
Subscribe to
Computerworld
or
Other Security Stories
April 05, 2005 (IDG News Service) -- Beware of Web postcards bearing greetings. That's the advice from the SANS Institute's Internet Storm Center (ISC), which is warning about e-mail messages that pose as Web postcards, then direct recipients to a Web site that installs a Trojan horse program.
The new attacks use sophisticated social engineering techniques to trick users into installing Trojan remote access programs that can fool antivirus and firewall software by appearing to be authorized applications like Internet Relay Chat (IRC) software, the ISC said.
The ISC has received an increasing number of reports of the postcard scams in recent days. Victims receive e-mail messages with subject lines such as, "You have received a virtual postcard from a family member," with a link to a pickup site that installs the Trojan horse, according to a post on the ISC Web site.
Another recent scam posed as a message from Blue Mountain Greeting Cards, a service operated by American Greetings Inc. in Cleveland. The messages use a spoofed sender address and appear to come from bluemountain.com. A link in each e-mail claims to go to Blue Mountain's card pickup Web page, where recipients are asked to enter a unique card ID number provided in the e-mail. However, victims who click on the link pass first through one of a number of sites that may have installed malicious software, ISC said.
Those Web sites weren't available today. A customer service representative from Blue Mountain said in an e-mail message that the company has recently received reports of false e-mails purporting to come from the company and that the company's abuse team is investigating.
Web greeting cards have been used to spread malicious code before. Variants of the Zafi worm in December arrived in e-mail attachments claiming to be postcards offering Christmas greetings. Some variants of the Cult worm in 2003 also spread in e-mail attachments that were said to be Blue Mountain greeting cards.
While the method of attack is well established, the latest threats are becoming harder to detect because they install programs that piggyback on authorized applications to carry out malicious acts. For example, the Trojan horse installed through one recent Web postcard attack took over, or "hooked," IRC applications on compromised systems. Antivirus and firewall software is often instructed to trust such programs and allow traffic from them to pass to and from a protected computer unmolested, which gives remote hackers access to infected systems, ISC said.
Users are advised to be cautious when opening unexpected e-mail from unknown sources, ISC said. When links to legitimate Web sites are provided in HTML-format e-mail messages, users should note the address, then type it into the address field of their Web browser, rather than clicking on the link provided in the message. Clicking on the link can often trigger the installation of malicious code or take the user to a Web site that will install unwanted programs.
|
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
|
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
|
|
| ||||||||
| ||||||||
| ||||||||
|


Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT the good, the bad, and the rest of the weird stuff you deal with every day.New baits |

"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|

In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
| About Us Advertise Contacts Editorial Calendar Help Desk Jobs at IDG Privacy Policy Reprints Site Map |
|
CIO The Industry Standard |