Criminals sabotaging Cyber Monday, security experts warn
Fake UPS notices, bogus Groupon coupons, raft of other tactics deployed by bad guys
Computerworld - Security experts today warned consumers of a rapidly mutating spam campaign using bogus messages from United Parcel Service (UPS) claiming that a package could not be delivered.
The spam run, which actually began earlier this month, is just one way that security researchers believe criminals will exploit the holiday season online buying spree.
According to Cloudmark engineering director Angela Knox, the UPS-based scam uses phony email to dupe recipients into either opening an attachment or clicking on a link to infect machines with malware.
"We've seen a number of variants in this campaign, some with attachments, some with no attachments and bad links, all of them personalized to the recipient, and sent from an ever-changing list of fake UPS employees or the generic 'UPS Customer Services,'" said Knox in a blog post today.
The attached files are actually .zip archives that contain malware, said Knox, while the links lead to compromised or hacker-controlled websites that host attack code.
"With Cyber Monday kicking off the online holiday shopping frenzy, online shoppers should remember to be vigilant about any email message that they receive," said Knox.
Other security experts echoed that as they cataloged a host of ways criminals could subvert online shopping.
Wolfgang Kandek, chief technology officer of Qualys, warned of hackers exploiting the popularity of discount services such as Groupon and Living Social to feed malicious links via all kinds of avenues, including Twitter, Facebook, email and instant messaging.
Meanwhile, Dell SecureWorks today reported an uptick in malicious messages posing as problems with recipients' airline tickets, canceled direct deposits and -- as Cloudmark noted -- shipping invoices.
The malware planted on fooled users' PCs includes the notorious Zeus Trojan horse, which has been implicated in numerous thefts from U.S. consumers and small businesses, said SecureWorks today.
Experts urged users -- both at home and at work, where many shop using their office's faster Internet connection -- to be wary of fake sites and too-good-to-be-true discounts pitched via email and social media.
SecureWorks also encouraged users to ensure that their browsers and browser plug-ins, especially document viewers such as Adobe Reader, music and video player utilities like Flash, are up to date with the most recent security patches.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cybercrime and Hacking White Papers | Webcasts