Beware of Phishing Attacks and Other Scams during the Thanksgiving Shopping Season

Thanksgiving Day is one of the major holidays celebrated in the United States on the fourth Thursday in November. The following Friday, referred to as Black Friday, marks the start of the Christmas holiday shopping season. Almost every retailer large and small offers huge discounts on Black Friday, often extending through the weekend and the following Monday, now known as Cyber Monday.

As we near Thanksgiving and the start of the holiday shopping frenzy, we’re observing a sharp increase in cyber scams and phishing activities targeting online shoppers. As shoppers look for the best deals available, cybercriminals are quick to take advantage of unsuspecting users.

Increase in online shopping transactions

Every year during this timeframe, we observe a noticeable spike in the total number of web transactions within the Shopping category. We have shared this trend in our previous blogs as well ([1],[2]).

Last year, we saw around 2.71% of all the web transactions categorized as Shopping and this year is no different. We currently see that 2.63% of total web transactions belong to the Shopping category and we expect this number to rise as we approach the end of the month. The following chart shows that the number of Shopping transactions has increased steadily throughout November.

Cyber Scams and Phishing attacks

The increase in Shopping activity comes with an unwelcome increase in phishing attempts. Phishing is a well known attack method, often used by attackers to steal sensitive information like authentication credentials, credit card numbers and personal information. We have already seen a large spike in Phishing and Spam activity, specifically targeting Thanksgiving, Black Friday, and Cyber Monday events. The following graph shows the phishing transactions for this month that have been blocked by Zscaler:

We caution consumers to be extra vigilant this holiday season when shopping online. Here are some examples of phishing attempts that we have blocked:

Walmart phishing attempt:

Amazon phishing attempt:

Ebay phishing attempt:

The motive behind these attempts is to steal sensitive user information which includes personal credentials and financial data. Cybercriminals often use this stolen information for illicit activities resulting in monetary gain.

More phishing sites targeting online retailers:

• Ebay - hxxp://124[.]150[.]140[.]133/~ritenfad/viewitem/dll/88322933932/
• Walmart - hxxp://ofertaswalmart[.]besaba.com
• Walmart - hxxp://walmartfriday[.]net/
• Amazon - hxxp://zekocase[.]com/._ama_c0nf1rm/info_bill/login.php
• Amazon - 213[.]13[.]119[.]152/am/

Fake Black Friday/Cyber Monday/Thanksgiving related sites:

• hxxp://sfspr[.]org/?hid=hollister-cyber-monday-cyber-monday-sale
• hxxp://cyber-shop[.]net
• hxxp://www[.]ocdiagnostics[.]net/?id=louboutin-loafers-cyber-monday-deals
• hxxp://koeriersdienstdemolen[.]nl/wp-content/languages/?page=toms-soap-cyber-monday-2014
• hxxp://devillevacaville[.]com/?tid=cyber-monday-toms-canada
• hxxp://postyourads.co[.]uk/?mid=mulberry-bags-cyber-monday-deals
• hxxp://semexcesso.com[.]br/?hid=hollister-girls-cyber-monday-2014
• hxxp://dl5.iq11download[.]com/lm/lmdisc2/thanksgivingss.exe
• hxxp://www[.]americanasblackfriday[.]esy[.]es
• hxxp://www[.]systempackaging[.]com/images/ugg/black-friday-uggs-p-35.html
• hxxp://busycatholicmoms[.]com/2013/11/26/new-articles-and-happy-thanksgiving/

Sample of subjects used in spam e-mail messages targeting online shoppers:

• Get Stylish-furniture At Discount
• Checkout tire sales for Black Friday
• Make the Most of Black Friday, with A New smart-phone
• Brand name laptops on sale for BlackFriday
• [Black Friday Starts EARLY]Saveup to 90% +FREE BonusItems!
• Walmart One Day Specials BlackFriday
• Shop Black Friday sales to upgrade furniture
• Thanksgiving Specials and BlackFriday Discounts!
• New Early BlackFriday Door busters are Added EveryDay
• Shop Black Friday to find discounts on electronics
• Search major Savings on laptops...On black-friday
• Limited Time Black Friday Deal
• 10% off Site-Wide. Get Your Black Friday Shopping Started Today!

 

How can online shoppers protect themselves?

Thanksgiving marks the start of the holiday shopping season which continues until Christmas. The Zscaler ThreatLabZ team is working round the clock to ensure that our customers do not fall prey to such malicious activity.

We highly recommend that all online shoppers exercise extreme caution and follow our holiday season shopping security checklist:  

• Inspect the source of emails with shopping deals

• Ensure HTTPS/secure connections to online retailers and Banking sites

• Check the authenticity of the URL or website address before clicking on a link

• Stay away from e-mailed invoices - this is often a social engineering technique used by cybercriminals

• Do not use insecure public WiFi for shopping

• Use two-factor authentication whenever possible especially on sensitive accounts such as those used for banking

• Always ensure that your Operating System and Web Browser have the latest security patches installed

• Use browser add-ons like Adblock Plus to block popups and potential malvertisements

• Backup your documents and media files

• Review the Identity Theft Guide and FAQ from the Federal Trade Commission.

Wishing you all a very Happy Thanksgiving and don’t spend too much!

Credit for analysis: Rubin Azad, Uday Pratap Singh

Spearphishing Connects PCs to Russian Botnet

The talent over at MalwareBytes wrote this week about a Zbot dropper which comes from a PDF exploit through a spear-phishing e-mail.  In their blog, they discuss how a spear-phishing attempts to exploit either CVE-2013-0640 or CVE-2013-2729. User's must be extra cautious dealing with any attachment in an e-mail, but this threat merits extreme concern.  It installs a very persistent rootkit and logs the victim into a botnet which receives new commands/tasks every 10 minutes.  Removal is near impossible and also will use your Windows Mail to spear-phish your contact list.

As noted by MalwareBytes, attackers often use false extensions in order to infect victims (such as totally_legit.doc.exe). In the case of this attack, victim's download and click a malicious PDF.  This PDF, as Malwarebytes mentions, exploits Adobe Reader 11 and downloads an executable file.  At the time of research, 18/51 AV companies saw through this ruse and blocked the content before it had a chance to further exploit the victim.

We obtained a copy of the same malware in the Zscaler cloud and noted the following observations. A dropped file immediately connects to a Russian IP address to set up its beaconing activity as well as download more malicious PE files to the victim's machine.

axisbuild[.]com is showing some suspicious activity besides beaconing.

The translation of the C&C configuration file seen above in English is:

Интервал обращения к серверу в минутах

('Interval back to the server in minutes')

Таймаут цикличного обращения по ссылкам в минутах

('Timeout cyclical treatment referred to in minutes')

Список ссылок c&c

('The list of references c & c')

Страна бота

('Country bot')

Список задач

('task List')

In addition to awaiting for further commands from a remote server, the threat will also make many edits to the vicitm's system in order to remain despite removal processes.

There are several locations where this threat might download additional malicious PE files.  I've added a brief list below to illustrate.  I will provide more upon request to interested security professionals.

There are other locations used to download malicious files.

We took all different versions of these files and combined the phone home traffic to give a full list of IPs contacted.  The dropped files immediately begin to contact various IP addresses using nonstandard ports.  The following is a list of IPs and their hosted country.  

List of nonstandard ports used by all variants.

List of IP addresses which were contacted across all variants.

Administrators should monitor their networks for any activity which might match the outgoing transactions above.  Administrators will have a really tough time removing the threat due to the creation of a rootkit and altering the system's boot sequence.  The Zbot variant maintains a high level of persistence by doing the following:

This allows for untested drivers to be executed as part of the boot process

• Uses bcdedit to modify the Windows boot settings.

Dropped files create a system driver which executes during boot sequence.

• Spawns drivers in the Windows Directory

The Autostarter value is randomly generated

• Creates an autostart registry key

Used to inject malicious process into kernel.

• Registers kernel notifiers (kernel callbacks)

The victim is used as a node in further spear-phishing campaigns.

• Manipulates Windows Mail files

Users and Administrators must take extra caution against suspicious attachments.  Common methods for APT infection include tricking users to go to a compromised website or downloading something malicious through an attachment.  The fact that this threat compromises Windows Mail files means that the victim can be used to attack your contact list.  This allows for the attack to circumvent spam lists and base protections employed by regular users.  The best solution is to employ a sandboxing solution against all files which come through e-mail.

Facebook phishing: manual session hijacking

We have reported a number of Facebook phishing pages and scams on this blog. Attackers always come up with clever ideas to fool users in order to obtain their credentials. One of these phishing tricks is a "poor-man" session hijacking attack whereby the user is fooled into copying and pasting a Facebook URL containing the session ID or other credentials into a malicious page. I'll describe such an example that I spotted this past weekend.

The phishing page starts with the usual bait, a video. This time, no sex, but instead an opportunity to watch "Jackie Chan died after perfecting a deadly stunt. Jackie Chan falls from a building of 12 floors."

Jackie Chan died!

The user must click to verify his age, another common trick to get users to click on the page. This displays a list of steps to "verify your age" which involve clicking on another link, copying a link from the window opened, and submitting the data.

Steps to "verify" the user age

The new window points to Facebook. The window is too small for the user to understand what he is copying. Also, instead of opening a page, the URL used is "view-source:https://www.facebook.com...". This makes it one step harder for the user to understand that the window displays a page from Facebook.

Popup window open by the phishing page

When the user copies and pastes their Facebook URL into the 3rd party web page, they're also sending their authentication token used share content. Once this is done, the scammer can now post content on the user's behalf.

Fortunately, Facebook reacted quickly to this particular scam. The Facebook  popup is not valid anymore and it shows the following warning:

Warning from Facebook

When subsequently logging into Facebook after viewing the scam, I also received a warning about phishing pages:

Warning about phishing pages

It looks like Facebook has reacted much faster than they have in the past and added additional warnings for end users. I was asked by Facebook to review my timeline for any suspicious activating just after I logged in. Hopefully more Facebook users will learn about these phishing techniques and will be able to spot them early on.

Phishers target Yahoo users

Yahoo Mail introduced two-factor authentication in December 2011. Two-factor authentication can be used to prevent suspicious access to an account (login from a different country, numerous failed login attempts, etc.) and can be used to verify a user's identity when asking for a password reset.

Two-factor authentication has been in the news a fair bit lately as LinkedIn and Twitter have recently begun to offer the feature. We encountered an example whereby a phisher actually took advantage of heightened awareness of two-factor authentication to aid in an attack. The scam involved spoofed e-mails, which claim that all Yahoo users must turn on two-factor authentication:

Phishing e-mail to Yahoo Mail users

The e-mail has a spoofed FROM address (@yahoo.com) and a fake link to http://update.yahoo.com/. The user clicking on this link is actually redirected to a phishing page at http://www.antek.com/pics/tiles/yahoo.com.html as shown below:

Yahoo phishing page

At present, this URL is blocked by Google Safe Browsing (Firefox, Chrome, Safari) but not by Internet Explorer.

Yahoo is now shutting down their Yahoo Mail classic interface and forcing users to their new e-mail platform. This will no doubt be another great opportunity for phisher to take advantage of confused users.

Facebook Scam for Stalkers

If you are like me, you might feel bad about leaving your dog home alone all day while you are at work.  So to alleviate his boredom, I've let him sign up for his own Facebook.  Being new to the social media scene has already resulted in one tragedy. Well, my dog has done it again.  This time he was paranoid over whether his girlfriend from across the street was cheating on him.  So of course when he sees the new FBStalker26.com, he must try it.

On Version 26! So Advanced. So Legit.

Being a human, I know that this is obviously a phishing attempt trying to trick my dog into revealing his username and password to Facebook or worse.  Usually a Facebook scam's success is determined by the paranoia of who is looking at your profile or how many free iPads you can win.  Once you realize that, these phish attempts are almost elementary to recognize.

Always look at the address bar before entering your creds.

 The link from that photo will take you immediately to a new page where you are meant to log in again with your Facebook credentials.  A quick glance at the address bar will show you that you are not in Kansas anymore.  Don't do it!  Don't enter that information!

Oh no you did it...Now your username/password have been compromised, they still won't have an easy time into your account due to higher security policies from Facebook.  Unfortunately, my dog was gullible enough to enter in his security question and answer, only to be disappointed by a 404 error immediately after that entering his data.  Looks like he'll never know who is stalking him now, but don't worry...he won't have access to his own Facebook account for much longer.

Pinhout: Pinterest clone or phishing site?

Recently I stumbled upon pinhout.com. Look familiar?

Pinhout.com looks awfully familiar to...

It looks like a Turkish copy of Pinterest, a growing social network to share web content.

.. Pinterest (home page).

Official site?

I was wondering if this site is a Phishing site, a clone, or an official site from Pinterest. Whois records show that the domain has been registered by a Turkish Individual:

Registrant Contact Details: Pinhout Berat Yas (duruyas@hotmail.com) Ankara Ankara Alt?nda?,06000 TR Tel. +90.0533488xxxx

The website is hosted on 95.173.164.13. This IP hosts several other domains registered by different individuals. Pinhout.com is not the default domain for this IP either (see http://95.173.164.13/). All of this tells is that this is definitely not an official localized version of Pinterest.

Phishing site?

However, the site does not look like a Phishing site either. It is fully functional and phishing sites usually clone one or two pages only. The site can be browsed without having to login. I've tried to sign up with a Facebook test account, but the signup failed.
Then what is it?
The site could be used to harvest e-mail addresses, Facebook and Twitter accounts (both can be used to sign up), but that does not seem to be the case here. At least not yet...
This is either a dormant phishing/spam site, or most likely an unsanctioned clone of Pinterest by a bored programmer.

Posted with Blogsy

UPS Phishing page with malware

For some time now, attackers have been faking popular websites like YouTube to entice users into downloading and installing malicious software disguised as plugin updates or video codecs. I rcently found a page that is using the same technique to distribute a malicious executable through a fake UPS page.

The page is located at hxxp://www.retinamac.ru/UPS/. It has been up for at least three weeks and not yet blacklisted by Google Safe Browsing. At the top is a fake Firefox warning bar (the same type we analyzed earlier) for a missing plugin. It is interesting to note that the page shows the same fake bar to all browsers - it does not attempt to fake a specific implementation for say Internet Explorer or Chrome.

Fake UPS website

The page warns of a missing plugin. All links, buttons and images open a new popup to download  JavaJREInstaller.exe. On 10/31, only 4 AV vendors were detecting the threat out of 43 vendors! Five days later, that count rose to 35 AV vendors. This illustrates how hard it is for AV to detect new threats.

A behavioral analysis of the executable shows that several executables are dropped into a temporary folders:

• C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\00442734.exe
• C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\00445cfa.exe
• C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\msuuioeyi.exe
• C:\Documents and Settings\All Users\Application Data\8CAFEE7F380FD13300008CAF61D8DA37\8CAFEE7F380FD13300008CAF61D8DA37.exe

The last executable is registered to run with every startup. This example is very representative of the threats we see on the Internet today - most of the attacker effort goes into hiding the malicious executable from the AV vendors, not into the way the payload is delivered to potential victims. This is true for many exploit kits such as the Blackhole exploit kit, where it is much easier to detect the page used to deliver the executables than the malicious executables themselves.

Free provider x90x.net hosting numerous Facebook phishing sites

In the long history of free hosting and DNS providers abused (co.cc, pastehtml.com, etc.), x90x.net can now be added to the list, as it is being used to host many Facebook Phishing sites in a variety of languages:

• faceb000k.x90x.net
• jebemtakra-pisdfa-asdasdsds-ddfs.x90x.net
• mesnaindustrija-goranovic-m-e-s-n-a.x90x.net
• dft3.x90x.net/fbcd.html
• d3xt0pcr3w.x90x.net
• etc.

www.mesnaindustrija-goranovic-m-e-s-n-a.x90x.net

d3xt0pcr3w.x90x.net

dft3.x90x.net/fbcd.html

x90x provides free hosting on their sub-domain

A little bit more research showed that many other types of scams and spam content are hosted on x90x.net sub-domains. Here are a few of them:

• Fake Google page

mygoogle.x90x.net

 This site does not appear to be functional.

• Links to Canadian Pharmacies

vmdygoa.x90x.net

•  forex.com phishing site

jasf.x90x.net/tag/chase/

• Porn (no screenshot!)
• and much more....

The hosting provider is also used by legitimate sites.  It is very risky to host any important website with a free provider which is going to get abused over and over. co.cc has been blacklisted by Google Safe Browsing in the past, meaning all Firefox/Safari/Chrome users were prevented from visiting any of the websites hosted under co.cc. I believe that a $10/year domain name is really a must for any website. Do not rely on a free domain such as those provided by x90x.net that could soon be blacklisted.