Results tagged “Hackers” from SpywareGuide Greynets Blog

Hot on the heels of this writeup comes another example of a particular technique favoured by 419 Scammers at the moment. It follows a familiar pattern - someone has their EMail account hijacked, and then all of their contacts will find this in their Inbox shortly afterwards:

Hello,
I am sorry I didn't inform you about my traveling to Africa for a program called Empowering Youth to Fight Racism,HIV/AIDS,and Lack of Education,the program is taking place in three major countries in Africa which are Ghana,Togoland and Nigeria,I am presently in Lagos Nigeria.
 
I misplaced my wallet on my way to the hotel where i lodged my wallet which contains my money,and other valuable things were kept.I will like you to assist me with a soft loan urgently with the sum of $3,400 US Dollars to sort-out my hotel bills and get myself back home.
 
I will appreciate whatever you can afford, i 'll pay you back as soon as i return.
Kindly look for any western union and use this informations below to send me whatever you can afford.

Name : <Redacted>
Address : <Redacted>
Zip code: <Redacted>
State :Lagos
Country :Nigeria
Test Question :To who?
Answer :
Amount send $:?

Once you have it sent, please send me the money transfer control number,with details used in sending it. I await to read from you.


The EMail content is practically identical to the last one with only a few minor alterations. The recipient was naturally suspicious (especially over the fact that their skills with the English language had suddenly taken a turn for the worse) and asked if it was really their contact sending them this mail. The reply was as follows:

Thanks for geting back to me i really appreciate your mail this massage is from me.what i need you to do for me is that just lend me some money when i get back i will pay you back and explain everythings to you ok

Perhaps given the concern over their contact losing all grasp of their native tongue, sending back a missive lacking in spelling, punctuation and basic sentence structure wasn't the smartest of moves.

Happily, our intepid investigator was able to confirm with the victim that yes, they had been hacked and as far as I'm aware nobody lost any money to these scammers. Thanks to Jeanette at Mother Hen Productions for sending this over!
This is a particularly disturbing scam that's been passed my way, courtesy of reader MTGarden.

The scammers in question hacked a colleagues EMail account, then sent out a request for money to the people on the hacked accounts contact list, claiming they were overseas and without cash. The EMail looked like this:

Hi,
I am sorry I didn't inform you about my traveling to Europe for a
program called Empowering Youth to Fight Racism,HIV/AIDS,and Lack of
Education,the program is taking place in three major countries in Europe
which are Czech Republic,Scotland and England,I am presently in
England,London.

I misplaced my wallet on my way to the hotel where my money,and other
valuable things were kept.I will like you to assist me with a soft loan
urgently with the sum of ?2000 British Pounds to sort-out my hotel bills
and get myself back home.
I will appreciate whatever you can afford, I'II pay you back as soon as
i return.Kindly look for any western union and use this informations
below to send me whatever you can afford.

Name : <redacted>
Address :<redacted>
Zip code: <redacted>
State : <redacted>
Country :<redacted>
Test Question :To who?
Answer :<name removed>
Amount send ?:2000

Once you have it sent, please send me the money transfer control
number,with details used in sending it.
I await to read from you.


....yikes. All you'd need is one or two non-tech savvy people (relatives would obviously work best here) on the contact list and you'd quickly have a large problem on your hands. If you have anyone like that on your contact list - and most of us do - it might be worth letting them know about this scam. As a sidenote, I should add that the person in question regained control of their EMail account and no money was sent to the scammers.

Be on your guard...
Earlier today, we noticed it was possible for malicious users to abuse Imageshack by obtaining the IP Address of anyone who had uploaded an image to the site (considering they have 2+ million uploads a day, that's an awful lot of people to choose from). The first step would be to make a simple alteration to the file extension on a "direct link" URL for any Imageshack picture.

Once done, a file would be presented for download.

imshck1.jpg


Upon opening up the file, you would be presented with the IP Address of the uploader:

imshck2.jpg


This presents an obvious security risk, and could be used for everything from freaking people out on forums via the method of "magically" revealing someones IP address to more devious activities like building up a posting history of particular IP addresses, or simply trying to run exploits against the end-user in question. Of course, end-users might be caught out if they've been uploading images on company time, too (the snooper could match an IP to a company and go to them with an easily identifiable person in a photograph for example. It may sound a touch OTT, but never underestimate someones capacity to cause trouble over the silliest things).

We notified Imageshack at 7:59 PM GMT / 11:59 AM PT. Imageshack responded at 9:03 PM GMT / 1:03 PM PT, letting us know that the issue reported had been addressed and were confident that "this security gap no longer exists". After some testing, that appears to be the case. If you try the same technique now, you'll see this:

forbidden1.jpg

We don't know how long this has been in circulation for, but I'll stick my neck out and guess (hope!) that it's a recent thing. Kudos to Imageshack for acting so quickly - I can't remember the last time we found something that was patched at such speed, and full credit to them. The last time an issue like this existed was (I believe) back in 2006, which was also apparently fixed rapidly.

A shame it doesn't always happen like that...