Spam Opt-out Link Triggers Malicious Code Attack

Maestro4k writes "The Register is reporting on a new spam E-mail circulating out there. In it, clicking on the 'Click here to remove' link launches a site, that when the user scrolls the page, triggers a drag-drop javascript exploit. Scarily the E-mail actually complies with the CAN-SPAM act as it only requires spammers to put an opt-out link in their mailings. As The Reg says "It comes as little surprise that this feature is been taken advantage of in a social engineering exploit; but it does illustrate the security problems of the opt-out approach that were always apparent to security experts - and ignored by legislators." The link in questions points to www. xcelent.biz (As in The Reg story, space intentionally included) so even if you can't block the mail yet it should be easy to block access to the site with the exploit. I suspect this is just the beginning and most spam will include "features" such as this in the near future."

Comments

Microsoft says "No Problem"

[Anonymous Coward]

Don't worry, this isn't a real problem:

"Given the significant amount of user action required to execute an attack, Microsoft does not consider this to be a high risk for customers," a company representative said, adding that the software giant's security experts are continuing to research the issue.

I mean, using a scrollbar. Come on, what kind of ignorant user is going to use a scrollbar an a site they don't trust? ;-)

Greeting from Malaysia

[politicsie04]

Whois says that the website is operated by Anandan Krishan from Malaysia, so lets all send him an email, win2save@yahoo.com , complaining that he has discrimnated against Firefox, and Linux users of his website, and that in future he should have a more inclusive virus.

Dumb

[sl8r]

Also, the programmer seems to have had fun writing the javascript on that xcelent.biz page. From the source:

// probably the dumbest scrollbar emulation on this planet ;)

Re:Why is the site still up?

[gorbachev]

Two possible reasons:

1. Law enforcement agencies asked to keep it up

2. Hinet Taiwan doesn't give a shit

I'm betting on option #2.

Re:Use your powers for good

[ElNeo]

Like this nice link?
(click link below to show link...)