You have been photographed naked: you are being sued; you have a tax refund coming.

Stuart Corner
Monday, 21 April 2008 07:04

Business IT - Security

Cyber criminals are becoming increasingly inventive in their efforts to get the unsuspecting to give away personal details or install malware onto their systems.

Perhaps the cleverest, and potentially one of the most damaging has been reported by UK company Norman Data Defense Systems (NDDS). It takes the form of an email direct to a company's CEO and appears to be an official message from a US District Court telling the CEO that his/her company is being sued. The recipient is instructed to click on a link to view the official court documents.

According to NDDS, "the email looks very realistic, and contrary to some other phishing attempts the grammar in these emails is good. It also contains the correct name of the company, the correct CEO and might even contain the correct phone number. This misleads the recipients into following the instructions in the emails. When clicked, the link that seemingly is to the American Courts leads to Jinan China where users are asked to install a plug-in to access the documents.

"By doing this the victims are in fact installing a trojan that gives criminals access to data located on the computer. Such data could include sensitive business or development data, passwords, strategy documents, payment information and so forth. The trojan is installed in form of a digitally signed CAB archive which extracts a file called acrobat.exe. This file then again installs acrobat.dll that gives the trojan access to all data that passes through the web browser and Windows Explorer."

Another trick, received several times by the author in recent days, could surely only snare the most gullible. It purports to be from the US Internal Revenue Service informing the recipient that they have a tax refund. They are given the option of having this paid direct to their credit card: if they enter their credit card details: including the PIN!

A third ruse designed to get people clicking has been identified by Internet security company, Marshal, which reports a spate of spam messages with the subject line "we caught you naked [your name]! check the video." The message itself contains only a link which falsely claims to be to this video, but in fact makes the users' PC part of the Srizbi botnet. CONTINUED