According to CNET, criminals are using fake LinkedIn invite email to scam people into clicking links that lead to the Zeus botnet. The scam targets Windows users only and may be the first time the Zeus botnet has targeted LinkedIn users.

According to CNET, “Researchers saw tens of billions of messages related to the attack yesterday, Henry Stern, a senior security researcher at Cisco Systems, told CNET. “There have been some bursts today, but nothing like yesterday,” he said. “The botnet responsible for this is still in operation and it’s just doing something else right now.”

Fake LinkedIn email links to the Zeus botnet.

No related posts.

WTF. You’d think after the humiliation and financial risks caused by social sharing site Blippy.com that we reported earlier this week, they would have either fixed it right, or shut the service down until they were certain everything was secure. But as reported on Blippy’s own blog, another four credit card numbers showed up in Google search results yesterday.

Possibly more disturbing is that Blippy is claiming only four individuals’ accounts showed up altogether, whereas other reputable sites like Mashable are reporting the number is closer to 200.

No related posts.

Hundreds of credit cards exposed.

UPDATE: Blippy responds in their blog.

As reported by Mashable today Blippy, the online “service” that allows you to see what others have purchased and share your purchases, had an embarrassing and potentially dangerous security issue today. According to Mashable:

“Tipster Trey Copeland wrote to us with a link to results for the search: site:blippy.com +”from card”. That search returns results showing detailed purchase information for transactions. Each result highlights that there was a “debit card transaction” or “card transaction,” the amount spent, the specific location (address included) and the full card number.”

Mashable included a screenshot of Google’s search results, which show a number of compromised credit card numbers exposed. Don’t bother trying that search query: you’ll get an error message from Google instead.

The social media team I run at C-E has long speculated that this would happen. We couldn’t imagine why on earth anyone would share their purchases and trust all their credit card numbers to a social site that doesn’t sell anything.

TIP: As we warned a few weeks ago, there’s no reason to join Blippy. You do not ever need to share your purchases. It makes you a target. If you are a member, take immediate action to remove your financial information.

A generous nod to Gary Olson for the story.

No related posts.

Please and thank you?  Microsoft has had some serious security issues over the years but recently there have been several problems that are so severe that they’ve had to release a fix outside of their normal schedule.  This is a pretty radical step since this causes companies (not to mention the rest of us) to spend time and resources that we hadn’t planned for.  Today, Microsoft released another out of cycle patch for Internet Explorer.  There have been a growing number of attacks that are exploiting this vulnerability.  I would recommend that you update with this patch as soon as possible so you can get back to Dave’s great series on scam spotting

No related posts.

Esteemed military bank, USAA was recently targeted by an email phishing scam. Thankfully, USAA has an incredible security team, who discovered it and warned their members before anything happened. Details of the email can be found on their site.

No related posts.

Before we get started, are you running a Windows operating system with anti-virus software that’s up to date?  No?  Please stop reading this and go get that under control.  If you need AV software, see Dave’s post on FREE AV.  We’ll wait for you

We’ve talked about the current malware trends and I’m sure that’s not a surprise to anyone but I saw a couple reports recently that did surprise me.  Malware is being found in some very odd places.

Symantec researchers discovered malware lurking in software that monitors the charging status on a USB battery charger

Panda labs discovered malware on a new cell phone distributed by Vodaphone. They discovered variants of the mariposa bot and conficker…

It’s not clear how this happened but it’s obvious that the affect of malware is far reaching and can leak into our lives in unlikely ways.  It’s not the first time malware has been discovered in pre-packaged devices.  In 2008 there were reports of malware showing up in digital picture frames.

Message: Be cautious! Make sure you have anti-virus software running and keep it up to date.

Have any interesting virus stories? We want to hear about it.

No related posts.

Looks as though a third party app was hit for a phishing scam that has allowed the perps to appear to take over hundreds of Twitter accounts. According to Mashable, since all of the spammed tweets mention coming from the API, the accounts themselves are probably still OK. It’s the app they’ve allowed access to that’s been compromised.

TIP: Always think twice before giving an app access to your account. Do your friends use it? Have they had problems? When in doubt, Google the app. See if it’s legitimate before you click allow.

No related posts.

Spammers harvesting emails from Twitter in real time!

As if you didn’t have enough things to worry your pretty heads about, spammers have figured out a simple email harvesting trick using Twitter. This is too easy. Straightforward queries for tweets containing, “gmail.com”, “email me at”, “contact me at” etc. reveal thousands of tweets that can be quickly scraped and harvested with a script.

TIP: Never reveal your email openly on Twitter. DM only!

Attackers, like marketers, are targeting brands better

I work in an ad agency, so I can tell you firsthand, marketers are getting damn good at targeting niche audiences and individuals. Unfortunately, so are online criminals. According to Cyveillance’s 2009 Cyber Intelligence report [PDF]:

“Cyveillance determined that during the second half of 2009, 399 brands were first-time targets of phishing attacks, nearly double the amount of first-time targets than in the first half of the year. Averaging more than 36,000 confirmed, unique attacks per month in the same period of 2009, phishing attacks continue to succeed, the report says.”

Points for style

While the Koobface gang (responsible for the Koobface botnet and several online pranks) may be somewhat nasty, you have to give them points for style and humor.

No related posts.

Wow, busy week for feds and hackers alike!

Mariposa Botnet netted and doused in formaldehyde

UPDATE: New details have emerged about the size and complexity of the Mariposa botnet. Apparently Mariposa dwarfed the attacks from Estonia and Georgia, and contained details on over 800,000 people.

Investigators in Spain shut down the Mariposa botnet, finding out the perps weren’t the sophisticated geniuses they expected.

“They’re not like these people from the Russian mafia or Eastern European mafia who like to have sports cars and good watches and good suits — the most frightening thing is they are normal people who are earning a lot of money with cybercrime,” said Cesar Lorenza, a captain with Spain’s Guardia Civil.

Blippy = TMI

For the life of me, I cannot figure out why anyone would use this service. Blippy allows you to post your purchases—in real time—to credit cards, ecommerce sites, etc., publicly and let your friends like or comment on your purchases. Seriously. Dancho Danchev’s post, Does Blippy really pose a security risk? is a must-read wake-up call for anyone using or planning to use this service. Hint: Don’t. Even Web Celebs like Leo LaPorte post rather sizable purchases on Blippy, making question whether or not he realizes what a target he is making himself into.

Botnets are ruining your inbox

Good lord. As if Mariposa wasn’t causing enough mischief, two other botnets, Grum and Rustock are accounting for nearly half of all spam, most of it Canadian pharma scams.

iPhones users targeted for scams

This scam is pretty ingenious in an evil way. According to the MarkMonitor blog,

“This recent attack also stands out because it utilizes some advanced technologies and suggests possible directions of future cybercriminal activity. First, the attack uses server-side logic that hides the phishing site unless it is accessed through the browser produced by the smartphone company. Second, the attack uses additional protective technology in the form of a fast-flux network, which hides the phishing site behind a dynamic network of ever-changing proxies. These two smart technologies demonstrate how cybercriminals continue to focus their efforts on making their attacks targeted, stealthy, and resilient.”

Choosy hackers choose PDF

According to a recent report of more than a trillion Web requests, PDFs were responsible for a staggering 80% of all exploits targeted at Adobe Reader vulnerabilities. The report (ironically itself a PDF) mentions that Flash-based attacks actually dipped from 40% to 18% in Q4 2009 while malicious PDFs rose from 56% to 80%.

More stories tomorrow. Lots going on! What do you think of Blippy? Too much info? Let us know!

No related posts.

Looks like the hackers responsible for the recent attacks on Google and a few dozen other companies are the work of a small Asian hacker group, and possibly only one individual. There’s plenty of details at this article by the Wall Street Journal.

What’s your theory?

No related posts.