NIST IT Security: New Phishing Scam Hitting Hard, No Clicks Required

NIST Site Search

Product Research

Advertise on this site

Headlines

US-CERT Current Activity

»	Insecure Loading of Dynamic Link Libraries in Windows Applications
»	VMware Releases Updates for ESX Service Console Packages
»	Cisco Releases Security Advisory for IOS XR Software Border Gateway Protocol
»	RealNetworks Releases Update to Address Vulnerabilities in RealPlayer
»	Cisco Releases Advisories for Unified Communications Manager and Unified Presence
»	APWG Fax Back Phishing Education Program
»	Adobe Releases Security Bulletin for Shockwave Player
»	Apple Releases Security Update 2010-005
»	Microsoft Releases Security Advisory
»	VideoLAN Releases a Security Advisory for VLC Media Player

Date published: not known
Details

DOE-CIRC Updates

»	T-430: Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code
»	T-429: WaspTime MS-SQL Database instance with blank password for sa account WaspTime MS-SQL Database instance with blank password for sa account
»	T-428: Vulnerability in Help and Support Center Vulnerability in Help and Support Center
»	T-427: VMWare WebAccess Vulnerability VMWare WebAccess Vulnerability
»	T-426: Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability
»	T-425: Desktop Java running in web browsers Desktop Java running in web browsers
»	T-424: Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service
»	T-423: Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution
»	T-422: Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability
»	T-421: Multiple CACTI Security Vulnerabilities Multiple CACTI Security Vulnerabilities
»	T-420: Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability
»	T-419: PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability
»	T-418: Adobe Acrobat and Reader Font Parsing Remote Code Execution Vulnerability Adobe Acrobat and Reader Font Parsing Remote Code Execution Vulnerability
»	T-417: Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
»	T-417: Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities

Date published: not known
Details

Virus Bulletin news

»	ARF published as IETF standard Abuse report format helps auto-handling of email complaints
»	Microsoft releases new fix for DLL vulnerability Earlier workaround believed to be too complex for most users.
»	Malicious tweets link to fake TweetDeck update Twitter resets passwords for accounts that appear to have been hacked.
»	94% of Internet users befriend unknown 'good-looking woman' Sensitiva data shared after two-hour chat.
»	Investment boost for Quick Heal Indian security firm gets hefty cash injection.
»	41% of spam sent via Rustock botnet Botnet spam back after short summer break.
»	Avast gets $100m investment boost Growth equity firm invests in Czech firm
»	Computer chip giant buys AV giant Intel becomes new owner of McAfee for the princely sum of $7.8bn
»	AV-Test.org issues latest round of testing results Symantec and Microsoft outdo Trend and McAfee in live tests.

Date published: not known
Details

DarkReading - All Stories

»	Networked Scanners Offer A Window Into The Enterprise, Researcher Says Emerging Web-based features make it possible to capture document contents remotely from networked sc ...
»	U.S. Businesses Could Lose Up To $1 Billion In Online Banking Fraud This Year Small- to midsized businesses taking the biggest hit, experts say, but consumer banking customers co ...
»	Product Watch: Verizon, VMware Team Up With Hybrid Cloud Service New Verizon service offers private public-cloud option
»	Could USB Flash Drives Be Your Enterprise's Weakest Link? The Pentagon last week conceded that a USB flash drive carried an attack program inside a classified ...
»	Delaware Contractor Mistakenly Posts Personal Data Of 22,000 Employees State of Delaware contractor Aon mistakenly posts personal data of 22,000 retirees without randomiza ...
»	IBM Corrects Unpatched Vulnerability Numbers After Google Challenge X-Force Team at IBM revises data on vendors with most unpatched bugs in recent IBM X-Force 2010 Mid- ...
»	Major Disruption of Pushdo Botnet Wasn't The Original Goal Botnet's spam traffic cut by 80 percent
»	China, Taiwan Nab 450 Suspects In Biggest Fraud Raid Ever Law enforcement authorities in China, Taiwan seize cash, fraud "manuals" from alleged tele ...
»	Four Best Practices For Tokenization Going beyond Visa's best practices guide

Date published: not known
Details

New Phishing Scam Hitting Hard, No Clicks Required

A new method is being used to phish for credit card numbers that is fooling a lot more people. In this scam the user never has to figure out if a link is good or not because they never have to click on anything. Its all very familiar to them because they've done it before.

The phishing messages are being sent out to targeted groups. For instance government and military employees have been receiving messages that report to be from the credit card company most used for official business. Members of small credit unions are receiving messages apparently from their credit union. In some cases the messages contain the persons name. The messages at first glance are fairly realistic and contain stern warnings for card holders on how to avoid phishing scams. Of course the “From:” address looks like it comes from their card issuing bank, it contains a copyright notice in the name of the bank, it references being a member of FDIC or a credit union association, etc. Everything intended to lower the readers guard.

But what really sucks people in is that there are no links in the email message. It isn't asking them to click on anything. Instead the email message tells them that due to suspicious card activity their card has been temporarily deactivated. To reactivate the card they simply need to call an automated system to reactivate the card. They even provide a toll-free phone number. The exact process that many people used when they first received the card - call a toll-free number, punch in the card number, and the card is activated. In this case they are also asked for the pin number and card expiration date.

That toll-free number is what is convincing people. They seem to think that bad guys would never invest in a toll-free number and an automated system. Or they think think that such a system could be shut down so quick that if its still up and running when they call it must be legitimate. But apparently neither are true. Bad guys have set this up and apparently the toll-free number is being redirected overseas. Its also apparently very difficult to shut down these systems because one has been running for at least 2 weeks now.

Web servers are actually much easier to shut down. Servers have to be hosted some where and hosting companies can shut them down for violating their Terms of Service or Acceptable Use Policy. But phone lines / numbers being used illegally have to go through the legal process. In many cases it takes law enforcement investigating and working with the phone company. This takes time. We've seen web servers shut down within minutes of contacting the right people at the web hosting company, never two weeks. Even if the phone company shuts down the toll-free number the bad guy most likely still has their automated phone equipment and their local overseas phone number (or Voice over IP connection). All they have to do is get a new toll-free number and redirect it overseas again (to the same equipment).

What may turn out to be the most interesting aspect of this scam is how they are redirecting the call from the toll-free phone number to the overseas equipment. It is probably fairly simple equipment such as a Linux computer running the free Asterisk PBX software and a VoIP gateway. Probably about $250 plus an old PC that was ready for the junk pile. All incoming calls to the toll-free number are routed VoIP (over the Internet) to the overseas automated system. When law enforcement shuts it down they really haven't lost much (probably less than what they gained from one card number), they just pop up another gateway.

Because this scam is apparently convincing a much higher percentage of people to turn over their credit card information than typical phishing scams, and because the card collection systems can stay up and operational much longer, we're probably going to see a lot more of these type phishing scams.

References:

Several examples of the email messages from the phone number currently being used. 800links.com
SANS Internet Storm Center Alert
Fayetteville Observer Credit Union news report
University Credit Union notice of this tollfree phishing scam