From email attachments to gift cards to announcements about the beginning of the NFL season to online games – that’s what we’ve seen the Storm Worm do lately, switching email-lure tactics.

Both F-Secure and McAfee Avert Labs have screenshots worth checking out.

So, what’s next?

Phishers target corporations and corporate executives for the same reason that bank robbers target banks – because that’s where the money is.

With that in mind, Alex Eckelberry, Sunbelt Software president, has the details on his company’s blog about a new scheme that claims to be a Better Business Bureau notification.

It’s similar to other BBB-copied schemes seen in recent months, but instead of carrying an attached document, it points the user to a malicious website.

Go here for more details and images.

Eight is the magic number.

That’s how many PDF spam emails were waiting for me when I arrived at the office this morning.

So if you don’t believe the security vendors, believe me. PDF spam is spiking.

Unless, of course, those were legitimate proposals that I mistakenly deleted. In that case, I’d like to apologize to my friends Tobias C. Steele, Maximillian L. Reilly, Hugh O. Salas, Violet Clayton. Majory V. Gentry, Maude and Squad for trashing their emails.

Here’s what others had to say about recent jumps in PDF spam:

“We have received a number of reports from our readers indicating that they are receiving a large amount of pump-and-dump spam that contains no subject or body text. The emails do however contain attachments that have a .dat extension. Upon further review of the attachments, it appears that they are failed attempts at creating and sending a PDF file.

The attachments are the typical pharmacy scam spam. It is recommended that you just delete the emails. You may want to think about adding the .dat to your banned file extensions in your anti-virus programs at least until this round of spam has ended.”
- Deborah Hale, SANS Internet Storm Center, July 13, “Strange round of emails”

“Yes, PDF spams are now quite a common thing.

The easy way to recognize it is a big yellow square before the actual spam message…and the ‘Please Register this Version of PDFcrypt’ message…”
- Pedro Bueno, McAfee Avert Labs Blog, July 13, “New trend on PDF spam”

What’s a better scam seal of approval for a phisher than to have his or her information-gleaning scam website hosted on a government domain?

Symantec researchers said today they’re seeing that surprising trend with some frequency in recent months.

Now, before you run to the phone to call your congressman (or congresswoman) to complain, this isn’t a problem with the .gov domain used by federal agencies and departments in the United States.

Here’s a list of government domains hosting phishing sites, according to Symantec Security Response: Thailand (.go.th), Indonesia (.go.id), Hungary (.gov.hu), Bangladesh (.gov.bd), Argentina (.gov.ar), Sri Lanka (.gov.lk), Ukraine (.gov.ua), China (.gov.cn), Brazil (.gov.br), Bosnia and Herzegovina (.gov.ba), Columbia (.gov.co) and Malaysia (.gov.my).

Symantec’s Nick Sullivan pointed out today that government domains also give phishing sites extra traffic and a longer lifespan. Here’s what he had to say:

“Most phishing sites are placed on government web servers by hackers who have gained access to the server through a backdoor, a vulnerable web interface or some other means.

Hosting a phishing webpage on a government site has a number of advantages for a phisher. Government websites often receive a high volume of traffic, so their servers can handle the extra traffic generated by a phishing site. This extra traffic might not be noticed immediately, giving the phishing site a longer lifespan before it is detected and shut down. Perhaps most importantly, hosting a phishing site on an actual government URL gives the phishing site a sense of authenticity that’s hard to beat.”
- Nick Sullivan, Symantec Security Response blog, July 12, “Government servers hosting phishing sites”

Spamhaus has enemies out there.

Last year, e360 Insight objected to the U.K.-based non-profit listing it as a spammer and filed an action in an Illinois court. Spamhaus did not appear and e360 won a court order by default, and then demanded that ICANN strip Spamhaus of its domain.

ICANN, of course, responded that it did not have the authority to take such action.

This week, Spamhaus is again staring down attackers, who are attempting to discredit the organization and DDoS their phone lines, according to the researchers at McAfee Avert Labs.

A few notes about the attack from McAfee:

“The spammer in this case also had to fake the sender’s address because Spamhaus’ SPF record is of the ‘-all’ variety which sensibly denotes that they *only* permit one IP address to send mail for their domain and so affecting the bot’s ability to deliver further.

Obviously Spamhaus does not use botnets to send out promotional material.”

And here’s the text being used in the attack:

From: Christy June
Date: Fri, 5 Jul 2007 20:34:52 +0100
To: “some, one”
Conversation: Which shalom myself magnetic
Subject: What shalom herself magnetic

WORKING TO PROTECT INTERNET NETWORKS WORLDWIDE
Spamhaus tracks the Internet’s Spammers, Spam Gangs and Spam Services, provides dependable realtime anti-spam protection for Internet networks, and works with Law Enforcement to identify and pursue spammers worldwide.

The SBL database is maintained by a dedicated international Spamhaus team based in 9 countries, working 24 hours a day, 7 days a week to list new confirmed spam issues and - just as importantly - to delist resolved issues.

The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of illegal 3rd party exploits, including open proxies (HTTP, socks, AnalogX, wingate, etc), worms/viruses with built-in spam engines, and other types of trojan-horse exploits.

The Exploits Block List can be used by all modern mail servers, by setting your mail server’s anti-spam DNSBL feature (sometimes called “Blacklist DNS Servers” or “RBL servers”) to query xbl.spamhaus.org. Use of the XBL is free for users with normal mail servers (but networks with high email traffic should see DataFeed).

You can get MUCH MORE if you contact us:

The Spamhaus Project Ltd. 50 Churchill Square, Suite 6, Kings Hill, West Malling ME19 4YU United Kingdom, Tel (+44) 870 766 xxx

Who wouldn’t want a free iPhone – or an iPhone free of a binding agreement to one voice service provider?

I would. But it’s likely that no such deals exist, unfortunately. But here are some details on scam emails and online advertisements that claim they do - as well as other swindles.

The PC Doctor’s Blog details recently discovered iPhone scams, one claiming “unlocked” iPhones are available on eBay.

“An iPhone but be free of AT&T? Dream on!
A number of “unlocked” iPhones seem to be on sale on eBay. Given that there’s no confirmed unlock method for the iPhone, their listings are either erroneous or deceptive. Many of the sellers, when questioned on this, seem to be retracting their statements about the iPhone being unlocked, but there’s still plenty of scope for buyers to be scammed into buying a phone that’s not suitable to their needs.”
- “iPhone scams to be wary of…” The PC Doctor’s blog, July 2

But the award for the most comprehensive webpage on iPhone scams has to go to ScamBusters.org, which predicts the top seven most common iPhone scams – updated post-launch.

“1. iPhone on eBay scams:
As we write the first version of this article on Wednesday evening, two full days before the launch of the iPhone, there are already 1,796 products listed when you do an eBay search for ‘iPhone.’

Our recommendation: Never open attachments from people you don’t know or that you aren’t expecting. Keep your anti-virus software and anti-spyware software up to date. Use a firewall.”
- “iPhone scams: ScamBusters.org predicts the Top 7 iPhone Scams,” ScamBusters.org, updated July 3

It’s a little too early to start wondering if, a decade now, you’ll ask your friends, “Where were you when the iPhone went on sale?” But that doesn’t take away from the fact that Apple’s latest and greatest gadget launch was an unqualified success - at least in terms of living up to the hype.

Scammers have also had their turn with iPhone madness, sending out scam emails that download malware or try to acquire financial information from recipients.

The researchers are hard at work as well, taking the iPhone apart and looking for any security vulnerability they can find.

Here’s some post-launch security analysis of the iPhone launch:

“Within hours of Apple’s introduction of the latest version of its Safari browser two weeks ago, the hacking community began reporting bugs they had discovered in the beta code. Today, the iPhone is likely to get even closer scrutiny from many of the same security researchers. Here’s a list of the top items on the typical iPhone hacker’s to-do list.

3. Take a Close Look at iPhone’s Networking Technologies
Because Apple hasn’t previously developed its own mobile phone, there is bound to be lots of new and possibly buggy networking code in the device. “One of the things we’ll look at as well is the new code that will have to be developed for a phone platform,” said Neel Mehta, a researcher with IBM Corp.’s Internet Security Systems division. “With any piece of new code there’s always a risk that there could be vulnerabilities in it.”
- Anand Vardhan, Anand Varhan: Flex Developer, July 2, “A hacker’s to-do list – iPhone”

“Yup. After waiting a day to get the darn thing activated, we found a bug within a few minutes. We are cheating, of course; it’s just the same bug we found earlier on Safari. Also, our Bluetooth fuzzer locks up the device, so that’s an interesting sign. (As we’ve said in the past, we’ll disclose all our bugs to Apple when they publish acceptable vuln handling guidelines).

At the same time, Apple is going to have the same problem that Windows has. While they may have better theoretical security, they are going to be a bigger target. Hackers know a lot more about breaking into Mac OS X than they do competing platforms like Windows Mobile or Symbian. Thus, even though Apple will patch sooner, they’ll also have more bugs to patch because of increased hacker interest.”
- Robert Graham, Errata Security blog, July 1, “Our first iPhone bugs”

One of the best parts of IT security is the often silly-sounding terms used commonly.

Phishing, in one form or another has been around forever. And what else would targeted phishing be called other than spear phishing?

Here’s a new one – whaling.

If you think about it logically, whaling means exactly what you would think it would mean, at least in comparison to phishing. It’s Captain Ahab the Scammer, out there on the wild seas looking for the biggest of fishes.

These scammers are going after the high rollers, hoping they can find one naive user to hand over the mother lode of passwords and usernames.

And as the name would suggest, whaling isn’t for everyone.

Gunter Ollman has a better description than I can offer at X-Force Labs’ blog:

“Once armed with a list of addresses specific to their quarry, the phishers send email that appear as though it may have come from the employer of someone who would normally send an email message to everyone within the organizational group (e.g. head of marketing and sales, the IT support team, the owner of the message board, etc.) in reality, the message sender information will have been faked (i.e. spoofed).

Unlike normal phishing scams whose objective is to steal an individual’s online banking credentials, the spear phishers is most often seeking to gain access to the entire network of an organization. That said, it is not unheard of spear phishers targeting the users of a specific piece of software (e.g. members of a specific ‘clan’ within World of Warcraft) and stealing their login credentials.”
- Gunter Ollman, Frequency X, “Spear phishing and whaling”

Recently we brought you stories about phishing scams claiming to be from the IRS or the Better Business Bureau.

With the phony IRS email, recipients were warned that they were under investigation for a false tax return sent to the California Franchise Tax Board.

The Better Business Bureau scam claimed that victims were on the receiving end of a complaint about their business services.

These emails are examples of spear phishing – a technique of putting off mass-spamming phishing emails in favor of targeting small groups of people with the scam messages, in this case corporate execs.

What the scammers are after is obvious. Want corporate data? Who better to target than the execs using it every day?

Joe Stewart of SecureWorks has found a Chinese connection to the two scams. The attacker behind the BBB and IRS operations has set up a new domain and server to host his or her latest scam in the People’s Republic.

Here’s Stewart’s take:
“Typically when we see malware from China, it has one of two purposes – to either steam documents related to trade secrets of companies and military/government institutions, or to steal accounts from online role-playing games. This new scam doesn’t seem to fit into either category, so it may represent the emergence of a new kind of Chinese-based cybercrime. The question is then, just what do Chinese malware authors intend to do with the vast amount of data they’ve stolen from over a thousand U.S. corporate executives?”

At the moment, researchers are unsure what to make of the former email filter-bypassing technique of the moment.

Most agree that it’s too early to write off this image-based menace of inboxes for good, but some image-spammers seem to have taken a spring holiday – or dismissed the technique all together.

A report on April’s email-borne threats from Symantec (reported here on SCMagazine.com) showed a 10-percent drop in image spam from March to April, when it accounted for 27 percent of all captured spam.

Three weeks ago, Doug Bowers, senior director of anti-abuse engineering at Symantec, told us that he wasn’t “convinced we’re seeing a significant decline just yet. I don’t think we have enough data to see if it’s a trend.”

Meanwhile, Nick Kelly, posting on the McAfee Avert Labs blog on Friday, said that in recent weeks, “there has been a significant reduction in spam that contains embedded images dropping from 59 percent at the start of April to 12 percent earlier this week.”

But again, don’t pop the champagne just yet. Reports of the death of image spam may have been premature.

“During the last 24 hours, embedded image spam has again increased to 31 percent of spam, so whether the pump-and-dump spammers were having a holiday during April and are now back at work, or if this is a temporary increase, remains to be seen,” he said.