Network World
Tuesday, October 14, 2008
DNSstuff.com
Get information about your IP
IP Information
50+ On-demand DNS and network tools

Community

Navigation

Two hits on this Thursday

0

I got two hits on the IE7.0 Beta 2 in my inbox as of Thursday. I forwarded the message to as well as to the carriers for the two servers listed in the links.

By the time I started my forensic analysis one of the sites had already been taken down, but the other on the People PC network was still active. Both of the links were directly to "IE70.exe", no respected vendor would ever do this, but link to a download site.
Secondly the links were to raw IP addresses and not to DNS names, another no-no.
Linking a .gif to a diffent site than the one that is included in the picture is a major phishing tactic that has been used over and over again, resently for Fifth-Third and Bank of America.
I've also gotten Chase, Sears, Walmart and BB&T hits using the same type of redirects.

I get more than my share of this type of message because I work in IT Security, and so permit almost everything through my primary ISP and Email filters, but have extensive rules associated with junk mail. That permits me to view the raw text format of the message, thus eliminating the html, activeX and other exposures associated with most web and email based attacks. One of the ways I do this is that when I provide an email address to a vendor, I use a "public" address that automatically puts all of the traffic into the Junk folder. Upon review I can vet some of these messages as legitimate and set rules for them.

Just about any upgrade, or "security" information that you get in e-mail that gives you a link should be suspect. Never use the e-mail links, but go through the primary site supposedly affected to search for any real updates. Even then, be aware that if the link information includes a redirect statement, the vendors systems may be compromised.

Reply

The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <i> <b> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <blockquote> <br /> <br> <p>
  • Lines and paragraphs break automatically.
  • You can use BBCode tags in the text.
  • Web page addresses and e-mail addresses turn into links automatically.

More information about formatting options

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.

Advertisement: