No-Click Phishing On The Way

An anonymous reader writes "MessageLabs has discovered a pretty nasty - though fairly crude - phishing scam which doesn't even require recipients to click on a link in order to hand over personal data. Simply opening the email is enough to activate a script which 'lies in wait for its victim' according to one report. The script rewrites the host files of the machine and directs users to a fake web page the next time they legitimately attempt to access an online banking page. ... However, this will only affect users who have Windows Scripting Host enabled and certain ActiveX controls, according to MessageLabs."

Comments

Pegasus Mail!

[rearl]

...doesn't execute HTML or scripts. Use it, be safe!

you've been served

[bathmann]

No-click phising? That's infringing on Amazon's one-click patent!

So that's the reason

[Anonymous Coward]

The virus apparently also redirects visitors of AOL Support Forums to Ask Slashdot, which explains the recent postings.

same thing works on linux

[Anonymous Coward]

but you have to manual make the suggested changes to your /etc/hosts file after getting root access and using your editor of choice.

not quite "no-click", but linux does support this feature.

[/humor]

thats why

[Anonymous Coward]

that's why I never keep any personal info on a computer. in fact I have outlook filled with entirely made up crap. names like 'hootie McBoob' and such

God bless Microsoft

[Anonymous Coward]

For making products so easy to use that even someone you don't know can use them for you.

And here I was going to switch to Windows...

[RealAlaskan]

However, this will only affect users who have Windows Scripting Host enabled and certain ActiveX controls, according to MessageLabs."

Well, I was going to switch over from Linux to Windows, because I heard Bill Gates said that ``security is our top priority'', but now I think he must have been misquoted. Maybe I'll stick with Linux just a little longer, until Windows gets those last few little bugs ironed out.

Re:And here I was going to switch to Windows...

[ConceptJunkie]

I heard Bill Gates said that ``security is our top priority'', but now I think he must have been misquoted.

No, the quote is correct, it's just taken out of context:

"[Our financial] security is our top priority".

Re:definition

[Anonymous Coward]

for those who don't know what phishing is

Slashdot - news for n00bs, stuff that confuses

Re:Law enforcement?

[aurb]

Are you saying they should start arresting Microsoft programmers?

News Flash!

[RAMMS EIN]

ActiveX is insecure!
WSH is insecure!
Windows is insecure!
HTML mail can be used to exploit security flaws in user agents!

Film at 11!

Innovation

[pete-classic]

Will the innovation never end?

-Peter

Re:Makes me glad I use pine

[slash-tard]

I just use pop3 and smtp commands inside a telnet window(ex: telnet mailserver 25 or 110). I consider this the safest. I dont know what pine is doing behind the scenes.

Re:Took them long enough

[mfifer]

Remind me to tell my mother to start using Thunderbird and Firefox and install a firewall.

Sure. What was her email and IP address?

;-)

Re:Took them long enough

[Odin's Raven]

Remind me to tell my mother to start using Thunderbird and Firefox and install a firewall.

Sure, no problem. But could you ask her to hold off on the upgrades until after I've finished sending out this last batch of bulk mail that I've got queued up on her box? Quid pro quo and all that. Thanks.

Re:Well...

[merphle]

Let's keep our programs simple. Let's continue the UNIX philosophy of one program for one task.

*coughemacscough*

Zzzzzzzzz

[m.h.2]

*yawn*

Patented

[punkkid]

Didn't Amazon patent no-click phishing? Oh wait, that was 1-click phishing. Sorry!