SECURITY WARNINGS & Notices - Please post them here

Pondus · 2012-01-09T18:39:49.000Z

FBI warns of new Zeus-based malware in phishing scam

http://www.networkworld.com/news/2012/010612-gameover-malware-254623.html

http://www.ehackingnews.com/2012/01/newer-variant-of-zeus-malware-game-over.html

http://krebsonsecurity.com/2011/11/ddos-attacks-spell-gameover-for-banks-victims-in-cyber-heists/

GameOver With Just One Click
http://blogs.norman.com/2012/for-consumption/gameover-with-just-one-click

Pondus · 2012-01-10T20:39:33.000Z

Convicted murderer gets new trial after computer virus destroys data
http://nakedsecurity.sophos.com/2012/01/04/convicted-murderer-trial-virus/

DavidR · 2012-01-11T13:16:09.000Z

Well the fake HM Revenue & Customs Tax Refund email I reported on the 2nd Jan finally made the papers now. It turns out that HM Revenue & Customs have known about this for some time and have shut down 149 sites (I believe that is the number, but of that order).

Why the hell didn’t they make it public sooner is what I have to ask.

Following hard on its heals is yet another fake email, social engineering, phishing attempt, this time for Santander bank, “Account blocked: Confirmation required” as the subject.

Yet again easy to spot (not least because I don’t have a Santander account ;D) but banks just don’t pull these sort of strokes asking for information in this way. If you have any doubt that it might actually be legit, then logon to your bank in the normal way not via a link in an email.

The link in the email is easy to see is fraudulent, if you only look, hover the mouse over the link and look at the status bar or the email program where the true URL is displayed. For me using MailWasher it displays the underlying URL which stick out like balls on a plate (image).

The email headers also shoe that it doesn’t come from who they purport to be.

It also used an email address that I wouldn’t use for banking, my filtering email which I use for non-trusted sources like banking.

So stay alert, stay suspicious, stay safe as there will be another along soon with a slightly different format.

Pondus · 2012-01-11T13:59:10.000Z

Signed malware: Snooping on Chinese students?
http://blogs.norman.com/2012/malware-detection-team/signed-malware-snooping-on-chinese-students

By redirecting the address to a different IP, attackers are able to present users with altered web content or perform man-in-the-middle attacks. The purpose of this against a student site is up for speculation.