- BlackBerry Storm vs. the iPhone
- Digg's Kevin Rose: "We have to do better"
- Blogger warns: "Nortel doesn't make it out alive"
- Financial quagmire bringing out the scammers
- Verizon plays with the wrong e-mail addresses
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:Application Performance Solutions | App Performance | Networking Solution | SafeGuard Enterprise Solution Center | SOA | Test your Web Filter | Value of WDS
With Microsoft Corp.'s monthly patch release expected on Tuesday, scammers are sending out fake security bulletins that attempt to install malicious software on victim's computers.
The e-mail messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update."
When users click on this link, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk.
This Trojan software then attempts to reach out to other computers on the Internet in order to install more programs on the victim's computer.
The SANS Internet Storm Center received its first and only report of the scam on Thursday night but a second sample has also been posted to the Chinese Internet Security Response Team blog.
SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. The trojan looks for three different servers and two of them have domains that haven't yet been registered. He suspects the authors of the scam may be planning to register those domains before embarking on a more widespread campaign.
The two e-mail samples contained obvious errors that would be caught by technically savvy users. For example, although the patch Zeltser examined claimed to have been issued in June 2007, it was entitled MS06-4 instead of the more-plausible MS07-004.
Still, these scams need to fool only a small percentage of victims in order to be successful, said Zeltser, information security practice leader at Gemini Systems LLC in New York. "You wonder, does it really matter that there are these strange discrepancies in the way the fake security alert is written," he said. "People who would notice probably would be the kind of people who wouldn't click on the link."
Another tip-off: Microsoft does send out notification e-mail when it publishes security bulletins, but the links in these alerts take users to the bulletins themselves, not to executable downloads
| NetworkWorld, Inc. | About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW |
| IDG, Inc. | CIO | Computerworld | CSO | Demo | GamePro | Games.net | IDGconnect.com | IDG World Expo | Infoworld | JavaWorld.com | LinuxWorld.com | MacUser | Macworld | PC World | Playlistmag.com | The Industry Standard | IDG List Services | IDG TechNetwork |
 |
Copyright © 1994-2008 Network World, Inc. All rights reserved. |
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comments (2)
thank u for the tip offBy Anonymous on June 11, 2007, 6:29 pmthank u for the tip off
Reply | Read entire comment
Beware of fake Microsoft security alertsBy Anonymous on June 11, 2007, 9:38 amYou can find the list of all of Microsoft's routine security alerts here and and news/updates on other security issues here.
Reply | Read entire comment
View all comments