Weird spam #2: "BREAKING NEWS - The Pope has been discharged from his office"

A genuine "wtf" spam here:

Subject: BREAKING NEWS - The Pope has been discharged from his office
From: "Press Officer"

BREAKING NEWS

Feb. 2009 - The Pope has been discharged from his office!

Find out more at Urgent news
[http://208.91.200.49/interspire/link.php?M=00000&N=5&L=1&F=T]

Unsubscribe me from this contact list
[http://208.91.200.49/interspire/link.php?M=00000&N=5&L=2&F=T]

Powered by Interspire

The page 404s. But wait.. the email was sent from 208.91.200.49 and points to the same IP address. And the domain rcigi.com is hosted a few IPs over at 208.91.200.35.

What is rcigi.com? It calls itself the RC-Institute for Global Individuation and hides behind an anonymous domain registration. The site is either a spoof, or perhaps the domain of some religious nutters. It is hard to tell. Interesting, it is in English and German, and the way the English is written makes me think that it might be a native German speaker writing it.

The site indicates that it is run by a "Dr" Eduard Schellhammer of either Barcelona or Alicante. All the sites linking FROM rcigi.com are registered to Eduard Schellhammer, however it is possible that this is a sophisticated Joe Job and Herr Schellhammer is completely innocent. Still, all very odd.

Weird spam #1: "Warning! Virus detected"

A couple of bits of weird spam today, number one:

Subject: Warning! Virus detected

A possible virus was found in this message.
The virus name is: W32/Netskyb@MM!zip

-----Original Message-----
Hello, check my postcard!
[skipped]
--------------------------

In all cases leading to what appears to be a page on a compromised PHP-powered site, but in each case the page is coming up with a 404. Is it related to this?

UNYK.com: spam or what?

I really, really hate these contact managers that spam out invites to everyone's contacts. UNYK.com seems to be the latest of these:

Subject: Personal invitation from ****************

Hello,

This is a way to never lose contact.

Finally, a smart and simple way to manage your contacts!

With UNYK, I put all my contacts together in one address book that is automatically updated. One of my contacts changes his or her information at UNYK.com: My address book is updated. I change information at UNYK.com: My contacts’ address books are updated. Simple, but life-changing!

Can I add you as one of my contacts? To accept, click here!

You too can create your own smart address book.

Life-changing my arse.. Plaxo has been doing this for years and that's a pretty worthless application to.

If you are a corporate mail administrator, then my advice has always been to block this kind of rubbish. As you might expect, it comes with some downloads that you probably don't want to let anywhere near your users' PCs, and it is bound to generate a load of support calls asking "is this spam?" / "this looks like a good idea, doesn't it?" / "is this a virus?" / "how do I install this?" etcetera.

No, I'm not saying that UNYK.com is evil in any way, it is just that for many sysadmins this sort of stuff costs real money when the users latch onto it. The best thing to do is apply an IP block to 204.92.8.159 to 204.92.8.220, and hopefully you will never be bothered by UNYK.com again.

BitDefender: Trojan.Generic.1423603 in winlogon.exe

This looks like a false positive: BitDefender is reporting Trojan.Generic.1423603 in C:\windows\system32\winlogon.exe. This name is sometimes used by malware, but in this case no other product is detecting anything malicious.

Current pattern is for BitDefender is 2640654, pushed out on Friday 13th February (!).

I will post the ThreatExpert prognosis when I get it.. in the mean time I would suggest that you do NOT try to remove winlogon.exe as you will render your system unbootable. (NOTE: Do NOT reboot your machine as this will most likely break it!)

Update: ThreatExpert indicates that it is clean. Several comments confirm that it is a false positive. The problem seems to be on Windows XP SP3, SP2 does not seem to have the same issue. The MD5 for this file is ed0ef0a136dec83df69f04118870003e

It seems that there are several reports at the BitDefender forum. I would guess that BitDefender are aware of the problem, temporarily disabling the anti-virus scanner may be a good idea else your system may become unusable. Usually these issues are fixed in 24 hours.

Update 2:
If you can't get the winlogon.exe out of quarantine, then this is a copy of the original (English US) file for XP SP3. Use at your own risk - password is "bitdefender".
winlogon_xpsp3.zip

Good new. Bad news.

A couple of items of interest from The Register:

OpenDNS rolls out Conficker tracking, blocking
This seems like a great idea, especially for small organisations without IDS or traffic monitoring. The problem.. well, OpenDNS has been awfully slow recently and personally I had to stop using it.

Kaspersky breach exposes sensitive database, hacker claims
This looks like a case of an insecure SQL database, leading to a potentially nasty compromise. Kaspersky isn't the first AV vendor to be shown to have poor SQL security. Trend was hit last year, as was CA. In this case, it looks like a potential data breach which is embarrassing. There's no evidence that any Kaspersky product has been compromised, but you can see that it might be possible to leverage credentials exposed in the SQL injection attack and use them elsewhere.

Snow

It really doesn't usually snow this much around here...

Snow bear

The heaviest snowfall for a zillion years or something in the UK.. it appears to have brought out this snow bear which is lurking in the garden.


I think he's probably harmless enough.

Drive-by cloning of RFID passports

Here's a different type of drive-by attack than the usual one.. security researcher Chris Paget shows that it is possible to read RFID tages from a passing moving vehicle and clone all the information they contain.. for the price of $250 worth of kit off eBay.

UkrTeleGroup vanishes, morphs.

First some good news (via the WaPo Security Fix blog): well known black hat web host UkrTeleGroup appears to have vanished from the internet. The bad news is that seems to have morphed into a company called Internet Path which is masquerading as a US company.

Unfortunately, it does not appear that this is an Atrivo / McColo / Estdomains style situation where the bad guys are permanently shut down.. yet. But perhaps continued pressure on upstream providers might have some effect.. who knows?

Uh-oh

No doubt the whole of the south of England will grind to a halt under this stuff, to the amusement of people who get REAL snow.. but a rear wheel drive sports car with no snow tyres is not exactly ideal for these conditions.

"Zhudian Machinery" / zhudian-m.com scam

A strange, tersely worded email from some scammer or other:

Subject: Representative Needed
From: "ZHUDIAN MACHINERY"

How would you feel to work for the Zhudian Machinery and earn good money? Contact Qi
Par via email: employment@zhudian-m.com

How would I feel? Well, alarmed and upset probably when the police kick down my door with a warrant because of the money laundering I've been doing for this so called "Zhudian Machinery".

Oddly, the domain is registered with a set of fake details pointing at the UK:

Domain name: ZHUDIAN-M.COM
Created on: 2008-11-05
Updated on: 2008-11-05
Expires on: 2009-11-05
Registrant Name: PETER LLEWELLYN-JONES
Contact: Peter Llewellyn-Jones
Registrant Address: no 43567 broad street
Registrant City: england
Registrant Postal Code: ch1 1lt
Registrant Country: GB
Administrative Contact Organization: Peter Llewellyn-Jones
Administrative Contact Name: Peter Llewellyn-Jones
Administrative Contact Address: no 43567 broad street
Administrative Contact City: england
Administrative Contact Postal Code: ch1 1lt
Administrative Contact Country: GB
Administrative Contact Email: kedenor@gmail.com
Administrative Contact Tel: +44 701 1130444
Administrative Contact Fax: +44 701 1130444
Technical Contact Organization: Technical Support
Technical Contact Name:
Technical Contact Address: Via A Ponti, 6
Technical Contact City: Bergamo
Technical Contact Postal Code: 24126
Technical Contact Country: IT
Technical Contact Email: support@register.it
Technical Contact Phone: +39 035 3230400
Technical Contact Fax: +39 035 3230312
Primary Name Server Hostname: NS1.REGISTER.IT
Secondary Name Server Hostname: NS2.REGISTER.IT

The "CH1 1LT" postcode given is the Chester Grosvenor Hotel but the rest of the address doesn't match and is clearly nonsense. The +44 701 1130444 number given looks like a UK number, but in fact it's a "follow me anywhere" number that is probably just forwarding to another number outside the UK.

Originating IP address is 206.47.199.87 which is well known for spam. Email address was harvested from a "free webspace provider".

Asprox: dbrgf.ru

Another domain to look for in SQL injection attacks is dbrgf.ru, still calling script.js. Checking your proxy logs for ".ru/script.js" is a good idea at the moment.

It might also be worth checking for the string "google-analitycs" as the attacks redirect through a subdomain containing that mis-spelled phrase.

Asprox: lijg.ru and dbrgf.ru

A fresh round of SQL injections seem to be on the march, with (at least) two new domains being injected into vulnerable sites: www.lijg.ru and www.dbrgf.ru, calling a script named script.js.

This script redirects through an IFRAME pointing to google-analitycs.lijg.ru, although the payload is unclear.

Including some older domains, the following list seem to be active, either calling script.js or style.js.

• www.lijg.ru
• www.dbrgf.ru
• www.bnmd.kz
• www.nvepe.ru
• www.mtno.ru
• www.wmpd.ru
• www.msngk6.ru
• www.dft6s.kz

For the record, the domain registrations are as follows:

domain: LIJG.RU
type: CORPORATE
nserver: ns2.lijg.ru. 68.4.124.142
nserver: ns5.lijg.ru. 74.129.255.164
nserver: ns1.lijg.ru. 68.6.180.109
nserver: ns3.lijg.ru. 67.38.2.113
nserver: ns4.lijg.ru. 76.240.151.177
state: REGISTERED, DELEGATED
person: Andrey G Chalkov
phone: +7 495 9385996
e-mail: chalkov@laptopmix.net
registrar: NAUNET-REG-RIPN
created: 2009.01.20
paid-till: 2010.01.20
source: TC-RIPN


domain: DBRGF.RU
type: CORPORATE
nserver: ns5.dbrgf.ru. 74.196.121.117
nserver: ns4.dbrgf.ru. 68.105.25.64
nserver: ns1.dbrgf.ru. 75.156.152.67
nserver: ns2.dbrgf.ru. 68.197.137.239
nserver: ns3.dbrgf.ru. 146.57.249.100
state: REGISTERED, DELEGATED
person: Andrey G Chalkov
phone: +7 495 9385996
e-mail: chalkov@laptopmix.net
registrar: NAUNET-REG-RIPN
created: 2009.01.20
paid-till: 2010.01.20
source: TC-RIPN

"Soft Fund Ltd" scam

Soft Fund Ltd is a wholly legitimate Ukrainian company. This email claims to be from Soft Fund Ltd, but isn't.

From: support.softfund@gmail.com

Hello Sir/Madam.

I Alex Feigin,
Director of Soft Fund Ltd specializes in innovative IT solutions and complex software projects development.

My company based in Ukraine. We've earned ourselves a reputation of a reliable and trustworthy partner working successfully with a number of West European companies and providing them with reliable software development services in financial and media sectors. Unfortunately we are currently facing some difficulties with receiving payments for our services. It usually takes us 10-30 days to receive a payment and clearing from your country and such delays are harmful to our business. We do not have so much time to accept every wire transfer.

That's why we are currently looking for partners in your country to help us accept and process these payments faster. If you are looking for a chance to make an additional profit you can become our representative in your country. As our representative you will receive 8% of every deal we conduct. Your job will be accepting funds in the form of wire transfers and forwarding them to us. It is not a full-time job, but rather a very convenient and fast way to receive additional income. We also consider opening an office in your country in the nearest future and you will then have certain privileges should you decide to apply for a full-time job. Please if you are interested in transacting business with us we will be very glad.

Please contact me for more information via email: SoftFundjob@gmail.com

and send us the following information about yourself:

1. Your Full Name as it appears on your resume.
2. Education.
3. Your Contact Address.
4. Telephone/Fax number.
5. Your present Occupation and Position currently held.
6. Your Age

Please respond and we will provide you with additional details on how you can become our representative. Joining us and starting business today will cost you nothing and you will be able to earn a bit of extra money fast and easy. Should you have any questions, please feel free to contact us with all your questions.

Thank you,
Director
Alex Feigin ,
Soft Fund Ltd

Alexander Feigin is a director of the REAL Soft Fund Ltd, but this email is completely fake. It is a standard money mule scam, one of many pretending to be from legitimate IT firms in the Ukraine. Soft Fund Ltd have nothing to do with the email, and you should not respond to it.

The originating IP is 209.239.38.111. Two sample subject lines are "Not give a convenient time for you extra income" and "We work closely together! Additional income for you!". Avoid.

"Polish fine art studio" scam

Is this a money mule scam? A package reshipping scam? Something else? It's certainly a scam.. perhaps an art scam designed to process fraudulently obtained artwork. Jennifer's "from" address says "Max" and the email originates from 189.68.40.112 in Brazil.

Subject: I'm looking for somebody to replace me, A

Hello. I am really sorry to bothering you. I am going to get married and leaving to my husband to Cyprus. I have been working with a reliable partner from Poland for 2 years. I had an additional income of 2.000$-4.000$ per month. Because I am not going to live in the USA I offer my friends to cover this position. I have sent emails to all contacts in my address-book. In the USA I was a representative of a Polish fine art studio. I'm not an artist and don't know a lot about it. I controlled pictures acceptance and customers' payments. I got rejected pictures and then I was sending them to other customers with discounts. Sometimes I had to do little things. 2% turnover award fee is usually was paid in addition to $2000.00 month earning , to keep the team spirit. Before Christmas I earned over $5.000,00. If you are interested, please send your CV and Cover Letter directly to the manager at e-mail vitoldklepatski73@gmail.com . I'll be very pleased if you or somebody of your relatives or friends get this position, but not a strange person from an employment agency. When I first walked in it seemed to me that this work is very difficult, but it is not like that, this is very easy job and they showed and taught me everything about my job, and it took me 2 days to learn. People are very nice there and helpful. I think you don't have to miss an opportunity like this. My Best Regards to you my friends and I hope your had a great holidays.
Good luck! Jennifer

Amusing 419 from "EFCC Investigation Office Nigeria"

A novel take on the 419 scam:

Subject: DID YOU AUTHORIZE MR. JOHN WHEELER FOR YOUR FUND CLAIMS
From: Mooreh Rose {mrsrosemooreh44@yahoo.com.hk}
Date: Tue, January 20, 2009 10:51 am

- Attention; Beneficiary, I am Mrs. Rose Moore (Assistance) Chairman from Efcc Investigation Office Nigeria, there is presently a counter claims on your funds by one MR.JOHN WHEELER, who is presently trying to make us believe that you are dead and even explained that you entered into an agreement with him, to help you in receiving your fund, So here comes the big question. Did you sign any Deed of Assignment in favor of (JOHN WHEELER). thereby making him the current beneficiary
with his following account details: MR JOHN WHEELER, AC/NUMBER: 6503809428. ROUTING/122006743, B/NAME:CITI BANK, ADDRESS:NEW YORK,USA, we shall proceed to issue all payments details to the said Mr. John Wheeler, if we do not hear from you within
the next two working days from today Thanks Mrs. Rose Moore (Assistance) Chairman Efcc Investigation Office Nigeria

Clearly if I was dead then I wouldn't be reading the email. Just to wind this particular scammer up, I replied with the one word "yes". That should confuse them.

Originating IP is 83.138.172.72 which seems to be a favourite with 419ers.

Spamcop.net phish

Here's a phish being sent to Spamcop webmail users - the approach has also been used for other webmail systems, so it isn't just Spamcop being targeted:

Subject: UPDATE YOUR SPAMCOP.NET ACCOUNT NOW
From: "spamcop.net webmail update" {info@yahoo.com}

Dear spamcop.net E-mail owners,

This message is from spamcop.net messaging center to all our email account
owners.
We are currently upgrading our data base and e-mail center due to an unusual
activities identified in our email system. We are de-activating all unused
spamcop.net accounts to create space for new accounts. To prevent your account
from being de-activated, you will have to verify your webmail account by
confirming your Webmail identity So that we will know that it's presently a
used account. We have been sending this notice to all our email account owners
and this is the last notice/verification exercise.

CONFIRM YOUR EMAIL IDENTITY BELOW
Last Name: ...........
Username: .......... .
Password : ...........

YOU ARE REQUIRED TO SEND THESE DETAILS TO THE UPDATE TEAM BY SIMPLY
REPLYING TO THIS EMAIL WITH THE REQUESTED DETAILS.

Warning!!! Account owners who fails to update his or her account on receiving
this notice might loose his or her account.

Warning Code:VX2G99AAJ.spamcop.net
Thank you.
"SPAMCOP.NET IT TEAM"

Replying to the email gives a reply-to address of account_up_grade@hotmail.com and the originating IP is 216.241.36.13.

MS09-001 prognosis. Install it now? Leave it for later?

It's patch Tuesday again, with just a single update from Microsoft: MS09-001.

If you are administering a corporate network, then the question that you probably ask yourself each week is "do I need to patch my servers"?

The prognosis for this one seems to be.. "maybe". Microsoft's own bulletin summary gives MS09-001 an exploitability index of "3 - Functioning exploit code unlikely". But the flaw itself is rated "Critical" and could lead to remote code execution.. so there is a low probability of a very serious exploit.

It turns out that it is much more likely that an attempted attack using MS09-001 would blue screen the target system - and that is more likely to be a worry, especially on delicate servers. The Microsoft Security blog has a good writeup and recommends the following priorities:

In terms of prioritizing the deployment of this update, we recommend updating SMB servers and Domain Controllers immediately since a system DoS would have a high impact. Other configurations should be assessed based on the role of the machine. For example, non-critical workstations could be considered lower priority assuming a system DoS is an acceptable risk. Systems with SMB blocked at the host firewall could also be updated more slowly.

Some further reading gives mixed signals: Sophos labels this as a medium threat, SC Magazine reports differing opinions, ZDnet also mentions the denial of service risk, ISC rates it as "Critical" but not "Patch now".

Given that it doesn't take long for the bad guys to implement an exploit for these flaws, and the recent well-publicised spread of the Downadup / Conficker worm then perhaps Microsoft's advice is very pertinent - start by protecting those systems that would suffer the most if they crashed, but there is perhaps not the urgency of the MS08-067 patch that came late last year.

"SLG-Logistics Company" scam

Not to be confused with the legitimate S L G Logistics Ltd based in the UK, "SLG-Logistics Company" is a wholly bogus outfit, probably offering a job in money laundering, parcel reshipping or another criminal enterprise.

Originating IP is 87.205.253.77 in Poland, "from" address is Singapore and doesn't match the name or address in the email. A pretty poor attempt overall.

Subject: Job opportunity
From: "Elma Ford" ncbk@pacific.net.sg

Hi, if you are interested in a well-paid part-time(2-3 hours a day) job in a large transportation & logistics company please contact me at e-mail:
pammorrison366@hotmail.com

With best regards,
Pamela Morrison,
Project manager,
SLG-Logistics Company.

Ongoing injection attacks against Chinese domains

This looks like a case of the Chinese hacking the Chinese again, with a very large number of domains being injected into legitimate sites. Two IPs to block are 121.14.152.154 and 59.34.197.15. For most companies outside of AsiaPac it may well be feasible to block or monitor all traffic to .cn domains.

The following domains are being used in the injection attacks (there are probably many others in a similar format):

• Aznylsf.cn
• Bznylsf.cn
• Ccswzx3.cn
• Ccswzx9.cn
• Cznylsf.cn
• Eqw002.cn
• Eqw003.cn
• Eqw004.cn
• Eqw006.cn
• Eqw008.cn
• Eqw009.cn
• Eznylsf.cn
• Falaliee.cn
• Falaliii.cn
• Falalioo.cn
• Falaliqq.cn
• Falalitt.cn
• Fznylsf.cn
• Gznylsf.cn
• Hhj2.cn
• Hhj3.cn
• Hryspac.cn
• Hryspah.cn
• Hryspan.cn
• Hryspao.cn
• Hryspap.cn
• Hryspaq.cn
• Hryspav.cn
• Hznylsf.cn
• Iznylsf.cn
• Jym562.cn
• Jzll-1.cn
• Jzll-2.cn
• Jzll-4.cn
• Jzll-9.cn
• Jznylsf.cn
• Kznylsf.cn
• Rxgsslla.cn
• Rxgsslld.cn
• Rxgsslll.cn
• Rxgssllt.cn
• Sllanmb.cn
• Sllbnmb.cn
• Slldnmb.cn
• Sllinmb.cn
• Sznylsf.cn
• Tznylsf.cn
• Vvk2.cn
• Wrmfwa.cn
• Wrmfwb.cn
• Wrmfwc.cn
• Wrmfwd.cn
• Wrmfwe.cn
• Wrmfwf.cn
• Wrmfwg.cn
• Wrmfwi.cn
• Wrmfwj.cn
• Wrmfwl.cn
• Wrmfwn.cn
• Wrmfwo.cn
• Wrmfwp.cn
• Wrmfwq.cn
• Wrmfwt.cn
• Wrmfwu.cn
• Wrmfwz.cn
• Wxjyb.cn
• Wznylsf.cn
• Xznylsf.cn
• Yznylsf.cn
• Zdq004.cn
• Zdq005.cn
• Zdq009.cn
• Zdq010.cn
• Zgcgsslle.cn
• Zgcgssllf.cn
• Zghncsa.cn
• Zghncsi.cn
• Zghncsj.cn
• Zghncsl.cn
• Zghncsm.cn
• Zghncsp.cn
• Zghncsr.cn
• Zghncst.cn
• Zgynkmb.cn
• Zgynkmd.cn
• Zgynkmf.cn
• Zgynkmg.cn
• Zgynkmk.cn
• Zgynkms.cn
• Zznylsf.cn