Slashdot Mirror
New Targeted E-mail Attack Hits Business Execs
Erik Larkin writes "The same scammers who have been sending out the faked but highly convincing BBB and IRS e-mails are now targeting named victims with a new variety of e-mail that looks like a business invoice. Our editor-in-chief was sent one here at PC World."
Finally, a profitable application of the peter principle.
Beep beep.
I think it would be wise for companies to switch to use something like GPG and keep keys safe. The sooner this happens the sooner scammers will have a more difficult job with this style of social engineering.
Why UNIX?
It is still using the same method. The only difference is that they don't include spelling/grammar errors, and uses correct recipient and business name (how hard is that to find?). They are still using the same ".doc.exe" file names, which is very easy to spot.
-- tinyhack.com
As a small business owner, I can attest to the fact that many of my clients will blindly pay the bills I send them, without questioning a thing. I service their computers throughout the month, racking up between 10 and 30 hours, and then send them a bill that simply says "30 hours service * $60.00 / hour" and they pay it. I have never been asked to explain myself. I can probably make up whatever numbers I want.
I was wondering how long before the crooks realized that most businessmen do not have the time or patience to study their bills.
This spam includes a valid email address for the recipient, and correct recipient name and business details. The message and attachment could be anything. In this case its an invoice, but it could just as easily be an order (sent to sales) or a request for info (sent to PR or Marketing). This would make it extremely difficult to identify.
.doc (or presumably a file for any application that is exploitable by opening a file) to take advantage of a zero day vulnerability.
Its not as if you could use heuristic scanning of the text content (any malicious payload excepted) to determine that messages of this sort are spam, it would prevent you from recieving any business related email that follows a similar formula and they are all pretty similar.
The attachment in this case was a doc.exe which is fairly obviously dodgy, but as the article states it could be a
With this type of spam and the zero day vulnerability as the scenario it would be entirely possible for a message like this to get through to a real person, for that person to open the attachment and execute whatever malicious code is embedded in the attachment without realising that they have even done anything strange.
There is no way of preventing it that still allows your employees to function, with a 0 day you are (probably) not going to detect the payload before it is executed (what happens then depends on what precautions your company is taking). You cannot brief your user base not to open emails addressed to them with content that looks valid and may be part of their job to look at, the argument of only opening mail from people you know only really works in a social context where you can afford to ignore mail.
So, up until now most common scams and viral mail have had some tell-tale characteristics (although by no means all, custom attacks against specific targets have followed this model before), and now they may not have. (I never understood why spam was so poorly produced in any case). Given that even badly written and almost blindingly obvious spam and scams manage to trick a small number of people, this type of spam or scam is likely to be more effective. This leads me to think that from a business point of view (lets be honest, especially a Microsoft shop) the usefulness of email is seriously deteriorating, it is approaching the point where the existing system contains too much risk and is too overburdened to be useful and that is saying a lot because email really was/is a revolutionary technology. Not that I can think of an alternative nor am I suggesting that we will see business dropping email, but I can see business looking at some of those fatally flawed but great sounding add-ons that aim to secure mail from unknown recipients (micro payments and white listing etc..).
You don't need to.
As long as the protections cause the rate of infection to drop below the rate of disinfection, the threat will fade.
Social engineering will always be an issue. Even intelligent people can make mistakes.
The idea is to make it as obvious as possible that this is a DANGEROUS activity
Make it as easy as possible to clean up the mess.
#1. Any time an application is launched by clicking on a file INSTEAD of going through the menu bar throw up a warning.
#2. No email program should EVER run ANY executable.
That is the primary reason that so few "viruses" exist in the wild
#1. Save the attachment to your personal directory.
#2. Change the permissions on the file to be executable.
#3. Run the file.
And even with all of that the only thing in danger are your personal files (you do back them up of course). To do anything more you'd have to...
#4. Suppy it with your sudo password.
The reason this is so successful is that the possibility of FAILING to run the "virus" goes UP with each step that is required. Say that each step only has a 50% possibility of being run by the average user. The other 50% of the time they realize that they're doing something dangerous and they stop.
A. Old Windows example:
#1. Double-clicking on "sex.gif" in an old version of Outlook is a single step and will succeed with 50% of the people.
B. Linux example:
#1. Saving the file to your personal directory will work with 50% of the people.
#2. Changing the permissions on the file will work with 50% of the people from step 1 (25% of the total).
#3. Clicking on the file will work on 50% of the people from step 2 (12.5% of the total)
#4. Supplying the sudo password will work on 50% of the people from step 3 (6.25% of the total).
So, 50% infection rate vs a 93.75% NON-infection rate.