<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: anti-spyware]]></title>
    <link>http://securityratty.com/tag/anti-spyware</link>
    <description></description>
    <pubDate>Tue, 05 Aug 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Technology Tales from Thailand: KBank Fraud Management]]></title>
      <link>http://securityratty.com/article/5f893d1cf14b7adbe58a329292652735</link>
      <guid>http://securityratty.com/article/5f893d1cf14b7adbe58a329292652735</guid>
      <description><![CDATA[In The Magical ATM Card and SMS Message in Thailand we talked about booking flights and securely paying using a SMS PayCode and ATM transfer, avoiding the possibility of on-line credit card fraud; and...]]></description>
      <content:encoded><![CDATA[<p>In <a title="The Magical ATM Card and SMS Message in Thailand" rel="bookmark" href="http://www.thecepblog.com/2008/08/03/the-magical-atm-card-and-sms-message-in-thailand/"><span style="color: #105cb6;">The Magical ATM Card and SMS Message in Thailand</span></a> we talked about booking flights and securely paying using a SMS PayCode and ATM transfer, avoiding the possibility of on-line credit card fraud; and in <a title="Keyloggers: Why Banks Need Two-Factor Authentication" rel="bookmark" href="http://www.thecepblog.com/2008/01/14/keyloggers-why-banks-need-two-factor-authentication/"><span style="color: #105cb6;">Keyloggers: Why Banks Need Two-Factor Authentication</span></a> I described how <a href="http://www.kasikornbank.com/portal/site/KBank/?" target="_blank">KBank</a> uses SMS-based one-time-passwords (OTP) to authenticate transactions.   </p>
<p>In addition to the above services, KBank offers a service that permits users to receive an SMS message that details any change in account balance and/or point-of-sale (POS) transaction with your debit card.   I really like this service and the feeling of security knowing when, where and by how much my balance changes or my debit card is used in a transaction.    The KBank POS SMS notification is so fast that when I present my card to a merchant I normally receive an SMS message detailing the transaction before the merchant returns for my signature.  (There is an unfortunate lag in the balance change notification that can run minutes to hours behind real-time, but the POS VISA debit card notification is real-time).</p>
<p>As the story goes,  I should have been using my KBank card and account a few weeks ago and not my US-based VISA debit dard.  Why?</p>
<p>My US-based VISA debit card was cloned sometime on or before August 8th.   I am really careful with this card, so I was surprised the magnetic strip was cloned at a POS merchant.   The fraudster made 7 fraudulent transactions beginning on August 8th for a total of around $2500 USD, mostly on August 11th, before I discovered the fraudulent transactions viewing my account on-line.</p>
<p>This would not have happened with KBank SMS-based transaction notification services.</p>
<p>The first transaction with my cloned VISA debit card was less than $50 USD (I assume the fraudster was &#8220;testing the water&#8221;).   If I was using my KBank card, I would have received an immediate SMS message detailing a POS transaction in Bangkok when I was physically far away from Bangkok in Chiang Mai.   I could have immediately called the bank (or logged in) and blocked the debit card, limiting potential losses to the bank or the merchant to one fraudulent transaction, not seven.</p>
<p>In addition, KBank offers what they call a Web-Shopping VISA card, where you can go into your on-line account (verified by SMS OTP as mentioned) and request a VISA debit card number (with expiration date, CCV etc).   You set the limit from 0 to 500,000 THB (Thai Baht) per day; and you can login to your account and change this anytime (authenticating your transaction with another SMS-based OTP). You can also block or cancel this number anytime and apply for another one.</p>
<p>I am amazed that in Thailand I receive much better anti-fraud prevention and detection services than with banks in the US.   I know of no bank or brokerage in the US that offers the same quality of service and security as KBank in Thailand.  </p>
]]></content:encoded>
      <pubDate>Wed, 20 Aug 2008 03:16:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/visa debit card">visa debit card</category>
      <category domain="http://securityratty.com/tag/debit card">debit card</category>
      <category domain="http://securityratty.com/tag/card">card</category>
      <category domain="http://securityratty.com/tag/visa card">visa card</category>
      <category domain="http://securityratty.com/tag/kbank">kbank</category>
      <category domain="http://securityratty.com/tag/kbank card">kbank card</category>
      <category domain="http://securityratty.com/tag/transaction">transaction</category>
      <category domain="http://securityratty.com/tag/transaction notification services">transaction notification services</category>
      <category domain="http://securityratty.com/tag/fraudulent transaction">fraudulent transaction</category>
      <source url="http://www.thecepblog.com/2008/08/20/technology-tales-from-thailand/">Technology Tales from Thailand: KBank Fraud Management</source>
    </item>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Two]]></title>
      <link>http://securityratty.com/article/9d3454e7551fca2a11e4a5ee55704677</link>
      <guid>http://securityratty.com/article/9d3454e7551fca2a11e4a5ee55704677</guid>
      <description><![CDATA[With scammers continuing to introduce new typosquatted domains promoting well known brands of rogue security software that is most often found at the far end of a malware campaign, exposing yet...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKphU3YsSbI/AAAAAAAACDk/28wApKSrbYA/s1600-h/fake_security_software.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="76" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKphU3YsSbI/AAAAAAAACDk/bPxU6HdrxA8/s200-R/fake_security_software.JPG" width="200" /></a>With scammers continuing to introduce new typosquatted domains promoting well known brands of rogue security software that is most often found at the far end of a malware campaign, exposing yet another diverse portfolio of last week's introduced domains is what follows.<br />
<br />
Naturally, in between taking advantage of the usual hosting services, most of the domains remain parked at the same IPs, this centralization makes it easier to locate them all, then having to go through several misconfigured malicious doorways that will anyway expose the portfolio.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKpjp46fg4I/AAAAAAAACDs/hW-zlDsLSIg/s1600-h/antivirus_pro_2008.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="160" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKpjp46fg4I/AAAAAAAACDs/mjJJ2yUIcsE/s200-R/antivirus_pro_2008.png" width="200" /></a><b>antivirus2008t-pro .com</b> - (91.203.92.64; 78.157.142.7)<br />
<b>antivirus2008pro-download1 .com<br />
antivirus2008pro-download2 .com<br />
scanner.antivir64 .com<br />
antivirus2008t-pro .com<br />
antivirus-2008y-pro .com</b><br />
<br />
<b>&nbsp;systemscanner2009 .com</b> - (89.18.189.44; 208.88.53.114)<br />
<b>xpdownloadserver .com&nbsp;&nbsp;&nbsp; <br />
global-advers .com<br />
xpantivirus .com&nbsp;&nbsp;&nbsp; <br />
updatesantivirus .com<br />
windows-scannernv .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKpkn-kX73I/AAAAAAAACD0/GOsFiicPQXs/s1600-h/xp_anti_virus.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="160" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKpkn-kX73I/AAAAAAAACD0/AekOVq9ibn0/s200-R/xp_anti_virus.png" width="200" /></a><b>ratemyblog1 .com</b> - 208.88.53.114<br />
<b>windows-scanner2009 .com<br />
systemscanner2009 .com<br />
antivirus-database .com<br />
antivirus2009professional .com<br />
antivirus-2009pro .com<br />
antivirus2009-scanner .com<br />
global-advers .com<br />
drivemedirect .com<br />
windows-scannernv .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKpmSONqTJI/AAAAAAAACEE/4Cukn7sK9ek/s1600-h/fake_IE_7.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="160" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKpmSONqTJI/AAAAAAAACEE/iHExDhLb0z4/s200-R/fake_IE_7.png" width="200" /></a><b>webscweb-scannerfree .com</b> - (58.65.238.106; 208.88.53.180)<br />
<b>freebmwx3 .com<br />
mytube4 .com<br />
beginner2009 .com<br />
webscweb-scannerfree .com<br />
antivirus2009-software .com<br />
antivirus-database .com<br />
purchase-anti .com</b><br />
<br />
<b><br />
onlinescannerxp .com<br />
virus-onlinescanner .com<br />
spywareonlinescanner .com<br />
xponlinescanner .com<br />
virus-securityscanner .com<br />
virus-securityscanner .com<br />
webscannerfreever .com<br />
blazervips .com<br />
global-advers .com<br />
xpantivirus .com&nbsp;&nbsp;&nbsp; <br />
drivemedirect .com<br />
windows-scannernv .com</b><br />
<br />
<a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SKplujVb0XI/AAAAAAAACD8/laUP6HFKiPc/s1600-h/xp_anti_virus2.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SKplujVb0XI/AAAAAAAACD8/vH2l1Xo0k0Y/s200-R/xp_anti_virus2.png" /></a><b>mytube4 .com</b> - 58.65.238.106<br />
<b>beginner2009 .com<br />
webscweb-scannerfree .com<br />
securityscannerfree .com<br />
xpcleaner-online .com<br />
streamhotvideo .com<br />
xpcleanerpro .com<br />
onlinescannerxp .com<br />
online-xpcleaner .com<br />
antispyguard-scanner .com<br />
virus-onlinescanner .com<br />
microsoft.browsersecuritycenter .com<br />
fastupdateserver .com<br />
blazervips .com<br />
xpantivirus .com<br />
drivemedirect .com<br />
fastwebway .com<br />
xpantivirussecurity .com<br />
wordpress.firm .in<br />
megacodec .biz<br />
mcprivate .biz</b><br />
<br />
<b>internet-defense2009 .com </b>- 84.16.252.73<b><br />
myfreespace3 .com<br />
greatvideo3 .com<br />
internet-defense2009 .com<br />
windows-defense .com<br />
3gigabytes .com<br />
teledisons .com<br />
updatesantivirus .com<br />
update-direct .com<br />
xp-protectsoft .com</b><br />
<br />
<b>top-pc-scanner .com - </b>(91.203.92.50; 92.62.101.43)<b><br />
nortonsoft .com - </b>(91.186.11.5)<b><br />
powerantivirus-2009 .com - (</b>91.208.0.233)<b><br />
powerantivirus2009 .com - </b>(91.208.0.233)<b><br />
pwrantivirus .com - </b>(91.208.0.231)<b><br />
xp-guard .com - </b>(92.62.101.35)<b><br />
xpertantivirus .com - </b>(91.208.0.230)<b><br />
internetscanner2009 .com - </b>(89.149.229.168)<br />
<br />
Where's the business model here? Where it's always been, upon installation of the rogue security software, the malware campaigner earns up to 40% revenue from the rogue security software's vendor.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/04/localized-fake-security-software.html">Localized Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse Portfolio of Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/got-your-xpshield-up-and-running.html">Got Your XPShield Up and Running?</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/fake-pestpatrol-security-software.html">Fake PestPatrol Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br />
<a href="http://http//ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd</a><br />
<br />
<b></b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=h33YSK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=h33YSK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=jVrJfK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=jVrJfK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=FyAb7k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=FyAb7k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1wEuVk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1wEuVk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zeV8HK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zeV8HK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Xb2U2K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Xb2U2K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1JfUGk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1JfUGk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/368786894" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 21:51:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/portfolio">portfolio</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/rogue security software">rogue security software</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <category domain="http://securityratty.com/tag/domains remain">domains remain</category>
      <category domain="http://securityratty.com/tag/drivemedirect">drivemedirect</category>
      <category domain="http://securityratty.com/tag/global-advers">global-advers</category>
      <category domain="http://securityratty.com/tag/lazy summer days">lazy summer days</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/368786894/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Two</source>
    </item>
    <item>
      <title><![CDATA[Malicious Adobe Flash Ads Hit High-Profile Websites]]></title>
      <link>http://securityratty.com/article/7c521d10841f7c3d7edf4f1828800d37</link>
      <guid>http://securityratty.com/article/7c521d10841f7c3d7edf4f1828800d37</guid>
      <description><![CDATA[According to a post on the Bluetack Internet Security Solutions site, Newsweek.com is suspected of running rogue banner advertisements that try to trick visitors into installing fraudulent...]]></description>
      <content:encoded><![CDATA[According to a post on the Bluetack Internet Security Solutions site, Newsweek.com is suspected of running rogue banner advertisements that try to trick visitors into installing fraudulent anti-malware programs. Newsweek.com is one of several high-profile websites accused of exposing its readers to dangerous ads.
The malicious ads have been appearing on Newsweek&#8217;s website via feeds that [...]]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 19:17:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/high-profile websites">high-profile websites</category>
      <category domain="http://securityratty.com/tag/fraudulent anti-malware programs">fraudulent anti-malware programs</category>
      <category domain="http://securityratty.com/tag/rogue banner advertisements">rogue banner advertisements</category>
      <category domain="http://securityratty.com/tag/malicious ads">malicious ads</category>
      <category domain="http://securityratty.com/tag/newsweeks website">newsweeks website</category>
      <category domain="http://securityratty.com/tag/newsweek">newsweek</category>
      <category domain="http://securityratty.com/tag/trick visitors">trick visitors</category>
      <category domain="http://securityratty.com/tag/dangerous ads">dangerous ads</category>
      <category domain="http://securityratty.com/tag/feeds">feeds</category>
      <source url="http://cyberinsecure.com/malicious-adobe-flash-ads-hit-high-profile-websites/">Malicious Adobe Flash Ads Hit High-Profile Websites</source>
    </item>
    <item>
      <title><![CDATA[Anti-Georgia spammers building new botnet]]></title>
      <link>http://securityratty.com/article/fb40e81f04b22ace544dd6979a548459</link>
      <guid>http://securityratty.com/article/fb40e81f04b22ace544dd6979a548459</guid>
      <description><![CDATA[Hackers targeting Georgia in the midst of its conflict with Russia have started sending out a new batch of malicious spam messages, apparently with the aim of building a new botnet network of...]]></description>
      <content:encoded><![CDATA[Hackers targeting Georgia in the midst of its conflict with Russia have started sending out a new batch of malicious spam messages, apparently with the aim of building a new botnet network of remote-controlled computers.]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malicious spam messages">malicious spam messages</category>
      <category domain="http://securityratty.com/tag/botnet network">botnet network</category>
      <category domain="http://securityratty.com/tag/georgia">georgia</category>
      <category domain="http://securityratty.com/tag/apparently">apparently</category>
      <category domain="http://securityratty.com/tag/russia">russia</category>
      <category domain="http://securityratty.com/tag/conflict">conflict</category>
      <category domain="http://securityratty.com/tag/aim">aim</category>
      <category domain="http://securityratty.com/tag/computers">computers</category>
      <category domain="http://securityratty.com/tag/midst">midst</category>
      <source url="http://www.networkworld.com/news/2008/081508-anti-georgia-spammers-building-new.html?fsrc=rss-security">Anti-Georgia spammers building new botnet</source>
    </item>
    <item>
      <title><![CDATA[Data Mining to Detect Pump-and-Dump Scams]]></title>
      <link>http://securityratty.com/article/a5878a5dbedbdb06b13ea9db23d0e411</link>
      <guid>http://securityratty.com/article/a5878a5dbedbdb06b13ea9db23d0e411</guid>
      <description><![CDATA[I don't know any of the details, but this seems like a good use of data mining: Mr Tancredi said Verisign's fraud detection kit would help &quot;decrease the time between the attack being launched and the...]]></description>
      <content:encoded><![CDATA[<p>I don't know any of the details, but <a href="http://news.bbc.co.uk/1/hi/technology/7552009.stm">this</a> seems like a good use of data mining:</p>

<blockquote>Mr Tancredi said Verisign's fraud detection kit would help "decrease the time between the attack being launched and the brokerage being able to respond".

<p>Before now, he said, brokerages relied on counter measures such as restrictive stock trading or analysis packages that only spotted a problem when money had gone.</p>

<p>Verisign's software is a module that brokers can add to their in-house trading system that alerts anti-fraud teams to look more closely at trades that exhibit certain behaviour patterns.</p>

<p>"What this self-learning behavioural engine does is look at the different attributes of the event, not necessarily about the computer or where you are logging on from but about the actual transaction, the trade, the amount of the trade," said Mr Tancredi.</p>

<p>"For example have you liquidated all of your assets in stock that you own in order to buy one penny stock?" he said. "Another example is when a customer who normally trades tech stock on Nasdaq all of a sudden trades a penny stock that has to do with health care and is placing a trade four times more than normal."</blockquote></p>

<p>This is a good use of data mining because, as I <a href="http://www.schneier.com/blog/archives/2006/03/data_mining_for.html">said</a> previously:</p>

<blockquote>Data mining works best when there's a well-defined profile you're searching for, a reasonable number of attacks per year, and a low cost of false alarms.</blockquote>

<p>Another news article <a href="http://news.yahoo.com/s/zd/20080811/tc_zd/230711">here</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=MmnOWK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=MmnOWK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=pZdBMK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=pZdBMK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 02:10:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/stock">stock</category>
      <category domain="http://securityratty.com/tag/penny stock">penny stock</category>
      <category domain="http://securityratty.com/tag/restrictive stock">restrictive stock</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/trades tech stock">trades tech stock</category>
      <category domain="http://securityratty.com/tag/trades">trades</category>
      <category domain="http://securityratty.com/tag/fraud detection kit">fraud detection kit</category>
      <category domain="http://securityratty.com/tag/alerts anti-fraud teams">alerts anti-fraud teams</category>
      <category domain="http://securityratty.com/tag/trade">trade</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/data_mining_to.html">Data Mining to Detect Pump-and-Dump Scams</source>
    </item>
    <item>
      <title><![CDATA[CNN Custom Alerts Spam]]></title>
      <link>http://securityratty.com/article/f544d5e769f123f7cc5f3036bac72fdd</link>
      <guid>http://securityratty.com/article/f544d5e769f123f7cc5f3036bac72fdd</guid>
      <description><![CDATA[In general, my anti-spam filters and tools are pretty effective. So when I start to see something like this







it's obvious that a huge spam wave is underway. These are, of course, related to the...]]></description>
      <content:encoded><![CDATA[
        In general, my anti-spam filters and tools are pretty effective. So when I start to see something like this....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="cn1.jpg" src="http://blog.spywareguide.com/images/cn1.jpg" class="mt-image-none" style="" height="137" width="193" /></span></div><br /> <div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="cn2.jpg" src="http://blog.spywareguide.com/images/cn2.jpg" class="mt-image-none" style="" height="247" width="214" /></span></div>
<br />....it's obvious that a huge spam wave is underway. These are, of course, related to the <a href="http://blog.spywareguide.com/2008/08/cnn-daily-top-10-videos-spam.html">fake CNN Spam</a> from a few days ago. Here, the emails take the form of "custom alerts":<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/cn32.html" onclick="window.open('http://blog.spywareguide.com/images/cn32.html','popup','width=613,height=352,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/cn3-thumb-313x179.jpg" alt="cn3.jpg" class="mt-image-none" style="" height="179" width="313" /></a></span><br /><br />Click to Enlarge<br /></div><br />I've seen two types of this mail - one links to a genuine CNN article from the headline text (with the smaller link underneath leading to an infection site), the other simply links to the infection site from both clickable links. As before, deleting these Emails is the best course of action. Interestingly, the format of these mails might not be working to the spammers advantage. Lots of people I've talked to who had one of these mails sent through simply deleted them without a second thought, thinking it was merely something on the real CNN they thought they'd signed up to and didn't actually want.<br /><br /></div><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Sun, 10 Aug 2008 13:28:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/links">links</category>
      <category domain="http://securityratty.com/tag/clickable links">clickable links</category>
      <category domain="http://securityratty.com/tag/simply links">simply links</category>
      <category domain="http://securityratty.com/tag/simply">simply</category>
      <category domain="http://securityratty.com/tag/custom alerts">custom alerts</category>
      <category domain="http://securityratty.com/tag/infection site">infection site</category>
      <category domain="http://securityratty.com/tag/fake cnn spam">fake cnn spam</category>
      <category domain="http://securityratty.com/tag/genuine cnn article">genuine cnn article</category>
      <category domain="http://securityratty.com/tag/huge spam wave">huge spam wave</category>
      <source url="http://blog.spywareguide.com/2008/08/cnn-custom-alerts.html">CNN Custom Alerts Spam</source>
    </item>
    <item>
      <title><![CDATA[Email Hacking Going Commercial - Part Two]]></title>
      <link>http://securityratty.com/article/403816e80242e85ea676f8d2be0684b6</link>
      <guid>http://securityratty.com/article/403816e80242e85ea676f8d2be0684b6</guid>
      <description><![CDATA[Malware authors seeking financial gains from releasing their trojans often promote them as Remote Access Tools , which if we exclude the built-in anti-sandboxing and antivirus software killing...]]></description>
      <content:encoded><![CDATA[<a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SJtd4DC75_I/AAAAAAAACBE/No0eDRtdb8s/s1600-h/hire_to_hack.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SJtd4DC75_I/AAAAAAAACBE/BK1B_uN_Iew/s200-R/hire_to_hack.png" style="border: 0pt none ;" /></a>Malware authors seeking financial gains from releasing their trojans often promote them as <a href="http://ddanchev.blogspot.com/2007/07/shark2-rat-or-malware.html">Remote Access Tools</a>, which if we exclude the built-in anti-sandboxing and antivirus software killing capabilities, <a href="http://ddanchev.blogspot.com/2007/08/rats-or-malware.html">could pass for a RAT</a>. In a similar deceptive fashion, <a href="http://ddanchev.blogspot.com/2008/07/email-hacking-going-commercial.html">email hacking services are pitched as email password recovery services</a>. <br />
<br />
Hacking as a Service sites seems to be popping out like mushrooms these days, thanks primarily due to the fact that yesterday's script kiddies are today's entrepreneurs trying to even monetize the process of bruteforcing. Here's their pitch :<br />
<br />
"<i>Well.. There is nothing different in our       services. Like other group, we simply crack email addresses       , and provide you the current password used by the victim to       you for a suitable price. Nothing unique that we can brag       about....&nbsp; We don't hack NASA or CIA , we cannot hack a       bank and steal a million dollars.. We just crack email       password .. AND WE DO A HECK OF A JOB IN IT !! We cannot be as presentable as the other       groups, trying to look as formal and corporate, as if they       are running a Major Corporate Office. However they present       it...password retrieval, online investigation.. access       recovery...blah blah blah..&nbsp; the most simplest way to       put it is.. : Email Password Cracking: !! And since everyone else is busy faking       it, or trying to be more presentable, we utilize our skills       to get you what you want.. i.e. THE EMAIL PASSWORD. No       buttering up, no marketing skills..&nbsp; plain hardcore       hacking !! So, since you now know what we do , and       want us to do the job for you, please proceed to the order       page for your relevant TARGET EMAIL and submit your request.       All said and done, we will get the elusive password &amp; send       you a couple of proofs. You decide upon the authenticity of       the proofs, and let us know if you are comfortable going       ahead with the payment. PAY US, AND YOU GET THE PASSWORD !And as they say.......</i>"<br />
<br />
How much are they charging for the bruteforcing? $150 for starters, which is prone to increase due to their bla bla bla about how sophisticated it was to obtain the password - given they actually manage to deliver the goods :&nbsp; <br />
<br />
<div class="separator" style="text-align: center; clear: both;"><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SJyWntxCJWI/AAAAAAAACBU/aVdgDf7K46o/s1600-h/hire_to_hack1.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img height="160" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SJyWntxCJWI/AAAAAAAACBU/wsy8qQ3XtGQ/s200-R/hire_to_hack1.png" style="border: 0pt none ;" width="200" /></a></div>"<i>Many groups charge a fixed price for an email cracking. We undertake more kinds of projects than anyone else. Frankly, each email is a different project in itself. We cannot charge you $100, for something which we can do for $50. Subsequently, we cannot charge you $100, for something which should be priced at $200. But we charge a minimum of $150 USD so that we end up taking orders from ONLY those who really need it. It is a small amount for the level of satisfaction, facts/truth and relief that you would ultimately achieve from this.It depends upon the nature of the job, the accessibility factor. and many other reasons likes:-<br />
<br />
1- The email service provider<br />
2- The target itself. How net-savvy he/she is.<br />
3- Complexity of the password<br />
4- Urgency of job and many other things collectively.<br />
<br />
We will let you know our charges once we have the desired results only. Be assured, we wont charge you the moon. We charge only what we deserve, and is acceptable by you. Trust us !!</i>"<br />
<br />
Some of their answers to the frequently asked questions :<br />
<br />
" <i>- <b>Who are you? Where are you from</b>?<br />
We are Hire2Hack Group. Member of our group are students in information technology, at some university in England, France, Italy, Japan, Australia, Canada, Brasilia and at United States of America.<br />
<br />
- <b>What services do you provide?</b><br />
We can hack ANY EMAIL password for you very fast, reliable, secure and worldwide for a suitable price.<br />
<br />
- <b>Can you really hack password or just a making a shit scam?</b><br />
Well, lot of people, lot of groups, companies do this service, but not guaranteed. This is only you can choose which group you want to Order. Be careful with these people. You can believe only on them who claims to provide proof before you really pay them.<br />
<br />
- <b>Is there any tool available to crack password?</b><br />
Yes there is. And we are not giving it to you.<br />
<br />
- <b>How long does it takes to crack a password?</b><br />
Each account is different and hacking time vary. On average, it might take about 1 to 3 days, but it may take anywhere from 24 hours to 30 days or more depending on how difficult is the hacking of each account.<br />
<br />
- <b>How can I believe you, that you got password?</b><br />
We will provide you some good proofs before requesting you to pay us. The proof can be anything, you can decide what kind proof you need.<br />
<br />
- <b>Is there person will know that his/her email id has been cracked?</b><br />
No, we provide you only the original password. That mean the current active password. Your victim/target will not realized that she/he has been hacked. NEVER, we said !<br />
<br />
- <b>How I will pay you, I do not have credit card or I do not want to give my credit card number on net?</b><br />
Well, you can use international money transfer service such as Western Union (www.westernunion.com) or Money Gram (www.moneygram.com). These services immediate transfer money on same day or same hour. You can locate their agents in yours area from their website.<br />
<br />
- <b>Do I have to give you my password?</b><br />
No. Any service which requires your password is simply trying to scam you out of access to your account.<br />
<br />
- <b>How will I know you really have the password?</b><br />
We will show you the proofs.. which are mostly convincing.<br />
<br />
- <b>Since you have the password anyway, will you give it to me?</b><br />
NO. Do not waste your time or ours. We will not release the password until full payment is made - no exceptions. We have had people request our service and once we recover the password, they reset the subject account then ask us for the original password so they can reset it back - the answer will be no. We have also had people ask if they could have the password since we've already recovered it and they cannot pay - the answer will be no. No password will be released until payment has been made in full - no exceptions.<br />
<br />
- <b>Will you recover more than one password? Can I request more than one email account?</b><br />
Yes, but a separate request must be filled out for each one as you will only be billed for each successful recovery. If we have previously recovered a password for you and you have not paid, we will not begin any new request for you until your previous request is paid in full with exceptions for our established clientele. We charge at minimum US $100 for each account hacked.<br />
<br />
- <b>Do you reset or change the current password?</b><br />
No. We do not try to guess the current password or the secret question's answer, we do not change their password. We give you only the Original password, which the victim is currently using.<br />
<br />
- <b>Is this confidential? Do you share my information with anyone else</b>?<br />
No, Not at all, Not in any case, its a trust between you and us. Your information will be respected as long as you abide by our Terms and Conditions and Privacy policy. We keep your personal records and requests confidential in our database but we respect your right to privacy and will not rent, share, sell, or trade any personal information unless required by law. <b>But, if you engage in any spamming or fraudulent actives, Your information will be given to the appropriate authorities.</b></i>"<br />
<br />
So you've got script kiddies cracking email addresses and probably engaging in the rest of the usual cybercrime activities, who are spam sensitive, and would expose their customers if they start spamming from the cracked emails? Now that's socially responsible, isn't it.<br />
<br />
Targeted attacks are sexy, but bruteforcing email accounts no matter the number of proxies and wordlists that they have access to is so irrelevant, that social engineering a potential victim into infecting herself with malware through a live exploit URL seems to be the method of choice, next to a plain simple phishing email of course. In this case, what they're asking for in respect to the victim's details is the victim's country and victim's language, so that a localized social engineering or phishing attack can take place. However, this particular group seems to be using a standard bruteforcing tool.<br />
<br />
One thing's for sure - cybercrime is getting easier to outsource, and with potential customers starting to have access to services they didn't a couple of years ago, <a href="http://ddanchev.blogspot.com/2008/08/phishers-backdooring-phishing-pages-to.html">fake scammers are also emerging in between the real ones</a>.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Q4SazK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Q4SazK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=v68SQK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=v68SQK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fTxCfk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fTxCfk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=m5GSCk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=m5GSCk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=rFpJlK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=rFpJlK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=hDloOK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=hDloOK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kzNwqk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kzNwqk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/359698182" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 08 Aug 2008 10:31:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/crack password">crack password</category>
      <category domain="http://securityratty.com/tag/crack">crack</category>
      <category domain="http://securityratty.com/tag/crack email password">crack email password</category>
      <category domain="http://securityratty.com/tag/email password">email password</category>
      <category domain="http://securityratty.com/tag/password">password</category>
      <category domain="http://securityratty.com/tag/original password">original password</category>
      <category domain="http://securityratty.com/tag/current password">current password</category>
      <category domain="http://securityratty.com/tag/password retrieval">password retrieval</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/359698182/email-hacking-going-commercial-part-two.html">Email Hacking Going Commercial - Part Two</source>
    </item>
    <item>
      <title><![CDATA[Proactive Education: Remedying the 'Strain' of Compliance]]></title>
      <link>http://securityratty.com/article/fd8c75c1b98a515b5ea3bc2571d11031</link>
      <guid>http://securityratty.com/article/fd8c75c1b98a515b5ea3bc2571d11031</guid>
      <description><![CDATA[A recent survey confirmed that internal threats continue to grow and to represent a challenge to organizations' security postures. It revealed that, in scans of 100,000 PCs and servers in many...]]></description>
      <content:encoded><![CDATA[A recent <a href="http://www.darkreading.com/document.asp?doc_id=160154">survey</a> confirmed that internal threats continue to grow and to represent a challenge to organizations' security postures.  It revealed that, in scans of 100,000 PCs and servers in many industries: 12% of infected computers had a missing or disabled anti-virus program, 10.7% had unauthorized personal storage such as USB sticks or external hard drives, 9.1% had unauthorized peer-to-peer (P2P) applications installed, 8.5% had a missing 3rd party desktop agent, 2.6% had unprotected shared folders, 2.2% had unauthorized remote control software, and 2% had missing Microsoft service packs.  These results continue to resonate with the conclusions of the <a href="http://www.gocsi.com/forms/csi_survey.jhtml">CSI FBI survey</a> that reported in 2007 that <b>internal threats have now outpaced viruses in terms of risk to organizations...</b>  

]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/internal threats">internal threats</category>
      <category domain="http://securityratty.com/tag/internal threats continue">internal threats continue</category>
      <category domain="http://securityratty.com/tag/csi fbi survey">csi fbi survey</category>
      <category domain="http://securityratty.com/tag/remote control software">remote control software</category>
      <category domain="http://securityratty.com/tag/microsoft service packs">microsoft service packs</category>
      <category domain="http://securityratty.com/tag/usb sticks">usb sticks</category>
      <category domain="http://securityratty.com/tag/recent survey">recent survey</category>
      <category domain="http://securityratty.com/tag/personal storage">personal storage</category>
      <category domain="http://securityratty.com/tag/security postures">security postures</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1327">Proactive Education: Remedying the 'Strain' of Compliance</source>
    </item>
    <item>
      <title><![CDATA[Mac users are advised not to use Safari by Consumer Reports]]></title>
      <link>http://securityratty.com/article/0a5177838ff7c89761a7beef329bc56d</link>
      <guid>http://securityratty.com/article/0a5177838ff7c89761a7beef329bc56d</guid>
      <description><![CDATA[According to this years State of the Net survey, Mac users fall prey to phishing scams at about the same rate as Windows users, yet far fewer of them protect themselves with an anti-phishing toolbar....]]></description>
      <content:encoded><![CDATA[According to this year’s State of the Net survey, Mac users fall prey to phishing scams at about the same rate as Windows users, yet far fewer of them protect themselves with an anti-phishing toolbar. To make matters worse, the browser of choice for most Mac users, Apple’s Safari, has no phishing protection. Consumer Reports [...]]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 18:26:29 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mac users">mac users</category>
      <category domain="http://securityratty.com/tag/consumer reports">consumer reports</category>
      <category domain="http://securityratty.com/tag/net survey">net survey</category>
      <category domain="http://securityratty.com/tag/apples safari">apples safari</category>
      <category domain="http://securityratty.com/tag/matters worse">matters worse</category>
      <category domain="http://securityratty.com/tag/windows users">windows users</category>
      <category domain="http://securityratty.com/tag/protection">protection</category>
      <category domain="http://securityratty.com/tag/browser">browser</category>
      <category domain="http://securityratty.com/tag/toolbar">toolbar</category>
      <source url="http://cyberinsecure.com/mac-users-are-advised-not-to-use-safari-by-consumer-reports/">Mac users are advised not to use Safari by Consumer Reports</source>
    </item>
    <item>
      <title><![CDATA[More ways to protect yourself from phishing]]></title>
      <link>http://securityratty.com/article/7a9814896ec45271705fc9663da1bd25</link>
      <guid>http://securityratty.com/article/7a9814896ec45271705fc9663da1bd25</guid>
      <description><![CDATA[In my recent Editors' Notes post on Consumer Reports' recommendation that Mac users dump Safari because the Apple browser lacks the anti-phishing tools of Firefox and Opera, I focused on behavioral...]]></description>
      <content:encoded><![CDATA[In my recent Editors' Notes post on Consumer Reports' recommendation that Mac users dump Safari because the Apple browser lacks the anti-phishing tools of Firefox and Opera, I focused on behavioral changes one can make that minimize the risks of phishing attempts. I didn't, however, discuss a relatively simple configuration change you can make to your Mac that will give you a real anti-phishing tool--in Safari or any other browser you might want to use.]]></content:encoded>
      <pubDate>Tue, 05 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/browser">browser</category>
      <category domain="http://securityratty.com/tag/apple browser lacks">apple browser lacks</category>
      <category domain="http://securityratty.com/tag/simple configuration change">simple configuration change</category>
      <category domain="http://securityratty.com/tag/recent editors">recent editors</category>
      <category domain="http://securityratty.com/tag/consumer reports">consumer reports</category>
      <category domain="http://securityratty.com/tag/notes post">notes post</category>
      <category domain="http://securityratty.com/tag/opera">opera</category>
      <category domain="http://securityratty.com/tag/risks">risks</category>
      <category domain="http://securityratty.com/tag/tool">tool</category>
      <source url="http://www.networkworld.com/news/2008/080608-more-ways-to-protect-yourself.html?fsrc=rss-security">More ways to protect yourself from phishing</source>
    </item>
  </channel>
</rss>
