April 2009 Archives

It seems an endless wave of chain letter messages are starting to annoy people.

You'd think it would be pretty easy for Microsoft to block communications with "900" in them, but apparently not...

If you use Facebook, Myspace or any other Social Networking site you'll no doubt be familiar with messages like this and this. typically, they all involve sending them to an endless stream of participants, lest you suffer bad luck in the form of being hacked, losing your job, dying horribly or being stalked by vengeful ghosts for the rest of eternity.

Of course, it's all nonsense.

Well, illustrating that you're not safe from these kind of chain letters regardless of which digital domain you happen to use, here we have multiple instances of chain letters making their way to the XBox Live gaming network.

Over the past few days, large amounts of people are reporting being sent messages from both friends and complete strangers over the XBox Live messaging system that contains nothing other than this:

There's a site doing the rounds that promises "two years free" for a popular Counter Strike Mod:


Click to Enlarge

Of course, they want you to enter your Steam login details to access the game.

the link to avoid is

conterstrike15.fr.gd

There's been a rash of spam zinging around on Twitter, all of which is directing users to

SmartEcard.com

You can see more about that here, on the Sophos blog. The spammer tactics seem to be changing a little bit, perhaps so they can avoid detection for a little while longer. We're starting to see profiles that don't send out spam links via messages, but instead place the spam URLs in the profile description instead.

Here's a sample, you'll probably spot the rather odd pattern in the URLs follow:



twishmake.com
twiles.com
twantastic.com

Um, yeah. A little bizarre, I'm sure you'll agree. All of the above domains look identical to the SmartECard domain, there's probably more out there too:


Click to Enlarge

As with warnings of the original domain, if you've entered any login details at the above sites, go and change them immediately just to be on the safe side. Interestingly, all the profiles I've seen related to this scam are blank placeholders with no photo or information added to the fake profiles. However, there IS one where they've made a basic attempt to look like a real person:


Click to Enlarge

Don't be fooled - the above profile is as fake as the rest of them. While you're probably sick to death of being told to watch what you click on Twitter right now, it's about the best advice anyone can give.

It seems someone took a dislike to the kid recently revealed to be the source of multiple woes on Twitter.

A hacking group have taken him to the cleaners and then some. More here, and also here.

Here's an enterprising attempt at making some cash from utterly useless hacking programs that don't work.

First, they've created a Youtube account and (naturally enough) stuffed it full of impressive looking videos. Hack this, hack that, hack everything. How could you possibly refuse?


Click to Enlarge

Visit the website offering the programs, and things deviate a little from the usual "download infected file from Rapidshare / destroy own PC through greed" template I've come to expect.

Hit one of the download links such as the one below...

The below site:

itunes-multiplier.webs.com

should be avoided, as it's nothing more than a cheap con trick. The gag works like this - you go out and buy an iTunes card (which use codes that are redeemed inside iTunes to credit your account).

Then you see the above website promising it can double your points and start to feel a little greedy. Here is the "multiplier":

Asobi Seksu are one of my favourite bands of recent years, and while trying to work out where to buy an acoustic album they released not so long ago, I happened to come across a website called

music-megaupload.com

They're clearly riding on the back of the name of the legit file download site Megaupload. More importantly, they claim to be offering up a full version of one of their albums:

Generally, download sites do a good job of keeping potentially undesirable programs off their network. You might see the oddly titled "family keylogger" program and wonder about the ethics of such a utility, but leaving those rather dubious grey areas aside, mostly things take care of themselves.

However, while browsing the cnet.download.com site today, I happened to find something rather peculiar in their "Network Monitoring Tools". Namely, this:


Click to Enlarge

As soon as I saw the creator description of the program, I knew something wasn't quite right:

"Apheve is a great piece of software that has the ability to disguise itself as multiple IM programs including MSN, Skype, and BT Yahoo.This is perfect if a visitor is coming round who wants to access their IM account."

Wait, it "disguises" itself as multiple IM programs? And its name sounds like a bizarre slang version of the word "thieve" (A Pheve)?

Oh dear.

As you might expect, the program is available to download on numerous sites, including CNet Asia and ZDNet UK. Up for grabs since May 2008, the number of downloads is somewhat alarming:

18,214 download.cnet.com

9186 CNET Asia

455 ZDNET.co.uk

Not including other sites related to the above URLs, that means there's a grand total of at least 27,855 people (possibly) running round trying to steal your IM logins. (Check out the comments for more thoughts on what all those people may....or may not....be using the program for).

Did I say steal? Yes, I did. Presenting.... "Apheve":

Quite simply, you select the IM client of your choice - MSN Messenger, Yahoo IM or Skype - and hit the "Start!" button. Then you retreat to a safe distance and let your victim use the PC. As we've seen before, these kinds of programs work great for scammers in net cafes, libraries and schools / universities.

The victim will see one of these:


Click to Enlarge


Click to Enlarge

Of course, both of those IM boxes are entirely fake. Should you enter your login details, you'll be shown an error message and wander away from the computer feeling vaguely annoyed. Meanwhile, the attacker jumps onto the same computer and clicks on the apparently harmless looking fake icon in the Taskbar - in this case, a picture of a DVD / CD:



....and is presented with your login information, courtesy of a nifty popup box:


Click to Enlarge

Is it just me, or does that go a little beyond the scope of "Monitoring Software"?

The program has absolutely no reason to exist other than harvesting login credentials.

Even the choice of targets seems designed to cause as much trouble as possible - Skype accounts will probably have unused call credit stored against them, Windows Live accounts may well be linked to EMail as well as IM, potentially giving access to yet more personal information, logins etc.

Any claim by the creator that this is intended for "network security" is fairly blown out of the water when we check out his Youtube channel, only to find...


Click to Enlarge

...he's promoting it with the title "How to hack Msn, Skype or Yahoo with Apheve 1.1", with "Apheve pro - The ultimate hacking tool" in the description.


The only good thing here is that due to the program being around for a while, the fake versions of Skype, Windows Live Messenger etc look rather outdated and not very much like the real, current versions. The DVD / CD icon in the corner could also be a giveaway, though of course you can change that if you really want to.

We've EMailed the Downloads team, and will post again when we hear back from them.

Given the rather single-minded purpose of this application, I'm a little surprised it managed to squeeze through the cracks. The above download sites may well be "Tested Spyware Free", but they're currently not "Tested Horrible IM Stealing Piece of Junk Free".

Hopefully that might change shortly...

I've written about Freezers before - in short, programs designed to repeatedly spam the login for various sites & services with the victims EMail address and randomly generated passwords, until the account is locked out.

These Freezers take many forms, and have numerous features including built in browsers, progress bars and the ability to endlessly spam the target account until the PC melts or the account is permabanned, whichever comes first.

Well, here's another one, and it looks considerably better than the first (and that was no slouch in the looks department to begin with). As you can see, this one targets both Messenger Live and Facebook (alternating between the two with a nicely done set of tabs).


Click to Enlarge

The "Freeze" and "Skip Freezing" buttons are very chunky (it's all very 2.0, isn't it) and there are options for "help", "support" and an "about" panel too. Although the Windows Live Freezer didn't appear to function correctly, the Facebook Freezer caused the same problems as the program I wrote about a few weeks ago. Fire it up, walk away, leave it running for a few hours and when you return, the account will have been disabled - leaving the account owner with the prospect of trying to reactivate it, or skip the hassle and start from scratch.


Click to Enlarge

As before, the best (and only) advice you can really give where these tools are concerned is to avoid handing out your EMail address used for various social networking sites to strangers. If the site you use insists on showing your address to visitors, look for the option to hide it.

My good pals at the Secure Science Corporation have recently been taking a long, hard look at Skype.

Good thing too, because this is what they came up with.

As a side note, you should definitely consider subscribing to their blog which makes a welcome return.

There's a site currently online that was apparently hacked not so long ago:

Awful title gag aside, it seems someone is having a little fun in MSN Messenger land.

They've gone out and phished a number of accounts, then added all the people on their contact lists into one single file available to download.

Yet another cookie cutter movie site that gives you little or nothing in return for installing Adware? Yes please!

Much as I'd love to show you the part where it all goes horribly wrong, let's set the scene.

First, you need to throw together a website about an upcoming movie. How about.....



dragonballevolution.info

Yeah, that'll do it.

Obviously, you need to put the site up for sale as quick as you can.


Click to Enlarge

Let's make it perfectly obvious that the only reason the site exists is to trade off Adware in exchange for ripped movies:

"It also does have a streaming site (watch.dragonballevolution.info) which have the full movie streaming online (movie hosted on others video sharing host).

Most of the site income came from its streaming site which I have installed zango. It does pretty well with zango( look at the pageview per install ration on attachment).

Dragonball evolution the movie will be released in the United States this April 10, 2009. So make this the deal fast before someone else does!"

...but let's throw up a ludicrous "disclaimer" anyway:

Of course, you need to install Zango to watch the film:

Click to Enlarge

Setting aside the age problem - you need to be 18+ to install Zango, and how many people over 18 are seriously going to go looking for the Dragonball Evolution movie? - there's also the problem of it going horribly wrong.

Did I say horribly wrong?

...whoops, I guess I did.

Enjoy your "film", kids.

The racing season might well be underway, but it's a good idea to be careful where your logins are concerned.

The following domain:

tema-ferrari.tk


Click to Enlarge

Is trying to entice users of popular Social networking site Orkut to login to their accounts - or, to be mre accurate, is trying to entice fans of Ferrari cars to login to their Orkut accounts. You can't really miss the huge Ferrari logo in the middle - the earliest google cache of the site is a few days before the first race in Melbourne, around the 24rd of March. Odd coincidence, that.

In case you're wondering, the text (in Portuguese) roughly translates as follows:

"Connect with friends and family using scraps and instant messaging
Meet new people through friends of friends and communities
Share your videos, pictures, and passions all in one place"

I'm going to go out on a limb here and guess the phisher won't even get a speeding ticket...

Paul Clark, Labour MP for Gillingham and Rainham, and Under-Secretary of State at the Department of Transport has apparently upset somebody, as this shot of his

Labourisworking.com

website would suggest. No idea who "Red Virus" is, but he / she left an EMail address so maybe they're available for comment(!) Interestingly, they claim their message is "From Egypt", yet the EMail address given is obviously Chinese.

Ooh, political...

Click to Enlarge

While looking into a set of hacking tools recently, I came across a set of screenshots pasted into the creator's image gallery. They're a series of pictures detailing the various steps involved in the process of creating a fake MSN Live application.

We've removed quite a few duplicates (and blanked one or two things out) but if you want to experience the rather surreal sensation of watching someone create a data theft tool, click here to view the gallery.

It's yet another "login here to send all your contacts endless amounts of spam" website. This one is called

meetyourims.com

...and looks like all the other ones.


Click to Enlarge

If you (or a family member) play Runescape, you might want to keep an eye out for this one.

A number of people are telling players on their friends list that the creators of the game (Jagex) are running a week long competition, where the selected participants change their password to

jagexevent

in order to get their hands on lots of free goodies.

If the person told about this event is suspicious, then the attacker will send them the following doctored screenshot as "proof", made to look like an official post by a Jagex Community Manager:


Click to Enlarge

There are emails in circulation directing end-users to the following web site:

moxieusa.com/includes/PEAR/Thanks.htm

It's a Paypal phish with an added "bonus" - when you visit the page from the mail, you're presented with the following message:

"You Have Successfully Confirmed your account information.

The New Anti Fraud System has been successfully added to your PayPal account."

Entirely false, of course - nothing has been added. There's also a short ramble about additional security features:


Click to Enlarge

Click the continue button, and you're taken to the inevitable phish page.

Avoid...

Remember those sites that want you to install Zango in return for ripped movies?

Sure you do.

Well, I've just seen the inevitable happen - it was only a matter of time before Zango affiliates latched onto Twitter as a means of promoting their installers. Here's a sample shot of a Twitter profile that's been firing out Zango related links since March 17th:


Click to Enlarge