Memorial Day is celebrated on May 27 and it is a day for memorializing the men and women who have died in military service for the United States. It is a common practice for cybercriminals to take advantage of events and holidays. This year, various sp…
寄稿: Avdhoot Patil
有名人のスキャンダルは注目度が高く、フィッシング詐欺師もサイトに利用しようとして常に狙っています。最近では、英国の歌手で女優のリタ・オラさんを利用したフィッシングサイトが確認されています。このフィッシングサイトは、無料の Web ホスティングサイトをホストとして利用していました。
このフィッシングサイトでは、ビデオを「ソーシャルプラグイン」と称して、Facebook のログイン情報を入力するよう求めてきます。フィッシングページには、背景にリタ・オラさんが映っている偽の YouTube 画像が貼り付けられていますが、問題のビデオには、彼女が登場するアダルトビデオと思わせるタイトルが付いています。リタさんが最近注目を浴びる出来事があったことから、フィッシング詐欺師がさっそくそれに目をつけたようです。フィッシングサイトは、ログイン情報を入力すれば背景に映っているビデオを見られると思わせる作りになっています。実際には、ログイン情報を入力しても、彼女のアダルト向け画像が載っているあるサイトにリダイレクトされるだけです。もちろん、ビデオの画像が載っているサイトにユーザーをリダイレクトするのは、ログインが有効であると思わせ、疑惑をそらすためです。この手口に乗ってログイン情報を入力したユーザーは、個人情報を盗まれ、なりすまし犯罪に使われてしまいます。
インターネットを利用する場合は、フィッシング攻撃を防ぐためにできる限りの対策を講じることを推奨します。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
As the urban legend goes, the bank robber Willie Sutton was asked why he robbed banks. “Because that’s where the money is,” he is attributed as saying. While Sutton has long since distanced himself from the statement, the concept resonates with many people, to the extent that it’s been used to describe principles in accounting and even medicine.
This principle also holds true in the world of Internet security. In the latest version of the Internet Security Threat Report we discussed the major trends in the spam world, where the percent of spam email continues to decline while more and more social networks are being targeted. Given the growth of social networking in recent years as a means to communicate, this comes as no surprise—it’s where the users are.
We’ve previously talked about how scammers are not only going after users on the most well-known social networks, as they have for years, but have begun targeting users on other networks, such as Instagram and Pinterest. Another popular social network has found itself in the crosshairs of spammers recently. The growth in popularity of Tumblr, particularly with younger Internet users, has also drawn the attention of spammers.
We’ve come across a spam campaign that is utilizing a feature on Tumblr similar to the type of commenting you might see on blogs or other social networks. Tumblr calls this feature “Ask,” where your followers can ask you questions, which can appear on your Tumblr blog. The feature is disabled by default, but you can enable it in your account settings and even allow anonymous comments. Spammers are attempting to take advantage of this feature to peddle their wares.
“WOW, I just lost a bunch of weight using the OFFICIAL TUMBLR DIET!! Are u using it as well? Check it out at [REMOVED][d0t]com”
Figure 1. Spam message utilizing Tumblr’s Ask feature
Clearly, there’s no such thing as an official Tumblr diet. Instead, the URL provided in the spam message leads to a website that mimics a popular health magazine, espousing the benefits of a new diet pill.
Figure 2. Fake health magazine site promoting diet pill
The page is full of information about a “miracle pill,” along with testimonials and offers linking to sites where the user can get some. If the user clicks through, they are brought to an order page. However, the site appears to have a limited supply. Stock is set to run out, coincidentally, the same day the user is visiting the page.
Figure 3. Diet pill order page
The user is asked for a number of personal details, such as name, address, phone number, and email. The site will eventually ask for your credit card details as well.
Figure 4. Diet pill payment page
We don’t know for sure if the site will actually send you genuine diet pills that contain the supposed miracle ingredient, fake pills claiming to have it, or if the site will just make off with your credit card details. Regardless, we do not recommend attempting to purchase goods through offers like this.
This spamming technique is not limited to diet pills either. Other scams, such as the one below, attempt to play at a user’s desire to make money. In this case they don’t even bother to ask a question—skirting the primary purpose of Tumblr’s Ask feature altogether.
“I made $300 yesterday by Internet marketing and I’m looking at at least $450 today. So yeah. You need to do this. I found out about it from this news article on CBS. I’m just excited to share this with you because it actually freakin works! Tumblr won’t let me post a link but if you want to read up and start making some money then head over to [REMOVED] [d0t] cоm – Spread this to fellow tumblree’s and tumblrette’s and lets get out of this recession together!”
The link in this case leads to a fake news page espousing a great way to make money from home, then to a page that asks for the same personal details as the scam above. In this case, besides gather personal details, it’s possible that the scammers here could be looking for cybermules—another precarious scam that is best avoided.
Figure 5. Page promoting “make money from home” scheme
What’s disconcerting about this scam is that Ask questions do not appear on Tumblr blogs by default, as traditional comments can. Instead, a user has to make the effort to answer the Ask, at which point both the question and the answer will appear on their Tumblr blog. Granted many users are answering these Asks sarcastically, while others do so with annoyance, seeing it as the spam it is. While we don’t suggest doing this, what’s perhaps most worrying is that some users actually go as far as to thank the Anonymous poster for the information, seemingly falling for the ruse. Regardless of how the user responds, the messages remain online, and anyone perusing these Tumblr blogs could feasibly visit the sites mentioned on their own accord.
It’s difficult to determine the number of Asks these spammers are sending out, but we have encountered hundreds of instances when looking into the issue. Since Anonymous Asks do not require a Tumblr account to submit, and determining if a Tumblr blog has the feature enabled is easily scriptable, spammers could easily send large volumes.
To its credit, Tumblr has implemented an Ignore feature, where you can block the account, IP, and/or computer sending them. Overall, this spam should be treated in just the same way as any other Ask or comment-related spam: do not answer such submissions, do not visit the URLs provided, and do not give any personal details to less-than reputable websites.
ここ数週間で、「ペニーストック」関連のスパムメールが急増していることが確認されています。2011 年に「世界的な信用危機のニュースで株価操作詐欺が急増」というタイトルのブログを公開しましたが、そこでもこの種のスパムに触れています。
ペニーストック（セントストックとも呼ばれます）とは安値で取引される小型株のことで、1 株あたり数セントで取引されることも珍しくありません。ペニーストックは、スパマーによって頻繁に利用されています。スパムメールで安値の株を宣伝し、「この会社はもうすぐ大成功するから株価が急騰する」と謳うのです。そこには、会社が実際よりも価値が高く、何らかの目玉商品が完成したか、あるいはもうすぐ大躍進を遂げるはずであり、株価の急騰が予想されると書かれています。この手の詐欺の目的は、株の人気をつり上げ、その結果株価が上がったところで、持ち株を購入時よりもはるかに高い値段で売り抜けることです。このような株価操作詐欺の手法を「パンプアンドダンプ」と呼びます。
株に関連したスパムで利用されている手法には、単語の間に空白を挿入する、不要な改行で不明瞭化する、電子メールの件名や本文にランダムな文字を挿入するなど、さまざまなものがあります。
図 1. ペニーストック関連のスパムメール
シマンテックでは、次のグラフに示すように、株に関連したスパムの量が増えていることを確認しています。
図 2. 株に関連したスパムメールの量の傾向
こういった攻撃で頻繁に見られるメールの件名として、次のようなものがあります。
迷惑メールや心当たりのない電子メールには注意し、スパム対策のシグネチャは定期的に更新するようにしてください。シマンテックでは、このような「パンプアンドダンプ」スパム攻撃を厳重に監視しており、この傾向の監視を続けて読者の皆さまに最新の情報をお届けする予定です。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
Contributor: Avdhoot Patil
Celebrity scandals are always popular and phishers are keen on incorporating them into their phishing sites. Recently, we observed a phishing site featuring British singer and actress Rita Ora. The phishing site was hosted on…
In the last few weeks we have observed a drastic increase in “penny stock” spam emails. In 2011 Symantec published a blog entitled Global Debt Crises News Drives Pump-and-Dump Stock Scams, which also dealt with this type of spam.
Penny stocks, also known as cent stocks, are shares in small companies that trade at low prices, often as low as a few cents per share. Penny stocks are a very popular topic used by spammers. The spam emails advertise the cheap shares and state that the company is on the verge of becoming very successful and that the value of the shares will rise significantly. The emails make out that the company is more valuable than it actually is and implies that they have just created some major product or are on the verge of a breakthrough and that the share value is tipped to rise dramatically. The aim is to increase sales of the stock, which in turn raises the value, then the fraudster can sell their penny stocks for significantly more than they paid for them. This stock fraud method is known as “pump and dump.”
We are seeing various spam methods being used in stock spam such as broken words, obfuscation with irrelevant line spaces, and insertion of randomized characters in the header or body of the emails etc.
Figure 1. Penny stock spam emails
Symantec is observing an increase in spam volume related to stock spam, which can be seen in the below graph.
Figure 2: Volume trend of stock spam email
Below are the most frequently observed subject lines in these attacks:
Symantec advises users to be cautious when handling unsolicited or unexpected emails and to update antispam signatures regularly. Symantec is closely monitoring these “pump and dump” spam attacks and will continue monitoring this trend to keep our readers updated.
The 58th season of the UEFA Champions League is coming to an end with the final being played on May 25 at Wembley Stadium in London. Nowadays, cybercriminals are gaining a lot of interest in football, at least inasmuch as how to exploit interest in foo…
Contributor: Binny Kuriakose
People dream big when buying expensive items like a car or a property. When those dreams are seen with very affordable price tags it certainly attracts everybody’s interest. There are lots of websites available …
Mother’s Day is celebrated in many countries on May 12 and it’s a day for children, regardless of age, to express their love to their mother by giving her a gift. Spam messages related to Mother’s Day have begun flowing into the Symantec Probe Network. Clicking the URL contained in the spam message automatically redirects the recipient to a website containing a bogus Mother’s Day offer upon completion of a fake survey.
Figure 1: Survey spam targeting Mother’s Day
Once the survey is completed, a page is then displayed asking the user to enter their personal information in order to receive the bogus offer.
Figure 2: Fake survey
Figure 3: Bogus Web page asking for personal information
We recently blogged about the persistence of spam with .pw URLs and not surprisingly a lot of the Mother’s Day spam messages contain .pw top-level domain (TLD) URLs. The following are some examples of the From header using .pw URLs that we have identified to date:
Figure 4: Another dodgy website related to Mother’s Day
Symantec is observing an increase in spam volume related to Mother’s Day, which can be seen in the following graph.
Figure 5: Volume of Mother’s Day spam
The following are some of the Subject lines observed for these spam attacks:
Symantec advises our readers to use caution when receiving unsolicited or unexpected emails. We are closely monitoring Mother’s Day spam attacks to ensure that readers are kept up to date with information on the latest threats.
Have a safe and happy Mother’s Day!
Last week, Symantec posted a blog on an increase in spam messages with .pw URLs. Since then, spam messages with .pw URLs have begun showing up even more.
Figure 1. .pw TLD spam message increase
Symantec conducted some analysis into where these attacks are coming from in terms of IP spaces. As expected, Symantec observed a large quantity of mail being sent from an IP range and then moving to another IP range. While this is an expected behavior, there was an interesting twist. There were multiple companies (with different names) hosting .pw spammers using the same physical address in Nevada.
Examining messages found in the Global Intelligence Network, Symantec researchers have found that the vast majority of spam messages containing .pw URLs are hit-and-run (also known as snowshoe) spam. The top 25 subject lines from .pw URL spam from May 1, 2013 were:
In addition to creating anti-spam filters as needed, Symantec has been in contact with Directi and working with the registrar to report and take down the .pw domains associated with spam. Symantec believes that collaborating with the registrar is a more progressive and holistic approach to solving this problem.