ilmeteo.it hacked

Popular Italian weather site ilmeteo.it appears to have been compromised this morning, with several legitimate .js files on the site altered to drive traffic towards a malicious hacked domain at karsons.co.uk.

The payload is unclear because at the moment the payload site itself is out of bandwidth. It could either be a malware payload or possibly a rogue ad network (which could also be used to spread malware).

According to Alexa statistics, itlmeteo.it is the 29th most popular site in Italy and the 1305th most popular worlwide.

This URLquery report shows the scripts with the injected code:

The injection attempts to run code at [donotclick]www.karsons.co.uk/qdrX3tDB.php?id=114433444 and it can be found in the site's .js files (for example [donotclick]http://www.ilmeteo.it/im10.js). Right at the moment the site has exceeded its bandwidth and is erroring out.

It's hard to say exactly what the payload is or how many users may have been impacted. I've seen a few of these attacks recently that look like they are linked to a rogue ad network, but I can't confirm it in this case.

Update: site appears to be clean as of 1133 CET according to URLquery.

Staples "Your order is awaiting verification!" spam

This fake Staples spam has a malicious attachment:

Date:      Wed, 15 Jan 2014 15:40:44 +0800 [02:40:44 EST]
From:      Staples Advantage Orders [Order@staplesadvantage.com]
Subject:      Your order is awaiting verification!
                                           
Order Status: Awaiting verification
Order #: 5079728
Your order has been submitted and is awaiting verification from you.
Order #:     5079728
Order Date and Eastern Time:     2/19/2013 12:28 PM
Order Total:     $152.46
   
This is potentially due to missing or invalid order or payment information. If you receive this status message, please call Customer Service immediately for assistance.
For Staples Advantage Support, call 1-800-633-6080 or email Support@staplesadvantage.com.

Attached is a ZIP file Order_5079728.zip which in turn contains a malicious executable  Order_{_partorderb}.exe which has a VirusTotal detection rate of 23/47.  The Malwr report is pretty inconclusive, so presumably the binary is hardened against automated analysis tools.

PG&E "Gas and Electric Usage Statement" spam

This fake spam from the Pacific Gas & Electric company is presumably meant to have a malicious payload, but all I get is a server error..

From:     PG&E [do_not_reply@sourcefort.com]
Reply-To: PG&E [do_not_reply@sourcefort.com]
Date:     14 January 2014 22:37
Subject:     Gas and Electric Usage Statement

PG & E ENERGY STATEMENT             Account No: 718198305-5
                                                Statement Date: 01/10/2014
                                                Due Date: 02/01/2014
Your Account Summary

Amount Due on Previous Statement           $344.70
Payment(s) Recieved Since Last Statement   0.0 

Previous Unpaid Balance                    $344.70

Current Electric Charges                   $165.80
Current Gas Charges                        49.20   

Total Amount Due BY 02/01/2014 $559.7

To view your most recent statement, please click here You must log-in to your account or register for an online account to view your statement.
 
Total Amount Due BY 02/01/2014 $559.7

To give PG&E full credit, they have a link on their homepage about it and a full warning here. These scam emails seem to have been doing the rounds for quite a few days now.

"Uncensored download" spam leads to adware

I've been plagued with these over the past few days, emails coming in with the following subjects:

Underground XXX files
Free porno torrents
Uncensored download

The body text contains just a link to [donotclick]goinst.com/download/getfile/1205000/0/?q=Uncensored%20download

In turn this downloads a file Uncensored download__3516_i263089565_il6090765.exe and of course that's about as trustworthy as a van with "FREE CANDY" scrawled on the side. In blood.

A quick look at the EXE in VirusTotal indicates that it's some sort of Adware, probably pay-per-install. An examination of the binary shows a digital signature for Shetef Solutions & Consulting (1998) Ltd who are probably not behind the spam run, but are probably inadvertently paying the spammers for installations.

A Malwr analysis of the file can be found here.

Avoid.

HSBC "Payment Advice" spam / Payment Advice.exe

This fake HSBC spam comes with a malicious attachment:

Date:      Tue, 14 Jan 2014 11:57:29 -0300 [09:57:29 EST]
From:      HSBC Advising Service [advising.service.738805677.728003.693090157@mail.hsbcnet.hsbc.com]
Subject:      Payment Advice - Advice Ref:[G72282154558] / Priority payment / Customer Ref:[63 434S632U9I]


Sir/Madam

The attached payment advice is issued at the request of our customer. The advice is for your reference only.

Yours faithfully

Global Payments and Cash Management

HSBC

***************************************************************************

This is an auto-generated email, please DO NOT REPLY. Any replies to this email will be disregarded.

***************************************************************************

This e-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return e-mail.

***************************************************************************

"SAVE PAPER - THINK BEFORE YOU PRINT!"

The is an attachment Payment Advice [G72282154558].zip which contains an executable Payment Advice.exe with a VirusTotal detection rate of 12/48. Automated analysis by Comodo CAMAS shows an attempted connection to thebostonshaker.com on 206.190.147.139 (Salt Lake City Hosting, US). It is the only site on this IP address, blocking either temporarily may give some protection.

"Department of Treasury Notice of Outstanding Obligation" spam

This US Treasury spam (but apparently sent from salesforce.com) has a malicious attachment:

Date:      Mon, 13 Jan 2014 18:54:16 +0700 [06:54:16 EST]
From:      "support@salesforce.com" [support@salesforce.com]
Subject:      Department of Treasury Notice of Outstanding Obligation - Case H6SYVMK704BX4AL

Important  please review and sign the attached document!

We have received notification from the Department of the Treasury,
Financial Management Service (FMS) that you have an outstanding
obligation with the Federal Government that requires your immediate
attention.

In order to ensure this condition does not affect any planned
contract or grant activity, please review and sign the attached document and if
you are unable to understand the attached document please call FMS at 1-800-304-3107
to address this issue.  Please make sure the person making the telephone call has the
Taxpayer Identification Number available AND has the authority/knowledge
to discuss the debt for the contractor/grantee.

Questions should be directed to the Federal Service Desk at:

http://www.bpn.gov/ccr/Help.aspx
Phone : 1-866-606-5048
Int. Phone 1-344-206-5406 for international calls
For DSN, dial 809-463-3029. Wait for a dial tone, and then dial 866-606-5472. 

Attached is a file FMS-Case-H6SYVMK704BX4AL.zip (VirusTotal detection rate 7/47) which in turn contains a malicious executable FMS-Case-{_Case_DIG}.exe (detection rate also 7/47). The Malwr analysis shows an attempted connection to anggun.my.id on 38.99.253.234 (Cogent, US). This seems to be the only domain on that server, blocking either may be prudent.

Marketing1.net spam

These spammers sent their sales pitch to a random info@ email address on an unused domain I use. And what are they selling? Email marketing lists.. well, if they used their own mailing list for this then it is obviously crap.

From:     Audrey Martin [info@globalcrm-eu.net]
Reply-To:     info@globalcrm-eu.net
Date:     10 January 2014 07:32
Subject:     Happy New Year! - Followup to our last offer

Dear Madam, Dear Sir

Everyone in our team would like you wish you a happy and successful new year 2014! To help make this year even better for you, we have decided to give 20'000 free business contacts to the first 200 people visiting our website this morning! You don't have to buy anything. You can just visit our website and download the free business contacts!

Over the last year, we have helped hundreds of businesses like yours find new customers and achieve growth by using our highly targeted business database on CD. Our database, available for download from our website, is the only one on the market which includes targeted info on over 5 million Businesses in the UK.

Last December, we decided to take our Business Database CD off the market after a last sale because the cost to update the database regularly had become too high and we want to concentrate on the development of new products.

A lot of businesses since then, requested us to renew our last sale after its discontinuation. Not only have we decided to renew our last offer for a period of 8 hours (until 4PM this afternoon) before finally taking the database off the market, but we have decided to give to the first 200 people visiting our website this morning 20'000 free business contacts.

Here is a quick reminder of what is offered in our Business Database CD:

- 5 million Businesses in the UK selectable by Industry/Location/Company Size/Premises type/Job title
- Over 300,000 Businesses with email addresses
- 4 million named Decision Makers available by job function
- Unlimited export to .CSV or Excel
- Updated in October

We have decided to give you a last opportunity to get your hands on the database, as we are convinced it can dramatically help your business. We are offering to the first 100 customers placing their order today before 4PM, an unrestricted version of the database with unlimited export capabilities (as opposed to the standard version which has a limit of 50'000 exports) - and this, for a substantially reduced price of £199 instead of £498!  This will end at 4PM today, so don't miss it because some your competitors won't!


20'000 Free Business Contacts

We are so confident that the extensive data can help your business that we are giving away a free sample with 20'000 Business contacts to the first 200 people visiting our website this morning. This allows you to evaluate the quality of the data before completing your purchase. Visit our website to download the free sample and jumpstart your business!

To download the free sample, to get more infos or place your order, click here to visit our website

To your success in 2014 and beyond,

Audrey Martin
Marketing Solutions

Unsubscribe: Click here if you do not want to receive any further emails from us

This is a service from Marketing Solutions

Powered by Hairyspire

The link in the email goes to a domain globalcrm-eu.net on 217.147.82.106 (Iomart, UK) which is also the server sending the spam. The domain is registered with incomplete WHOIS details to mak the sender's identity. From there the victim is sent to m1databases-uk.net on a shared server at 66.96.161.162 (Endurance International Group, US) also with incomplete WHOIS records until they end up on the main site at marketing1.net hosted at 89.187.86.69 (Coreix, UK). The WHOIS details for this last one are inconclusive:

Domain Name: MARKETING1.NET
Registry Domain ID: 91418733_DOMAIN_NET-VRSN
Creation Date: 2002-10-21 18:13:12Z
Registrar Registration Expiration Date: 2014-10-21 18:13:12Z
Registrar: ENOM, INC.
Registrar Abuse Contact Email: abuse@enom.com
Registrar Abuse Contact Phone: +1.4252744500
Domain Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: MARKETING SOLUTIONS
Registrant Organization: -
Registrant Street: 152 CITY ROAD
Registrant City: LONDON
Registrant State/Province: LONDON
Registrant Postal Code: EC1V 2NX
Registrant Country: GB
Registrant Phone: +1.20814497
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext:
Registrant Email: MAIL@MARKETING1.NET
Registry Admin ID: 
Admin Name: MARKETING SOLUTIONS
Admin Organization: -
Admin Street: 152 CITY ROAD
Admin City: LONDON
Admin State/Province: LONDON
Admin Postal Code: EC1V 2NX
Admin Country: GB
Admin Phone: +1.2081449762
Admin Phone Ext: 
Admin Fax: 
Admin Fax Ext:
Admin Email: MAIL@MARKETING1.NET
Registry Tech ID: 
Tech Name: MARKETING SOLUTIONS
Tech Organization: -
Tech Street: 152 CITY ROAD
Tech City: LONDON
Tech State/Province: LONDON
Tech Postal Code: EC1V 2NX
Tech Country: GB
Tech Phone: +1.2081449762
Tech Phone Ext: 
Tech Fax: 
Tech Fax Ext: 
Tech Email: MAIL@MARKETING1.NET
Name Server: NS10.DNSMADEEASY.COM
Name Server: NS11.DNSMADEEASY.COM
Name Server: NS12.DNSMADEEASY.COM
Name Server: NS13.DNSMADEEASY.COM
DNSSEC: unSigned
Last update of WHOIS database: 2013-10-22 09:22:28Z

This address is an accommodation address that serves hundreds of different companies. I cannot find a trace of a company called Marketing1 or Marketing Solutions registered to this address at Companies House.

The marketing1.net website looks slick enough..

But again it give no real indication as to who owns or runs the company anywhere. The only contact details are as follows:

Marketing1
152 City Road
UK - London EC1V 2NX

Tel: +44 208 144 9762
email: contact@marketing1.net

The 89.187.86.69 server also contains a number of other related domains with fake or incomplete WHOIS details:
m1data-eu.net
m1data-global.net
m1databases-eu.net
m1databases.net
m1de-tracking.net
m1deglobal-tracking.net
m1sitetracking-eur.net
marketing1-app.net
marketing1-eu.net
marketing1-eur.net
marketing1-europe.net
marketing1-group.net
marketing1-soft.net
marketing1.net
marketing1base.net
marketing1data.net
marketing1europe.net
marketing1global.net
marketing1globalsite.net
marketing1group-europe.net
marketing1group.net
marketing1site-eu.net
marketing1soft.net
marketing1solutions.net
top-managers.com

You should never buy anything promoted through spam, and it is especially important not to buy email lists in this way. You (as the sender) will end up with the legal liability for anything that you do, but Marketing1 masks whoever is the true owner.. so good luck with ever finding that out (I suspect they are not based in the UK at all). Avoid.

UPDATE 2014-05-09: these grubby spammers are at it again, using the domain m1-datacrmeu.net to mask their true domain. I took a look at these "20'000" free records, and the ones I checked were laughably out-of-date. No wonder the database is so cheap!

More "Voice Message from Unknown" spam

Another bunch of fake "voice message" spams with a malicious payload are doing the rounds, for example:

Subject: Voice Message from Unknown (996-743-6568)
Subject: Voice Message from Unknown (433-358-8977)
Subject: Voice Message from Unknown (357-973-7738)

Body:
- - -Original Message- - -

From: 996-743-6568

Sent: Wed, 8 Jan 2014 12:06:38 +0000

To: [redacted]

Subject: Important Message to All Employees  

Attached is a file VoiceMessage.zip which in turn contains VoiceMessage.exe which has a VirusTotal detection rate of 11/47. Automated analysis tools [1] [2] show an attempted connection to casbir.com.au on 67.22.142.68 (Cologlobal, Canada). This appears to be the only server on this IP address, so blocking or monitoring it for the time being may be prudent.

"Unauthorized Activity on your Amazon account" phish

The New Year seems to have brought a new wave of phishing emails, here's a new one looking for Amazon credentials.

Date:      Mon, 6 Jan 2014 08:19:39 -0000 [03:19:39 EST]
From:      Amazon [noreply@trysensa.com]

Case- 91289-90990

Unauthorized Activity on your Amazon account.

We recently confirmed that you had unauthorized activity on your Amazon account.

Please be assured that because your card includes "zero-liability fraud protection" , you are not responsible for unauthorized use of your card.

Unfortunately, we have not confirmed your complete information , please follow the instructions below.

Click the link below to validate your account information using our secure server:

Click Here To Active Your Amazon Account

For your protection, you must verify this activity before you can continue using your account

Thank You.
Amazon LTD Security System

The link in the email goes to [donotclick]immedicenter.com/immedicenter/images/yootheme/menu/Amazon/index.php and comes up with a convincing-looking Amazon login page:

The next page phishes for even more information:

And now it goes after your credit card information:

And having stolen all your information, you get a nice message to say thank-you:

The hapless victim then gets sent to the genuine Amazon.com website.

In most email clients, floating over the link would clearly demonstrate that this was not the legitimate amazon.com website, and certainly once visited (not something I would recommend) then the address bar at the top of the browser would clearly indicate it is not amazon.com.

If you have accidentally clicked through this email and provided all the details then you should contact your bank immediately and also change your Amazon password plus any other places that you use that same username/password combination.