Beware of any Independence Day Links

The folks over at the Internet Storm Center have some great suggestions.

• Celebrate
• Watch Fireworks
• Enjoy the cook out food (This is my suggestion)

What not to do?

• Don't click on links in e-mails
• Don't surf to sites with Fourth of July, Independence Day or Fireworks as keywords.

The security company Websense is reporting that the subjects listed above are being seen in the subject lines of spam e-mails. They contain links that are supposed to be videos, however all it leads you to is malware that attacks your PC.

Click here to visit the folks over at ISC. They do great work.

Farrah and Michael Spam

With the news of Farrah Fawcett and Michael Jackson's deaths on the same day this week, the spam campaigns that have followed are leading people to getting their PC's compromised. The criminal attackers out there love to take advantage of current events to spread their malicious software. It's a social engineering trick that preys on people's curiousity to know as much as they can about the events.

Along with these spamming e-mail campaigns, you will also need to be VERY careful when going to web sites on the topic of these deaths. Malicious web sites have popped up and the bad guys are using black hat search engine optimazation (SEO) to raise their malicious site's Google ranking so that their sites will come up in the top 10 web sites when you do a Google search. Only go to trusted sites if you are wanting to read more information on these current events.

Stay safe and have a FABULOUS weekend.

Obama Has My E-mail Address!

OK, it really isn't the real President Obama. It is the work of social engineers who are trying to entice you into clicking on links that promise you money from the stimulus bill that was recently signed in to law. Here is my friendly reminder to NEVER click on unsolicited links or attachments. Don't be a fool.

Spammers are always trying to figure out ways to get people to click on there tricks. I actually have 3 identical e-mails from someone purporting to be the president and he has money for me.

Hope your week has started off good and I hear the warm weather is coming! Stay safe.

Adobe Reader and Acrobat Being Exploited

Thursday, the folks at Adobe announced that there was a vulnerability that is currently being exploited in all version 9 and earlier. The security group over at Shadowserver.org has been seeing targeted attacks that exploit this vulnerability that allows an attacker remote code execution. That sucks.

Brian Krebs from SecurityFix blog has a write up that you can read more details. Brian does a fabulous job keeping folks informed of computer security issues. Click here to read his post about the Adobe vulnerability. Adobe has a write up on their site too and you can click here to read that post.

As always you should never click on attachments or links in unsolicited e-mails. Stay safe and have a fabulous weekend.

Spammers Ready to use Stimulus as Bait

OK folks. I'm not going to bring politics into too much of my blog, but this stimulus bill absolutely sucks. Spending money we don't have. Well beware, spammers are already sending out spam for people to click here to get YOUR STIMULUS CHECK. OMG!!! Don't do it! But you know some will. If you are a reader of mine, just dump this just like you do the other spam that arrives in your e-mail inbox.

Hope all is well with everyone and all of you remember those you love on Valentine's Day. Rock Chalk Jayhawk. Hope we kick some Wildcat tail.

Examing A Spam E-mail

Some days you get e-mails that are obviously spam e-mails. Just the little things you look at and can tell right away that it is not real. Above you can see a copy of the e-mail. Right away you know that the fake UPS e-mails are still going around. Now someone in SPAMMERVILLE should tell them UPS stands for United Parcel Service. Not United Postal Service. LOL

Have a great Thursday tomorrow!

How to Avoid Fake AV

Have you been one of the many who have had the rogue anti-virus installed on your PC and wondered how you got it? Actions you have taken may have installed this nasty piece of malware. Here are a few of the ways you may have had the fake AV installed on your machine.

• Spammed email messages (ecards) that contain malicious links
• Instant messaging applications where links are sent as messages
• Private messages in social networking sites
• As codecs for videos hosted on social networking sites
• Downloaded by malware in a prior infection
• Mass SEO poisoning involving several compromised Web sites

What happens from that point may vary, but the bad guys goal is to trick the user through a variety of system modifications and scary warning messages that something is wrong with their PCs. These scare tactics include showing fake Windows popup balloons, modifying the PC’s wallpaper to an alarming message, and performing an unsolicited system scan that yields worrying scan results.

These attacks were starting to pop up in August, and they have continued here in September. This basically tells me the attacks are pretty successful. Beware of the social engineering that actually tricks you into installing this rogue AV badware from the criminal attackers.

Stay safe and have a great weekend.

Are You Getting Obama Spam Like Me?

Well I have this throw away e-mail address that I get a lot of "interesting" spam sent to me. I have been finding some rather unusual e-mail from Barrack, Michelle, and Joe too. When you look at the header information, it is being sent from the IP 70.42.50.186 which belongs to EHLO mta-inap4.bluestatedigital.com. It appears that the Obama campaign doesn't mind buying e-mail lists so they can spam to millions. The people who maintain these large e-mail lists are actively participating in not so nice ways of collecting these e-mail addresses.

I'm not an Obama fan. Not really that much of a McCain fan either. I do notice that I haven't got these types of e-mails from the RNC. And I find at the bottom of the e-mail, an unsubscribe link. I have always advised people to NEVER click on links in spam e-mails because you don't know what the person responsible will do with this information. Those with not so good intentions use the unsubscribe link to verify that they have a valid e-mail address and that address will be "verified" in a way that these people who market these list can sell for more.

Delete all spam e-mails that you get. Never, never, never click on any links or attachments from unsolicited e-mails.

Scammers/Spammers will use Hurricane Gustav

People in general here in this great country of ours, The United States of America, are very giving and want to help those in need. When ever we experience a natural disaster like Hurricane Gustav, there are those who prey on our willingness to help. Those without a conscience will be there to take advantage of events like these.

When these events happen, the Internet Storm Center reports on domains that are being registered. A couple of days ago, they started seeing domains being registered relating to Gustav. Here are a few of those listed in the Internet Storm Center's latest post. Click here for the full Diary entry from the ISC.

boredatgustavus.net
contributegustav.org
contributiongustav.org
donategustav.org
donationgustav.org
gustav-hurricane.info
gustav-hurricane.net
gustav-hurricane.org
gustav-hurricane.us
gustav-relief.org
gustavassistance.org
gustavattorney.com
gustavcharities.com
gustavcharity.com
gustavclaims.net
gustavcontribution.org
gustavdonation.com
gustavfound.com
gustavhelpers.org
gustavhurricanerelief.com
gustavhurricanerelief.info
gustavhurricanerelief.net
gustavhurricanerelief.org
gustavlawsuit.com
gustavlawyer.com
gustavlegalrelief.com
gustavlegalrelief.info
gustavlouisiana.org
gustavmissing.com
gustavneworleans.com
gustavneworleans.org
gustavpictures.com
gustavrecovery.org
gustavrelief.info
gustavrelieffund.com
gustavrelieffund.org
gustavreliefvolunteers.com
gustavresponse.com
hannahrelief.org
hannainsuranceclaim.com
hannalawyer.com
hannarelief.org
helpgustavvictims.com
helpgustavvictims.net
helpgustavvictims.org
hurricanegustav08.com
hurricanegustave.info
hurricanegustavphotos.com
hurricanegustavrelief.info
hurricanegustavrelief.net
hurricanegustavrelief.org
hurricanegustavrepair.com
hurricanegustavresponse.info
hurricanegustavvictims.info
hurricanegustavvictims.org
hurricanehelp.us
hurricanelinks.info
hurricanelinks.org
hurricanerelo.com
hurricanerelo2ms.com
hurricanerelocate.com
hurricaneresponder.com
hurricaneseasonflorida.com
hurricanetrack.org
hurricanevolunteers.info
hurricanewatchnet.org
hurricanework.com
isurvivedhanna.com
lahurricanerelief.org
myhurricanephotos.com
netexashurricaneresponse.info
officialhurricanegustav2008.info
survivedgustav.com
survivedgustav.net

Some people may be registering these sites to sell in the next few days. Others may start to add "Donate Here" buttons. You need to beware of this type of scammers.

All our thoughts are with those in the Gulf Coast area. Monday is when they are scheduled to make land fall. Many have left. We all hope that this is not a repeat of Katrina. Stay safe and we'll have to see in the next 24 hours what will happen.

People Really Do Click on Spam E-mails

One of my responsibilities is teaching Security Awareness Training. We sound like a broken record at times, but we always say NEVER click on links OR attachments in unsolicited e-mails. I never really thought too many people clicked on these types of e-mails.

Read this article from ZDNet and was shocked. Click here to read the blog entry from ZDNet. And NEVER click on any type of spam e-mail.

Georgia.zip Malicious Attachment

You see spam e-mails everyday. Sometimes something is slightly different. Saw the same attachment with the name of georgia.zip. It was password protected. You see if an attachment has a password, your anti-spam tools can't open it to examine it. I noticed that two different subject lines were used. One was "Journalist shot in Georgia" and the other one was kind of funny. "Brittney Spears confession: I am Anna Nicole Smith's baby's father". I submitted the file to VirusTotal.com and the AV engines didn't have good results. Only 5 of 36 AV engines detected the file as malicious. Today, I got another copy and submitted it and now 7 of 36 AV engines recognize it as malicious.

One copy of the spam was sent from an IP in Turkey. Not a place that would seem to be very friendly. So if you get this file, just trash the e-mail and don't open this file.

Stay safe and TGIF!!!