mails desconhecidos pedindo informações pessoais sempre deveriam ser tratados com cuidado. O cabeçalho do E-mail inclui exemplos como:

Português

De: <suzanne122@[REMOVED]>

Assunto: Feliz páscoa adiantado

Outra coisa que nos chamou a atenção esse ano foi o alto volume de Spams de páscoa em outras línguas. O ataque de Páscoa normalmente contém presentes e brindes, como o Spam de entrega de Cupcakes e Ovos de Páscoa mostrados aqui:

Russo

From: Пасхи <vamdetal@[REMOVED]> | From: pasha

Subject: Скоро Пасха | Subject: Almost Pasha

From: Пряники <sladkie.pashi@[REMOVED]> | From: Gingerbread

Subject: Кондитерская мастерская | Subject: Confectionery masterskaâ

A Symantec deseja um Feliz Páscoa para todos os seus usuários e também aconselha muito cuidado com essas campanhas de Spams. Sempre tenha atenção com e-mails desconhecidos ou inesperados. Nunca clique em links de e-mails que pareçam suspeitos. Lembre sempre de manter seus softwares de segurança atualizados para lhe proteger e poder lhe fornecer a paz de espírito para comemorar e celebrar uma maravilhosa Páscoa.

Bebês Oferecidos para Adoção em 419 Scam

Hacker Medic April 16, 2014 No Comments

Uma variação de 419 scam de e-mails está sendo usada por fraudadores para tirar proveito de casais desprotegidos que querem adotar um bebê. Cuidadosamente as vítimas são atraídas para um falso processo de adoção, que em seguida, solicita dinheiro para cobrir despesas jurídicas e administrativas.

Enquanto a maioria dos últimos 419 golpes estão ligados à simplicidade e ingenuidade das vítimas, alguns criminosos online já começam a fazer um grande esforço para se comunicar diretamente com a vítima para conquistar a sua confiança. Os golpes são bem estudados e apresentados de forma convincente, inclusive demonstram histórias de vida real para deixá-los mais autênticos.

Figura 1. e-mail malicioso usando uma história de adoção

Ao invés de usar os discursos mais populares para simular fraudes online usuais, tais como ganhar na loteria ou a morte de uma pessoa famosa, este tipo de fraudador adota uma abordagem diferente. A mensagem acima foi enviada para destinatários ocultos (por meio de uma conta de webmail hackeada originária da Hungria, mas encaminhada a partir da Itália) e exigia uma resposta a um diferente remetente. Estas são características típicas de um golpe de pagamento antecipado. Por isso, a Symantec decidiu investigar mais a fundo para ver como o cibercriminoso pedia dinheiro em troca de um serviço falso.

Com a finalidade de tornar esta narrativa de adoção a mais legítima possível, o fraudador nos fez passar por várias fases antes de, finalmente, chegar ao ponto em que fomos convidados a enviar dinheiro. Durante a nossa correspondência que se estendeu por 11 mensagens de respostas e réplicas de e-mail – durante mais de dois meses – o criminoso digital nos informou com riqueza de detalhes a história da mãe da criança e os regulamentos envolvidos para a adoção privada e independente. Eles ainda foram tão longe a ponto de fornecer um formulário de adoção falso e fotos do bebê.

Figura 2. Fotos dos bebês oferecidos para adoção

Figura 3. Formulário falso de adoção usado para convencer as vítimas

Quando o fraudador finalmente decidiu pedir dinheiro, a quantia solicitada foi de US$2.500 para cobrir as taxas de entrada do processo de adoção no tribunal. Inclusive, o cibercriminosos informou a forma de um pagamento em duas parcelas – uma de US$ 1.500 e outra de US$ 1.000 – via transferência bancária eletrônica. O criminoso solicitou que os pagamentos fossem enviados desta forma para a transação parecer mais legítima e a vítima ter mais confiança no esquema.

Figura 4. E-mail do crimonoso virtual pedindo dinheiro

Quando o fraudador fornecia um nome e endereço para receber o pagamento por transferência bancária, assumimos que essa informação era falsa. No entanto, olhando para este endereço, de forma aprofundada, tivemos uma descoberta surpreendente.

O endereço solicitado para o envio era do escritório de um legítimo advogado especializado em adoção e leis familiares (que não possuía nenhuma conexão com este esquema). Isso comprova que a maioria dos criminosos utiliza qualquer nome falso para cometer uma fraude de pagamento antecipado, roubando a identidade de uma pessoa real para a fraude parecer mais convincente. O alvo desavisado pode procurar o nome e confirmar que a pessoa é um advogado legítimo que atua Estados Unidos. Tudo ”faz sentido”, eles enviam o dinheiro e se tornam mais uma vítima da fraude.

A execução deste golpe de adoção sinaliza uma nova abordagem com 419 e-mails de SCAM. Em entrevista à The Economist, há dois anos, foi relevado pela Symantec como alguns fraudadores de pagamento antecipado mudaram a sua abordagem e enviam mensagens de e-mail que parecem legítimos. Nenhuma destas narrativas é muito sofisticada, isto porque os golpistas procuram vítimas que se “auto-selecionam”.

Este exemplo serve como um lembrete de que nem todos os esquemas fraudulentos de pagamento antecipado são tentativas ociosas para obter das vítimas mais ganhos financeiros. Alguns fraudadores usam táticas criativas, como esta narrativa sobre adoção, com convincentes detalhes da vida do bebê e formulários aparentemente oficiais. Não há dúvida de que a imaginação e criatividade dos criminosos vai continuar a evoluir no futuro.

Expect Beautifully Packaged Spam along with Your Easter Gifts!

Hacker Medic April 16, 2014 No Comments

Contributor: Azam Raza

Easter, like all other celebrations is meant to be a day of jubilation, which of course means gifts, shopping, and spreading cheer. However, cheer is not the only thing that is being spread this holiday. Spammers have also started spreading their handiwork. With just a few days left before Easter, the volume of spam is on the rise.

Each year Symantec observes certain categories of spam using Easter as a theme and this year is no different. Let’s take a look at some of the different types of spam Symantec sees year-over-year, as well as some samples from this year.

Replica goods spam
With gifts being at the core of many major celebrations, product spam (replica goods spam in particular) is the spam category Symantec observes the most. In this spam, items such as fake watches and jewelry are promoted using catchy subject lines and product images. Email header examples include:

From: “WorldOfWatches” <johnwatson@[REMOVED]>

Subject: Challenge Ends Easter weekend

From: “DailyPromos” <aacpu@[REMOVED]>
Subject: Our pick today is- easter14

Easter Spam 1.png

Figure 1. Easter themed replica goods spam

Health spam
Pharmacy or medication spam is another spam category we see a lot of when we get close to any holiday season. These spam mails usually contain links to pharmacy sites which pretend to sell medication online without prescription. Season’s greetings are usually displayed as banners on these sites to add a festive touch.

Easter Spam 2 edit.png

Figure 2. Easter themed pharmacy spam

Weight loss spam is another subcategory of health spam which is seen in multiple languages. Weight loss medicines touted in these messages range from approved medication to stories about herbal extracts from exotic plants. Email header examples include:

From: “Mackenzie Burns” <monday@[REMOVED]>

Subject: Begin eating this fruit and lose the fat before Easter Sunday

Product spam
Major retailers and brands offer large discounts and sales during holiday celebrations and spammers take advantage of this. Spammers often craft their emails to make them appear to be from known retailers and brands but they usually include links leading to fake sites. Offers of gift coupons are also common. The products seen in this type of spam can range from kids toys to SUVs. Email header examples include:

Subject: Spring Sale Event on all Cars, Trucks, and SUVs!

From: Auto-Dealer-Online <williamw@[REMOVED]>

Easter Spam 3 edit.png

Figure 3. Product spam with Easter banner

Easter Spam 4 edit.png

Figure 4. Gift coupon spam seen this season

Personalized gifts
Personalized gifts are getting popular these days and spam promoting personalized messages on Easter eggs and Easter bunnies are proving popular among spammers. Most of these spam mails have links to fake sites and some of them even have links to inappropriate content. Email header examples include:

From: Easter Bouquets <rebekkahFAjhLg@[REMOVED]>

Subject: Make the Easter bunny jealous! Easter flowers

Easter Spam 5 edit_0.png

Figure 5. Spam offering personalized Easter bunny letters for children

Casino spam
Online casino and gambling spam show up in larger volumes during holiday periods. Casino spam entices victims with a signup bonus, reward points, and chances of winning a fortune. Email header examples include:

From: AU_AllSlots @ <AllSlots@[REMOVED]>

Subject: 25-free spins on Gold-Factory this-Easter

419 scam spam
Nigerian spam routinely makes the rounds during all holiday festivals with news of lucky draws and donations. Symantec has observed 419 spam pretending to be from orphanages and charity organizations asking for donations for the unfortunate. Unsolicited emails asking for personal information should always be treated with caution. Examples of email headers include:

Subject: HappyEasterInAdvance,

From: suzanne122@[REMOVED]

Something else which caught our attention this year is the volume of Easter spam in foreign languages. Easter themed attacks in foreign languages are usually about gifts and goodies, like the cupcake and gingerbread delivery spam shown here:

Portuguese

Subject: Páscoa |Subject: Easter

From: “Cupcake” <contato@[REMOVED]>

Russian

From: Пасхи <vamdetal@[REMOVED]> | From: pasha

Subject: Скоро Пасха | Subject: Almost Pasha

From: Пряники <sladkie.pashi@[REMOVED]> | From: Gingerbread

Subject: Кондитерская мастерская | Subject: Confectionery masterskaâ

Symantec wishes all our customers a very happy Easter, and we also advise you to be cautious of these spam campaigns. Always exercise caution when dealing with unsolicited or unexpected holiday themed emails. Do not click on links in emails that look suspicious. Remember to update your antispam signatures to safeguard your personal information and give you the peace of mind to celebrate the wonderful Easter celebrations.

Babies Offered for Adoption in 419 Scam

Hacker Medic April 16, 2014 No Comments

A variation on the 419 email scam is being used by fraudsters to take advantage of couples desperate to adopt a child. Once they are carefully lured into a fake adoption process, the victims are then asked for money to cover legal and administrative fees.

While most recent 419 scams rely more on the naivety of victims than any ingenuity on the part of the spammer, some fraudsters are beginning to make more of an effort to directly communicate with the victim to secure their confidence. Their scams are well researched, convincingly presented and may borrow stories from real life to make their stories more authentic and better able to withstand a little scrutiny.

While fake adoption scams have been seen from time to time before, in this instance Symantec observed real life background details and a scammer who goes to great lengths to engage with the victim.

Figure 1. Scam email using adoption story

Rather than using the usual advance-fee fraud scam narratives, such as winning a foreign lottery or a wealthy African leader dying, this fraudster adopts a different approach. Despite this, there were many telltale signs pointing towards a scam. The message was sent to hidden recipients (through a hacked webmail account originating from Hungary, but routed through Italy), and the message required a response to a different webmail provider. These are typical characteristics of an advance-fee fraud, but we decided to investigate further to see how the scammer intended to ask for money.

In an effort to make this adoption narrative appear as legitimate as possible, the fraudster made us go through several hoops before finally getting to the point where we were asked to send money. During our correspondence—which spanned 11 email replies over a two month period—the scammer informed us in great detail about the mother’s story, and the regulations involved with private and independent adoption. They even went as far as providing a fake adoption form along with pictures of the baby!

Figure 2. Babies offered for adoption through this 419 scam campaign

Figure 3. Fake adoption form used to gain victim’s confidence

When the fraudster finally decided to ask for money, we were asked to send US$2,500 to cover the “Court Order Preparation and Document Fee.” This took the form of one payment of $1,500 and another of $1,000, through a financial services wire transfer. It is likely the scammer requested the payments to be sent this way so the transaction appeared more legitimate and the victim would have more confidence that the scam was actually real.

Figure 4. Scammer requests baby adoption money

When the fraudster provided a name and address to receive the wire transfer payment, we assumed this information was phony. However, looking up this address led us to a startling discovery.

The payee address listed was the office address of a legitimate Adoption and Family Law attorney (who has absolutely no connection to this scam). While most scammers use any old fake name to perpetrate an advance-fee fraud, hijacking a real person’s identity can make the fraud appear more convincing. The unsuspecting target may look up the name and confirm the person is a legitimate attorney who is practicing in the United States. It all “adds up,” they send the money, and become yet another victim of the scam.

The execution of this adoption scam signals a new approach by 419 scammers, some of whom have now come full circle in their approach. In an interview with The Economist two years ago, I revealed how some advance-fee fraudsters have moved from sending legitimate and official-looking scam messages to far less professional looking missives offering large sums of money in unlikely scenarios. None of these scam narratives are very sophisticated because the scammers look for victims to “self-select.”

This example serves as a reminder that not all advance-fee fraud scams are lazy attempts to get the most gullible victims to participate. Some fraudsters use creative tactics, such as this adoption narrative drawn out over months with convincing background details and official-looking forms. There is no doubt that scammer imagination and creativity will continue to evolve in the future.

HeartBleed – a further update from Symantec Email & Web Security

Hacker Medic April 15, 2014 No Comments

Last week, we shared details of how the HeartBleed OpenSSL vulneratbility affected our Email & Web Security products.
The newest feature in our Web Security.cloud product, the ability to analyze and control data over HTTPS communicat…

?????????????????? Facebook ?????????????????

Hacker Medic April 14, 2014 No Comments

政治家がフィッシングサイトで利用される例は後を絶ちませんが、インドの総選挙が始まったことを受け、フィッシング詐欺師は地元の政治家やその政党を餌にインドのユーザーを狙い始めています。

シマンテックは最近、Facebook の表示を偽装するフィッシングサイトを確認しており、なかには元ニューデリー州首相でありアーム・アードミ党の党首であるアルビンド・ケジリワル（Arvind Kejariwal）氏も含まれています。フィッシングサイトのホストサーバーは、米国ミシガン州のランシングに置かれていました。

図 1. フィッシングサイトに掲載されている偽の「いいね」ボタンとアルビンド・ケジリワル氏の写真

上の画像でもわかるとおり、フィッシングサイトには「Unite With Us Against Corruption（団結して政治の腐敗と戦おう）」というタイトルが付けられ、アーム・アードミ党のポスターと、Facebook の偽の「いいね」ボタンが使われています。サイトの背景画像は同党の党首アルビンド・ケジリワル氏の写真で、氏が先日 Twitter に投稿した「Political revolution in India has begun.（インドの政治革命が始まった。）Bharat jaldi badlega」というモットーも書かれています。最後の言葉は「もうすぐインドは変わる」という意味です。

この「いいね」ボタンをクリックすると、アーム・アードミ党のページに「いいね」を付けるために、Facebook のログイン情報を入力するよう求められます。

図 2. アーム・アードミ党のページに「いいね」を付けるために Facebook のログイン情報を入力するよう求められる

このフィッシングページで使われているログインの指示には、紛らわしい部分もあります。アーム・アードミ党の名前を出すかわりに、Facebook のユーザー情報でログインし、可愛い女の子の写真に「いいね」を付けるよう求めてくるのです。これと同じように女の子の写真を使うフィッシングサイトは、以前にも登場したことがあります。フィッシング詐欺師が同じテンプレートを使って別のアプリケーションをホストするのはよくあることですが、どうやら今回は、可愛い女の子の写真についての説明を変更し忘れたようです。ユーザーがログイン情報を入力すると、フィッシングサイトから確認ページにリダイレクトされます。確認ページでは、もう一度「いいね」ボタンをクリックするよう求められます。

図 3. 確認ページに表示されるログイン確認メッセージと「いいね」ボタン

確認ページには、前のログインページで入力した電子メールアドレスが表示されます。「いいね」ボタンの横には、アーム・アードミ党がこれまでに獲得した「いいね」の件数も表示されますが、これは偽の数字です。ボタンもダミーであり、何の機能も果たしていません。この手口に乗って個人情報を入力したユーザーは、個人情報を盗まれ、なりすまし犯罪に使われてしまいます。

インターネットを利用する際には、フィッシング攻撃を防ぐためにできる限りの対策を講じることを推奨します。

アカウントにログインするときに、アドレスバーの URL を確かめ、間違いなく目的の Web サイトのアドレスであることを確認する。
電子メールメッセージの中の疑わしいリンクはクリックしない。
電子メールに返信するときに個人情報を記述しない。
ポップアップページやポップアップウィンドウに個人情報を入力しない。
個人情報や口座情報を入力する際には、鍵マーク（画像やアイコン）、「https」の文字、緑色のアドレスバーなどが使われていることを確かめ、その Web サイトが SSL で暗号化されていることを確認する。
ノートンインターネットセキュリティやノートン 360 など、フィッシング詐欺やソーシャルネットワーク詐欺から保護する統合セキュリティソフトウェアを使う。
電子メールで送られてきたリンクや、ソーシャルネットワークに掲載されているリンクがどんなに魅力的でも不用意にクリックしない。

Phishers Spoof Facebook Appearance and Promote India’s Aam Aadmi Party

Hacker Medic April 11, 2014 No Comments

Politicians are frequently featured on phishing sites and in light of the ongoing general election in India, phishers are starting to target Indian users by using a local politician and his party as bait.

Symantec recently observed a phishing site which spoofs Facebook’s appearance and includes Arvind Kejariwal, the former chief minister of New Delhi and leader of the Aam Aadmi Party. The phishing site was hosted on servers based in Lansing, Michigan in the US.

Figure 1. A fake Facebook “like” button and a picture of Arvind Kejariwal on the phishing site

As seen in the previous image, the phishing site, titled “Unite With Us Against Corruption”, uses a poster of the Aam Aadmi Party along with a fake Facebook “like” button. The site’s background image is a picture of the party’s leader Arvind Kejariwal and his latest Twitter tagline, which states that “Political revolution in India has begun. Bharat jaldi badlega.” The second sentence translates to “India will soon change”.

After clicking on the “like” button, users are prompted to input their Facebook login credentials so that they can “like” the Aam Aadmi party page.

Figure 2. Users are asked to input their Facebook login data to “like” the Aam Aadmi party page

The phishers also used a misleading login prompt in the phishing page. Instead of mentioning the Aam Aadmi Party, the page tells users to log in with their Facebook details to like cute baby pictures. Symantec has already seen a similar phishing site which used a picture of a young girl. Phishers frequently use the same template to host different applications but this time, they forgot to change the reference to cute baby pictures. After the user enters their login credentials, the phishing site redirects the user to an acknowledgment page. The Web page then asks the user to click another “like” button.

Figure 3. A login confirmation and the “like” button on the acknowledgement page

The email address entered in the previous login page is now displayed on the acknowledgement page. The “like” button is placed beside a fake number that claims to show the amount of likes the party has already gained. However, the button is just a dummy and does not perform any functions. If users fell victim to the phishing site by entering their personal data, phishers would have successfully stolen their confidential information for identity theft purposes.

Symantec advises Internet users to follow these best practices to avoid becoming victims of phishing attacks.

Check the URL in the address bar when logging into your account to make sure it belongs to the website that you want to visit
Do not click on suspicious links in email messages
Do not provide any personal information when replying to an email
Do not enter personal information in a pop-up page or window
Ensure that the website is encrypted with an SSL certificate by looking for a picture of a padlock image or icon, “https”, or the green address bar when entering personal or financial information
Use comprehensive security software, such as Norton Internet Security or Norton 360 to protect you from phishing and social networking scams
Exercise caution when clicking on enticing links sent through emails or posted on social networks

Phishers Spoof Facebook Appearance and Promote India’s Aam Aadmi Party

Hacker Medic April 11, 2014 No Comments

Figure 1. A fake Facebook “like” button and a picture of Arvind Kejariwal on the phishing site

After clicking on the “like” button, users are prompted to input their Facebook login credentials so that they can “like” the Aam Aadmi party page.

Figure 2. Users are asked to input their Facebook login data to “like” the Aam Aadmi party page

Figure 3. A login confirmation and the “like” button on the acknowledgement page

Symantec advises Internet users to follow these best practices to avoid becoming victims of phishing attacks.

Check the URL in the address bar when logging into your account to make sure it belongs to the website that you want to visit
Do not click on suspicious links in email messages
Do not provide any personal information when replying to an email
Do not enter personal information in a pop-up page or window
Ensure that the website is encrypted with an SSL certificate by looking for a picture of a padlock image or icon, “https”, or the green address bar when entering personal or financial information
Use comprehensive security software, such as Norton Internet Security or Norton 360 to protect you from phishing and social networking scams
Exercise caution when clicking on enticing links sent through emails or posted on social networks