|
Does Verizon's Voyager stack up to the iPhone? |
|
|
5 IT skills that won't boost your salary
[1,407]
Women 4 times more likely than men to cough up personal info
[589]
Japan's 10 funniest tech-related commercials [Videos]
[407]
Throwing away a promo CD is "unauthorized distribution"?
[1,265]
Adults too quick to dismiss educational video games
[682]
Attack of the iPhone clones [Slideshow]
[578]
10 things IT needs to know about AJAX
[1,258]
This Year's 25 Geekiest 25th Anniversaries [Slideshow]
[409]
|
|
Two hits on this Thursday
I got two hits on the IE7.0 Beta 2 in my inbox as of Thursday. I forwarded the message to as well as to the carriers for the two servers listed in the links.
By the time I started my forensic analysis one of the sites had already been taken down, but the other on the People PC network was still active. Both of the links were directly to "IE70.exe", no respected vendor would ever do this, but link to a download site.
Secondly the links were to raw IP addresses and not to DNS names, another no-no.
Linking a .gif to a diffent site than the one that is included in the picture is a major phishing tactic that has been used over and over again, resently for Fifth-Third and Bank of America.
I've also gotten Chase, Sears, Walmart and BB&T hits using the same type of redirects.
I get more than my share of this type of message because I work in IT Security, and so permit almost everything through my primary ISP and Email filters, but have extensive rules associated with junk mail. That permits me to view the raw text format of the message, thus eliminating the html, activeX and other exposures associated with most web and email based attacks. One of the ways I do this is that when I provide an email address to a vendor, I use a "public" address that automatically puts all of the traffic into the Junk folder. Upon review I can vet some of these messages as legitimate and set rules for them.
Just about any upgrade, or "security" information that you get in e-mail that gives you a link should be suspect. Never use the e-mail links, but go through the primary site supposedly affected to search for any real updates. Even then, be aware that if the link information includes a redirect statement, the vendors systems may be compromised.