Crypto-Ransomware Running Rampant

There's no doubt that ransomware is one of the most popular malware threats of 2014. Zscaler is not alone in this opinion, as other security firms have observed up to a 700% increase in infection rates to ransom-like malicious activity on victim PCs.  It's no wonder the attacks are so effective when for example, the delivery mechanism is designed to impersonate a legitimate service such as a harmless eFax.

This link is seen from a phishing e-mail.

Ransomware attacks can be monetized quickly and efficiently without the need to create a large scale botnet or expose the attacker's affiliate ID via click-fraud schemes. We've seen multiple attack vectors leveraged to target end users. Some vectors we have monitored include phishing email links or a malvertising campaign which leverages exploit kit distribution. Attackers will often pose as legitimate services, such as a law enforcement agency or a mass media outlet, in order to lure the unsuspecting victim into their scheme.

We recently encountered a ransomware campaign leveraging phishing e-mails purporting to be from the Australian Postal Services. The spam campaign themes used by the attackers involve tracking services or mobile invoices containing a link to the malicious content.  Upon completion of a CAPTCHA, the user is provided a zip file which contains a malicious executable posing as a PDF document.

At the time of research, this particular file shows a a detection rate of 16/53 antivirus engines on Virustotal. Before the victim even has a chance to realize their mistake, they are greeted by a message informing them of just how impacted they are.

It's rare for a piece of malware to name itself to the victim...

The goal of Cryptolocker or any other Crypto-Ransomware attack is to encrypt personal files and hold them hostage. The attacker encrypts the files using a specific key which is either obtained during the phone home request to a Command & Control (C2) server, or hard-coded within the malicious executable. In  this case, the malicious executable itself is falsely presenting itself as a valid executable for AQQ IM. 

AQQ is a popular IM application

Cryptolocker's encryption has been an evolving piece of this threat, often relying on asymmetric encryption to lock the victim's files.  In this particular version, the Cryptolocker variant targeted the following folders for encryption:

•  C:\MSOCache\All Users\
•  C:\Users\[Public/Username]\

The ".encrypted" files can only the key controlled by the attacker can release them.

The threat will also drop a file in the Windows directory and an associated registry key to launch the file upon boot.  This will ensure that the threat will remain persistent if the victim attempts to reboot their system.

The autostart value is randomly generated.

Cryptolocker will phone home to a hard-coded malicious domain via SSL. The SSL certificate is signed using the printable string 'debian'. This transaction is the secure communication which will provide the specific key needed to encrypt the victim's files.

Viewing the C:\Windows\uhjrajyj.exe in this case will reveal the hardcoded domain used to phone home.

The phone home address is hard-coded within the malicious payload.

Decrypted SSL traffic reveals the initial call back attempt that contains a POST request with victim's machine name and unique ID as seen below:

Decrypted call back attempt

This variant was found to be using a Domain Generation Algorithm for the C2 server communication, similar to the phone home method of Zeus.GameOver.

DGA activity

These domains are largely returning 504 errors now as they have either not yet been registered or have already been shutdown.  A few do were still live at the time of the research.  Zscaler inspected the associated IP addresses and found them to be hosted in the Russian Federation. The two server IP addresses of note at the time of the blog are 46.161.30.20 and 46.161.30.19.  Active ransomware URLs leading to these servers include:

• usygoseqowapadoh[.]com:443
• usygoseqowapadoh[.]com/topic.php
• octoberpics[.]ru:443
• octoberpics[.]ru/topic.php

Conclusion

Administrators should be on the lookout for the above connections as they likely indicate a compromised system. Given how prevalent this threat is, the U.S. Government recently released an associated alert on the US-CERT site. 

Taking regular backups of your personal files remains a user's best chance at mitigating the threat if they have been hit by this attack. It is also important for system administrators to enforce  strict file-type access control policies surrounding the download of archive and executable files from unknown sources.

Facebook Scam for Stalkers

If you are like me, you might feel bad about leaving your dog home alone all day while you are at work.  So to alleviate his boredom, I've let him sign up for his own Facebook.  Being new to the social media scene has already resulted in one tragedy. Well, my dog has done it again.  This time he was paranoid over whether his girlfriend from across the street was cheating on him.  So of course when he sees the new FBStalker26.com, he must try it.

On Version 26! So Advanced. So Legit.

Being a human, I know that this is obviously a phishing attempt trying to trick my dog into revealing his username and password to Facebook or worse.  Usually a Facebook scam's success is determined by the paranoia of who is looking at your profile or how many free iPads you can win.  Once you realize that, these phish attempts are almost elementary to recognize.

Always look at the address bar before entering your creds.

 The link from that photo will take you immediately to a new page where you are meant to log in again with your Facebook credentials.  A quick glance at the address bar will show you that you are not in Kansas anymore.  Don't do it!  Don't enter that information!

Oh no you did it...Now your username/password have been compromised, they still won't have an easy time into your account due to higher security policies from Facebook.  Unfortunately, my dog was gullible enough to enter in his security question and answer, only to be disappointed by a 404 error immediately after that entering his data.  Looks like he'll never know who is stalking him now, but don't worry...he won't have access to his own Facebook account for much longer.

Evolution of the "Work from home" scam

The "Work at home mum makes $X,000/month"scam has been around forever. In fact it has been an integral part of various scam campaigns which we've detailed in the past. These scams even appear in the list of the top-20,000 most visited websites in the world.

It is interesting to follow the evolution of this scam. The scam site always looks like a newspaper website (NBC, News Daily, etc.) with a legitimate news article, but they keep making small "improvements". Earlier this year, the scammers "borrowed" Facebook Like buttons to make it appear as though they had many supporters.

In the past two weeks, thousands of WordPress websites have been hijacked to redirect to online13workhome.com. New pages are added inside the /wp-includes/ directory:

• http://crewing-russia.com/wp-includes/zaoedtis.php
• http://nishikanttravels.com/images/gllsxayu.php
• http://mitra-corp.com/wp-includes/kexohywj.php
• http://aeflosangeles.com/wp-includes/bkpokbpc.php
• http://logintofacebook.biz/wp-includes/hjgmmvsh.php
• http://drhassanattia.com/wp-includes/zbfcbyom.php
• http://sumittirathyatra.com/images/zypeeucx.php
• etc.

The file names seem to be random and unique. Some of the hijacked websites are blacklisted by Google Safe Browsing, but the majority are not flagged and some of the websites have been cleaned up.

"Work from home" scam

Above is a spoof of the CNBC website. The page is well designed, with fake ads for CNBC Pro, summaries of fake articles on the elections, etc.  They even use geo-localization to modify the title of the article to include the local city name: San Jose Mum...", "Atlanta Mum...".

JavaScript used for geo-localization

All the links redirect to www.realonlineincnow.com (currently down). Neither online13workhome.com nor realonlineincnow.com are currently blacklisted by Google Safe Browsing, but some of the hijacked sites leading to them are blocked by Google.

Payday loan scam

Weebly is a free platform for website creation. Like many free hosting and DNS providers, it is abused by spammers and scammers. Recently, I found over 400 .weebly.com sub-domains advertising "instant cash loans" and redirecting users to http://paydayloanswww.com/.

instatncashloansandiegocacalegal.weebly.com

Here are some of the 400 sub-domains:

• loanranger.weebly.com
• fastapprovalsignaturepersonalloa.weebly.com
• 750cashloan.weebly.com
• americangeneralfinance1.weebly.com
• pdlnow-com.weebly.com
• globalgrouppaydayloans.weebly.com
• skyloans01.weebly.com
• privatelendersstudentloansbadcre.weebly.com
• loansforretired.weebly.com
• paydayloanswithmoneygram.weebly.com
• etc.

The 400+ weebly.com domains have an identical layout with some text at the top, but the majority of the page is simply a large image showing an application form.

the form is actually an image

The image is also a link to the actual Payday loan website. But instead of linking directly to paydayloanswww.com, they link to "custom" shortened URLs. The URLs do not come from legitimate URL shortening services, but rather domains that have been setup by the scammers for the sole purpose of linking to spam/scams. This is a technique used by other spammers, notably fake Canadian Pharmacy, to work around spam filters. Here are some of the domains used for the redirections:

• eibo.biz
• h8l.org
• zsui.org
• g1o2.info

paydayloanswww.com serves as a broker in finding payday loans for customers. Potential borrowers have to fill out 2 forms and provide very sensitive information including a social security number, bank account information, etc.

Payday loan form, page 1

Payday loan form, page 2

From my experience after filling out the form, and from what I gather from many forums, borrowers get a $200 loan, but here is an $89 charge every time the loan is renewed. The renewal happens automatically every nine days and herein lies the scam: it is apparently very hard to get the company to stop the automated renewal. The $200 loan can get very expensive after a few weeks!

My loan offer (I asked for $800)

The company operates under different names: Brighton Fnl LLC, Kingston Financial, etc. The Better Bureau Business record for Brighton Fnl LLC is not great: eight complaints are currently listed on the BBB website.

After sending a few URLs to Weebly, some sub-domains have been taken down, but most are still up. Weebly is fairly young, it does not look like they have the correct tools and processes in place to respond quickly to this kind of spam. I've offered to send them the full list, but I have not heard back from them yet.

80% of "Olympic" domains are scams and spam

Today we looked at all identified domains containing the string "olympics", which had been accessed by our customers over the course of a day. It turns out that 80% of them are scams or spam and they can be classified into three main categories.

Typo squatting

Spammers can take advantage of users making mistakes when typing a domain name directly into the browser address bar by purchasing domain names close to their intended target - for example: gooogle.com (3 letter o's) or gogle.com (1 letter o) for google.com, yaho.com or yaoo.com for yahoo.com, etc.

The main target of typo squatting in the US is the official NBC site for the Olympics: nbcolympics.com. Here are the domains that capitalize on user mistakes:

• cnbcolympics.com (extra c)
• nbcolympic.com (missing s in olympics)
• wwwnbcolympics.com (missing dot between www and nbcolympics.com)
• msnolympics.com (msn instead on nbc)
• nbolympics.com (missing c in nbc)
• nbcolympics.org (.org instead of .com)
• nnbcolympics.com (2 n's in nbc)
• mbcolympics.com (m instead of n in nbc)
• ncbolympics.com (c and b inverted in nbc)

These domains are mostly parked. They are covered with advertising in the hope that users will click on one of those links since there is no useful content on the page.

cnbcolympics.com

Domain names cost only about $10 and hosting can be free, so this can an effective way to make some money with a minimal initial investment.

"TV on PC" scam

Scams for receiving Cable/Satellite TV on a PC for a very low monthly fee are not new. Scammers are taking advantage of the Olympics to attract people who are ready to spend a few bucks to watch the games in real time.

Numerous pages, mostly parked on free hosting sites are created to redirect users to the TV scams. These redirection pages may be designed as reviews from users promoting the scam, or simple HTTP redirection scripts with no content actually displayed to the victim.

This technique is used by the largest number of "olympics" domains:

• londonolympics2012livestream1.webspawner.com
• london2012olympicslivestreamfreeonline.webspawner.com
• londonolympic2012tv.com
• olympics2012onipad.com
• watch2012olympicsonline.puzl.com
• olympics.gamelivehd.com
• londonolympics.chuckduck.info
• watcholympics2012live.com
• watchsummerolympics.com
• watch-olympics-online.info
• olympicstv.trueonlinetv.com
• watcholympicslivestreams.us
• olympic2012.livetelecast.us
• olympics2012london.tk
• olympic2012.onlinepremiumtv.com
• olympics2012live.onlinestreamingfree.net
• londonolympic.info
• london2012olympicslivestream.sitew.com
• olympicgames2012livestream.sitew.com
• watcholympics2012-openingceremonyonlinefree.sitew.com
• olympics2012lives.sitew.com

londonolympics2012livestream1.webspawner.com

TV scam after redirection: satellitedirect.com

"Made for Adsense" sites

"Made for Adsense" (MfA) sites are highly targeted websites that drive web traffic from search engines. They contain enough content to get listed in search engine results for as a specific query. They contain a lot of ads and encourage users click on them in order to get to some of the more interesting content. MfA sites typically have very few pages.

 Here are some examples related to the Olympic games:

• olympicstable.com
• 2012-london-olympics-news.com 
• olympic-games-2012-london.com
• olympicsgames.com
• olympicgames2012.com
• nbcolympica.com
• olympiczone.com

More ads than content: 2012-london-olympics-news.com

We've seen a few other scams - mostly old tricks revisited to fit the Olympic games.

• software to see the Olympic games that is actually spyware/adware: streamolympicsonline.com
• survey scams: olympics2012videoclips.vidrr.net

I guess the good news is that most of the scams are targeting 'low hanging fruit' and don't involve sophisticated exploits.

London Olympics Email Scams (updates)

In light of the popularity of the Olympics knowing that scammers will come out of the woodwork to take advantage of the event – we're continually monitoring for Olympic scams and maliciousness, no matter how unsophisticated. And so far, unsophisticated has been exactly what we have been seeing.

Here is an example of the standard sort of Olympics "lottery" pitch that we are seeing from the scammers over email:

Scam attachment

Below are a few updates for what we are currently seeing today:

Received: from [216.172.135.113] by web5710.biz.mail.ne1.yahoo.com via HTTP
From: Lottery Draws Notice [websjod@gmail.com]
Reply-To: internetaward166@gmail.com
Subject: View The E-Mail Attachment And Contact Your Claim Agent
Body: KINDLY OPEN THE ATTACHED FILE
Attachment: 2012 London Olympics Lottery Draws Notice.doc
Scammer email to send data: internetaward166@gmail.com

--

Received: from [173.245.64.182] by web180804.mail.gq1.yahoo.com via HTTP
From: London Olympics 2012 [bolympics111@gmail.com]
Reply-To: London Olympics 2012 [lon2012.0lympics@london.com]
Subject: Read the Attached Letter
Body: Read the Attached Letter
Attachment: LONDON OLYMPICS LOTTERY.pdf
Scammer email to send data: lon2012.0lympics@london.com

--

Received: from [209.73.132.40] by web5717.biz.mail.ne1.yahoo.com via HTTP
From: LONDON 2012 OLYMPICS LOTTERY [smithed2012@gmail.com]
Reply-To: 2012lonolympicsgames@london.com
Subject: Congratulation
Body: INTERNATIONAL PROMOTIONS LONDON 2012 OLYMPICS LOTTERY
Attachment: LONDON 2012 OLYMPICS 1-1.doc
Scammer email to send data: 2012lonolympicsgames@london.com

--

Received: from smtpout.telepacific.net ([208.57.218.234])
From: "Very.co.uk"[account@very.co.uk]
Subject: Account Bonus for Olympics 2012
Body: Dear Customer, Here is a notification that your account is due to be credited. Click on My Account below to accept this offer and also get a discount for the Olympics 2012.
Link: hxxp://contabilidadpymes.cl/images/login/en/index.html
This is a phishing page for very.co.uk online shopping site.

Very.co.uk phish page using Olympics as a driver

--

Received: from [67.195.23.211] by web184804.mail.gq1.yahoo.com via HTTP
From: LONDON OLYMPICS 2012 INTERNET LOTTERY ANNIVERSARY [i.olympic2012@london.com]
Reply-To: LONDON OLYMPICS 2012 INTERNET LOTTERY ANNIVERSARY [revgraigjon01@gmail.com]
Subject: You have won from London Olympic 2012
Body: Open the attachment
Attachment: LONDON OLYMPICS 2012.doc
Scammer emails: revgraigjon01@gmail.com, unclaimrevgraig@consultant.com

--

Received: from User ([217.16.182.244]) by redwood-mtg.com
From: "Mrs. Linda Joseph"[webinfo66@yahoo.com]
Subject: London 2012 Olympics Lottery Winner
Return-Path: webinfo66@yahoo.com
Body: basic scam email asking for victim banking info to be returned in order to claim winnings (summarized due to length)
Scammer email: webinfo66@yahoo.it

--

In addition to these, I’ve seen reports of scams using image files (e.g., JPGs) to by-pass content inspection checks (a common practice among scammers/spammers) containing the same sort of instructions for victims to send their banking information in order to claim their winnings.

In addition to scams, we have seen everything from gambling sites, online shops, TV/streaming services, news / social media sites, and even a florist sending email promotions using the Olympics as a marketing driver.

I will make updates to this post with anything new that I see over email throughout the Olympics, additionally I will make a separate post on the web angle.

London Olympics: Stay away from scams, data theft and phishing

The Summer Olympics in London have kicked off and cyber criminals, spammers and data thieves are wasting no time, capitalizing on Olympic related scams.  Currently, the volume of websites selling bogus Olympic tickets are on the rise. These sites normally propagate their campaings though unsolicited ad banners, popups, social networking sites and email messages. Let us examine one such site in detail.

This bogus site is liveolympictickets(dot)net, which also has a Facebook page as shown below:

The website claims to sell official tickets for the London Olympics. As you can see from the screen shots below, they have tried to retain the same
aesthetics as the official London 2012 site: [http://www.london2012.com/].  This bogus site allows you to add items to your shopping cart, checkout and pay using a credit card. It works just like any other normal ecommerce website.

The site also has external links which redirect to other websites that have the same kind of bogus tickets offers. Some of these sites include pay-per-click scams.

Let us try to examine what is happening in the background. When you type in your personal details such as email, address, phone no. etc., they get sent via plain text (no encryption). The same applies when credit card details are sent, exposing them on the network.

These websites do not have adequate security mechanisms in place, visiting and entering private information could lead to information leakage/theft. This website is just a needle in the haystack. There are numerous such sites which try to market fake promotions/live streaming/tickets. 


Stay away from these websites. The official London Olympics site maintains a list of websites which are known to sell fake tickets, check them before buying any tickets: [http://www.london2012.com/spectators/tickets/ticket-checker/]. 

If you are concerned about the legitimacy of a website, Zulu, Zscaler's cloud based URL risk analyzer can be used to check for malicous/spam/phishing sites etc. Visit [http://zulu.zscaler.com] for more Information.

London Olympics 2012: Prime time for spammers

Spammers love major events as they present an opportunity to social engineer victims with content that they’re likely to be interested in. The Olympics represent a golden opportunity for spammers – the world’s largest sporting event, that will draw a global audience for the next two weeks. As such, we expect to see a plethora of Olympic related scams, which are already beginning to emerge.

Below is an example of an email message that has been circulating that is essentially an Olympic themed version of the ever-popular Nigerian 419 email scam.

From: LONDON 2012 OLYMPICS LOTTERY PROMOTION [mailto:johnwilliamsa2011@gmail.com]
Sent: 15 July 2011 01:09 PM
To: undisclosed recipients:
Subject: CONGRATULATION!

PLEASE OPEN THE ATTACHED FILE

LONDON 2012 OLYMPICS LOTTERY PROMOTION!

The London 2012 Olympics lottery is proud to inform you that you have won £1,950,000.00 GBP (One Million Nine Hundred and Fifty Great Britain Pounds) why you have won? Your e-mail address is one of 15 lucky addresses who have won in the monthly promotion.

We wish to congratulate you on your victory; winners shall be paid in accordance with his/her settlement center. Stated below are your identification numbers:
Batch number: 18/006/1094/lipda/sl,
Reference number: lli/240142/011,
Pin: 2012, file number: flie//5612/1364.
Security code: olylon2012,

FILL THE DETAILS REQUESTED:

1. YOUR FULL NAME………………………………………...
2. YOUR COUNTRY NAME………………………………….
3. MOBILE NUMBER…………………………………………
4. OCCUPATION………………………………………………
5. FAX NUMBER………………………………………………
6. PASSPORT COPY OR ID…………………………………
7. BATCH NUMBE…………………………………………..
8. REFERENCE NUMBER……………………………………
9. PIN NUMBER……………………………………………….
10. FILE NUMBER……………………………………………..
11. SECURITY CODE………………………………………….
12. DATE OF BITH……………………………………………. .

The London 2012 Olympics lottery team, whereby all winners are selected computer ballot draws or server, this email draw or server visits all internet providers and email address around the globe, be it COM, ORG, NET, AOL and all country based web abbreviations, as you have .CA in Canada and .UK in United Kingdom and AOL in USA .ZA in South Africa and India .IN

Remember, you must contact your claim agent Mr. Richards Lord by email or through his office telephone number to make your claim of this great winning prize known to him, with the above requested information.

CONTACT YOUR CLAIM AGENT IN LONDON, UNITED KINGDOM.
MR. RICHARDS LORD
TELEPHONE PHONE: +44 703 174 9631
EMAIL: londonolympic_2012@hotmail.com

You have to note that the London 2012 Olympics Lottery is creating awareness of the Olympics sprit around the world, which is to be host in United Kingdom.

Online Lottery’s Operator, works in collaboration with the London 2012 Olympics Board to ensure that the most effective service is offered to the Lottery winners - within the responsible gaming framework at all times.

MRS. LINDA ROSE.
PROMOTION MANAGER.
LONDON 2012 OLYMPICS LOTTERY AWARD.
COUNTRY: UNITED KINGDOM.

Sample-1

The message is a perfect example of a 419 scam. It asks for personal information and informs you that you’re the recipient of a tremendous financial prize. Below is yet another example.

From: LONDON 2012 OLYMPICS PROMOTION [mailto:uk2012olympics@london.com]
Sent: 01 March 2012 11:49 PM
To: undisclosed recipients:
Subject: 2012 LONDON OLYMPICS E-MAILSSELECT PROMOTION

Head Office

London 2012

One Churchill Place

Canary Wharf

London E14 5LN

LONDON OLYMPICS EVENT AWARENESS AND PROMOTION COMPANY.

2012 London Olympics lottery draw notice 

This is to inform you that London Olympics event awareness and promotion company, and London 2012 summer Olympics Organizing Committee (LSOOC) here in London (U.K), has held an Internet Raffle Draw among all internet e-mail users, and your e-mail address was among the 10,000,000.00 (Ten million) e-mail addresses that was picked by the computer during the Second Quarter Raffle Draw (SQRD).

We are therefore with great pleasure, to notify you that your e-mail address once again, happened to come out top number (1) out of the 10,000,000.00.(Ten million) e-mail addresses on the final ballot draw.

 Please note that this has made you the jackpot winner of the sum of GBP£ 1,000,000.00 (One Million British Pounds) and free entrance tickets to watch the games live in London. 

Be aware that this Internet Raffle Draw (IRD) was organized by  London Olympics event awareness and promotion company.and London 2012 summer Olympics Organizing Committee (LSOOC), to create awareness to the world, as England is finalizing their preparation for the hosting of the 2012 summer Olympics.

BELOW ARE YOUR WINNING DETAILS:

COMPUTER DRAW NUMBER: 177

EMAIL CODE NUMBER: TTYEEWSSE2211775643000

FINAL JACKPOT NUMBER: 0001
SN: 2012 / LSOOC / LOC / UK 

WINNING INSURANCE POLICY NUMBER: JJA23UK

WINNING FUNDS INSURANCE COMPANY: NFU MUTUAL LONDON

REFERENCE NUMBER: EAASL/941OY1/04

BATCH NUMBER: 12/27/Du34

WINNING NUMBER: 3

Note that this program is being sponsored by below listed U.K companies:

1. Vodafone company U.K Limited
2.Fenchurch communications U.K Limited
3.Business mobile U.K Limited

 Mr. Kuash Behler, Our First Quarter Winner of

GBP£ 2,500,000.00 from Amsterdam, Holland.

Our Second Quarter Winner Mrs. Ali Fatima from Nepal receiving her winning cheque of GBP£1,000,000.00 also on the picture is her husband and friends rejoicing

\With them.

 Congratulations from all our staff, we also extend our thanks to the Sponsors for being part of our awareness and promotional program.

PRIZE CLAIMING INSTRUCTION:

YOU ARE HEREBY NOTIFIED THAT YOU ARE AMONG THE 7 WINNERS OF THE SUM OF GBP£ 7, 000, 000, 00 (SEVEN MILLION British Pounds) EACH ENTITLED TO RECEIVE GBP£ 1,000,000.00 (ONE MILLION British Pounds)

Your Fund is now deposited with our correspondent Paying Bank (BARCLAY'S BANK, LONDON) insured in your name for security reasons, you are advised to please keep your winning details very confidential from the members of the public to avoid double claim as your winning/payment will be cancelled should Two (2) claims be submitted under the above specified winning details.

Please note that claiming agents has been appointed in strategic areas around the world to help and ensure an easy and immediate claim to all our lucky winner's. We have checked your location and your claiming falls under group B.

You are to call and forward you’re winning details to our appointed and accredited Agent    (MR. M. ROBERT NULL)  
Office   Mail:  robertnull2010@null.net

Cell: Tel: + 44-7031741865    Fax: +447014237785   to enable him clear your file for immediate payment. Visit:    http://www.london2012.com    for more details.

You can also confirm your winning by directly calling/contacting our head office here in London on the bellow Details:

Signed By Dr. V. Beavis                                 Copyright © 1996-2012                      
[Award Board Director]                                       The U.K National Lottery Inc.

Head Office U.K                             All rights reserved. Terms of Service - Guideline

E MAIL :  board.directors@london.com                                         

 100860 8556 2548 9576UK

Sample-2

These scams have become so common that the official Olympic website is actually maintaining a list of those which have been identified in order to warn the general public. Here is a list of the email spam/scam variations related to London Olympics 2012:
• 2012 Games Entertainments Co-ordinator
• 2012 Olympic Draws
• 2012 Olympic Promo
• 2012 Olympic Promotion Board United Kingdom – South Africa
• 2012 Olympics, A Lottery For The Future
• 2012 Summer Olympic Lottery
• 2012 Summer Olympic/Paralympic Games
• Australian Lottery (in affiliation with the London 2012 Olympics Committee)
• AUTHORISATION NOTE: P&G WORLDWIDE PARTNER / London 2012 Olympic Games
• BBC Olympic Prize
• Big Big London 2012 Olympic Lottery
• BT & London 2012 Olympics Promotions Team
• CocaCola Company and London 2012 Official Award Notification
• Coca Cola London 2012 Olympic Games Promotions
• Deloitte/London 2012 Olympic Games Promotional Draw
• Ford Olympic 2012 Promo
• Future 2012 Olympics – Congratulations!
Grosvenor/London 2012 Olympic Games Promotional Draw
• London 2012 Draw Results
• London 2012 Employment
• London 2012/ FIFA International Online Lottery
• London 2012 grant award
• London 2012/Microsoft 2011
• London 2012 press release
• London 2012 Olympic Games Raffle Award
• London 2012 Olympics/Microsoft Sweepstake
• LONDON 2012: Ticket Number: LND0026
• Olympic 2012 Awareness Lotto
• Olympic Torch
• P & G Olympic Promotion

It is advisable that if a message contains any of the above mentioned text, such messages should be dropped. Today, many antivirus solutions and email gateways provide aggressive spam filters but messages can always slip through, so individuals should be wary of any message requesting personal information, regardless of the source.

Zscaler Safe Shopping for Internet Explorer

Zscaler Safe Shopping, the browser extension that warns users when they visit a fake store or compromised store, was Firefox, Google Chrome, Safari and Opera. It is now available for Internet Explorer 6 to 9 (Windows XP, Vista and 7). This is the first extension we released for Internet Explorer, and hopefully not the last one. You can download it here.

Zscaler Safe Shopping warning in Internet Explorer

Fake stores are still prevalent in Google searches for buying software online. If you get redirected to one of the fake store, a banner will be displayed at the top of the page to let you know the the website is not safe. We update the blacklist of fake and compromised stores regularly.


Browser Helper Object

Internet Explorer extensions are called Browser Helper Object (BHO). Unlike all the other major browsers, the add-on infrastructure in Internet Explorer is very incomplete. Internet Explorer does not offer a way to easily install add-ons, to update them, or to configure them. Instead, add-ons are treated as regular Windows program. Zscaler Safe Shopping comes in the form of executable to install and register the BHO. You can disable add-ons from within Internet Explorer, but you have to use the Control Panel to remove them completely from your system.

Zscaler Safe Shopping installer

Zscaler Safe Shopping installed

The executable required administration rights to register itself as an Internet Explorer add-on by modifying the registry. Although the add-on appears in Internet Explorer right after the installation, a restart of Internet Explorer is required to activate the plugin.

You can download Zscaler Safe Shopping from our website.

I will talk more about developing BHO in later posts.

"Check who is visiting your profile" scam on Russian social network Vkontakte

Vkontakte is the Russian equivalent of Facebook and has been criticized for being a direct "clone". Well, scammers are "cloning" the most popular Facebook scams and porting them to this Russian platform as well.

One recurring scam, used to trick people into giving up credentials to their Facebook account, or executing a cross-site scripting attack against themselves, has it's equivalent at Vkontakte: hxxp://gosti-vk.p7h.in/?r=3262.

Here is a screenshot of the page translated into English:

Scam site

The site claims to be an official Vkontakte application (with a .in TLD!). The page uses the same logo, layout and colors as the official site. The fake user testimonials explain that they have found likely lovers checking out your profile.

You need to give your ID or profile link (no password required) to let the "app" figure out who is viewing your profile:

Form (translated in English) to enter user ID

I inserted a fake name (in English) and the app miraculously found 7 people who had looked at my profile!

Name of people who visited by non-existent profile

Before I had time to click on any links, I was also asked to enter my cell phone number to ensure that I was indeed a human:

Phone number must be entered

This is where the Russian scam differs from the Facebook scam. In the US, scammers try to get users to fill out surveys, install spyware or try "free" offers. In Russia, as shown in other scams, scammers make money by sending SMS messages with a surcharge.

Are Pinterest "Pin it" going the way of Facebook "Like"?

Pinterest is a new social network that has been getting a lot of press lately. Basically, Pinterest is a virtual board, where users can pin things they like online. They can share the content with their friends, follow other people, etc.

My Pinterest board

Like Facebook, Pinterest users can add items to their board from the website, but also by clicking on "Pin it" widgets set up by webmasters on any website, which are equivalent of the Facebook "like" widgets. Any new pin shows up as a notification for all people following you. Although Pinterest is very new (you need to first apply for an invitation to get your login after a couple of days) and has a small number of users, spammers are already abusing the "Pin it" widget.

This week, I found spam campaigns at pinterestpromo.info and giftinterest.com that use Pinterest as the main tool to propagate scams.

pinterestpromo.com

The scam is very similar to some previous Facebook spam campaigns: users have to click on the "Pin it" widget in order to receive a free iPhone or iPad. On these two sites, scammers have used a fake "Pin it" widget rather than the official widget code.


After clicking on the widget, the site redirects to another website, such as:
http://www.giftsforshoppers.com/aseg-1142?trkSessID=195212565&dLID=5084&pRdrTrkID=667421271&skipExit=[skipExit]&pLeadEmailAddress=[pLeadEmailAddress].

www.giftsforshoppers.com

The scam is the same as one that I described last week for a Groupon scam: the visitor has to fill out surveys or trial offers in the hope of getting a gift card or some other gadget.

Any website with features to spread links quickly to a trusted group of people is doomed to be abused by spammers.