Results tagged “Skype” from SpywareGuide Greynets Blog

A friend of mine had this "exchange" on Skype a few days ago:

[10:36:19 AM] SHAHEEN: FROM: AHMED.S.
EMAIL: shhnahmed5@gmail.com
 
Hello [NAME REMOVED],
 
I have tried to reach you on Skype phone, but your line was busy, so I decided to write you this message.  I have been in search of someone with this last  name "[NAME REMOVED]", so when I saw you online, I was pushed to contact you and see how best we can assist each other. I am AHMED.S, a Bank Officer here  in U. A. E. I believe it is the wish of God for me to come across you now. I am having an important business discussion I wish to share with you which I  believe will interest you, because it is in connection with your last name and you are going to benefit from it. 
 
One Late Michael [NAME REMOVED], a citizen of your country had a fixed deposit with my bank in 2003 for 60 calendar months, valued at US$26,700,000.00 (Twenty Six Million, Seven Hundred Thousand US Dollars) the due date for this deposit contract was last 22nd of February 2008.  Sadly Michael was among the death victims in   the May 26 2006 Earthquake disaster in Jawa, Indonesia that killed over 5,000 people.  He was in Indonesia on a business trip and  that was how he met his   end.  My bank management is yet to know about his death, I knew about it because he was my friend and I am his account officer.  Michael did not mention any   Next of Kin/ Heir when the account was opened, and he was not married and no children.

Last week my Bank Management requested that Michael should give  instructions on what to do about his funds, if to renew the contract.  I know this will  happen and that is why I have been looking for a means to handle the   situation, because if my Bank Directors happens to know that Michael is dead and do not have any Heir, they will take the funds for their personal  use, so I  don't want such to happen. That was why when I saw your last name I was happy and I am now seeking your co-operation to present you as Next of Kin/ Heir to   the account, since you have the same last name with him and my bank head quarters will release the account to you. There is no risk involved; the transaction   will be executed under a legitimate arrangement that will protect you from any breach of law.

It is better that we claim the money, than allowing the Bank Directors to take it, they are rich already.  I am not a greedy person, so I am suggesting we   share the funds equal, 50/50% to both parties, my share will assist me to start my own company which has been my dream.  Let me know your mind on this and   please do treat this information as TOP SECRET. We shall go over the details once I receive your urgent response strictly through my personal email address, shhnahmed5@gmail.com 
 
We can as well discuss this on phone; let me know when you will be available to speak with me on Skype.  Have a nice day and God bless. Anticipating your  communication.
 
AHMED.S.
shhnahmed5@gmail.com

One to avoid...

Generally, download sites do a good job of keeping potentially undesirable programs off their network. You might see the oddly titled "family keylogger" program and wonder about the ethics of such a utility, but leaving those rather dubious grey areas aside, mostly things take care of themselves.

However, while browsing the cnet.download.com site today, I happened to find something rather peculiar in their "Network Monitoring Tools". Namely, this:


Click to Enlarge

As soon as I saw the creator description of the program, I knew something wasn't quite right:

"Apheve is a great piece of software that has the ability to disguise itself as multiple IM programs including MSN, Skype, and BT Yahoo.This is perfect if a visitor is coming round who wants to access their IM account."

Wait, it "disguises" itself as multiple IM programs? And its name sounds like a bizarre slang version of the word "thieve" (A Pheve)?

Oh dear.

As you might expect, the program is available to download on numerous sites, including CNet Asia and ZDNet UK. Up for grabs since May 2008, the number of downloads is somewhat alarming:

18,214 download.cnet.com

9186 CNET Asia

455 ZDNET.co.uk

Not including other sites related to the above URLs, that means there's a grand total of at least 27,855 people (possibly) running round trying to steal your IM logins. (Check out the comments for more thoughts on what all those people may....or may not....be using the program for).

Did I say steal? Yes, I did. Presenting.... "Apheve":

Quite simply, you select the IM client of your choice - MSN Messenger, Yahoo IM or Skype - and hit the "Start!" button. Then you retreat to a safe distance and let your victim use the PC. As we've seen before, these kinds of programs work great for scammers in net cafes, libraries and schools / universities.

The victim will see one of these:


Click to Enlarge


Click to Enlarge

Of course, both of those IM boxes are entirely fake. Should you enter your login details, you'll be shown an error message and wander away from the computer feeling vaguely annoyed. Meanwhile, the attacker jumps onto the same computer and clicks on the apparently harmless looking fake icon in the Taskbar - in this case, a picture of a DVD / CD:



....and is presented with your login information, courtesy of a nifty popup box:


Click to Enlarge

Is it just me, or does that go a little beyond the scope of "Monitoring Software"?

The program has absolutely no reason to exist other than harvesting login credentials.

Even the choice of targets seems designed to cause as much trouble as possible - Skype accounts will probably have unused call credit stored against them, Windows Live accounts may well be linked to EMail as well as IM, potentially giving access to yet more personal information, logins etc.

Any claim by the creator that this is intended for "network security" is fairly blown out of the water when we check out his Youtube channel, only to find...


Click to Enlarge

...he's promoting it with the title "How to hack Msn, Skype or Yahoo with Apheve 1.1", with "Apheve pro - The ultimate hacking tool" in the description.


The only good thing here is that due to the program being around for a while, the fake versions of Skype, Windows Live Messenger etc look rather outdated and not very much like the real, current versions. The DVD / CD icon in the corner could also be a giveaway, though of course you can change that if you really want to.

We've EMailed the Downloads team, and will post again when we hear back from them.

Given the rather single-minded purpose of this application, I'm a little surprised it managed to squeeze through the cracks. The above download sites may well be "Tested Spyware Free", but they're currently not "Tested Horrible IM Stealing Piece of Junk Free".

Hopefully that might change shortly...

A word of caution - we've noticed quite a few messages similar to the below currently in circulation on Skype:


Click to Enlarge

[5:51:48 PM] smith kabila says: GOOD DAY   
       FIRST AND FOREMOST,I MUST SOLICIT YOUR STRICTNESS CONFIDENCE IN THIS TRANSACTION AND I PRAY THAT MY DECISION TO CONTACT YOU WILL BE GIVEN GENUINE APPROVAL CONSIDERING THE FACTS WE HAVE NOT KNOWN EACH OTHER BEFORE, I WISH TO USE THIS OPPORTUNITY TO INTRODUCE MYSELF TO YOU.
 
      I AM SMITH KABILA FROM DR CONGO,   AFRICA. I WRITE TO INFORM YOU MY DESIRE TO INVEST,AND TO BUY A LIVING HOUSE IN YOUR COUNTRY. I AM THE FIRST  SON OF MR.BRIGHT KABILA, HE WAS A DIAMOND/GOLD MERCHANT IN MY COUNTRY.MY FATHER HAD A BULLET SHOT BY THE REBELS ON HIS WAY TRAVELLING OUT OF MY COUNTRY WITH TWO OF MY YOUNGER SISTER'S DUE TO PRESENT CRISIS THAT IS OCCURRING IN MY COUNTRY(DR CONGO).MY SISTER'S DIED ON THE SPOT WHILE THE U.N.PEACE KEEPING FORCE RESCUED MY FATHER,HE WAS TAKEN TO HOSPITAL FOR MEDICAL TREATMENT WHICH HE LATER DIED. BEFORE HE DIED HE REVEALED TO ME AND MY MOTHER ABOUT THE BOXES CONTAINING $7 MILLION US DOLLARS.WHICH HE DEPOSITED WITH A SECURITY COMPANY IN GHANA FOR SAFE KEEPING. MY FATHER DID NOT DISCLOSE THE CONTENT OF THE BOXES TO THE SECURITY COMPANY.TO AVOID THE OFFICIALS FROM RAISING EYE BROWS TO THE FUNDS.
 
       PRESENTLY MYSELF AND MY MOTHER ARE HERE IN GHANA TO NOTIFY THE SECURITY COMPANY FOR THE CLAIMS,AND WE ARE STAYING IN THE REFUGEE CAMP. THEREFORE I WANT YOU TO LECTURE ME ON HOW BEST WE CAN INVEST THIS MONEY,BECAUSE MY FATHER TOLD ME THAT IT IS DANGEROUS TO INVEST THIS MONEY IN AFRICA TO AVOID SUSPICIONS, AND DUE TO MARKET INSTABILITY COUPLED WITH ECONOMIC AND POLITICAL INSTABILITY FACING AFRICA COUNTRIES,THAT IS WHY WE WANT TO INVEST IN ABROAD. FOR YOUR MUTUAL ASSISTANCE, MYSELF AND MY MOTHER HAVE AGREED TO OFFER YOU 20%OF THE TOTAL AMOUNT OF THE MONEY AND ALSO 3% FOR ANY EXPENSES.
 
    WE HAVE ALL THE VITAL DOCUMENTS COVERING THE DEPOSIT AND THE OWNERSHIP WHICH I CAN SEND TO YOU THROUGH FAX ON REQUEST. NOTE:I HAVE NEVER DISCLOSED THIS TO ANY PERSON APART FROM YOU,SO YOU HAVE TO KEEP THIS TRANSACTION AS A TOP SECRET TO YOURSELF ALONE.WHICH I WILL WANT YOU TO FORWARD ACROSS TO ME YOUR DIRECT TEL/FAX NUMBER FOR MORE INFORMATION'S ABOUT THIS TRANSACTION.

contact through this contact
this is my direct line, 233 247890536
email contact : smithkabila29@yahoo.com
 
BEST REGARDS,
 
SMITH KABILA. (FOR THE ENTIRE FAMILY)

....quite a long one, isn't it?

He then spent a lot of time trying to convince me to "work together", claiming he would show me everything he knows about webscams.

Doh.

smithkabila100 is the Skype account to block.

Well that's typical, I go on holiday and the moment I switch a PC on to check something, this appears in Skype:

stephanie kidkhyan says: how are u i hope good, my name is stephanie napapon am from thailand but live london i contant u for my late fahter consingment in afirca pls if u can help me u will take 30% of the money pls the money in the box is 5.2mioll euro.i have all the document and my passport pls i need u help ok this is my email addr stephanienapapon@yahoo.com

This person then tried their hardest to get me to ring a UK based mobile phone number. Let's think about that for a second...someone in Thailand, a father with a "consignment" in Africa and a phone number located in an entirely different continent.

Yeah, doesn't sound too convincing does it? Do yourself a favour and block this Skype address:

napapon4love

In the meantime, we've reported the Username involved.

A short and sweet entry, this one. Ignore any messages you see like the below:

Hey [name goes here], this Nixie. Now I am looking for new friends. U can look my photo here:

elliser.com/girls/keengirl

The above URL redirects you to

xxxblackbook.com

...which is an adult dating website. Of course, Skype users should be suspicious when any unsolicited message comes through - even when from a supposedly "hot and horny female", or however it is that they tend to describe themselves...