Slashdot Mirror
New "Spear Phishing" Attacks Target IT Admins
snydeq writes "A new breed of 'spear phishing' aimed at IT admins is making the rounds. The emails, containing no obvious malicious links, are fooling even the savviest of users into opening up holes in their company's network defenses. The authentic-looking emails, which often include the admin's complete name or refer to a real project they are working on, are the product of tactical research or database hacks and appear as if having been sent by the company's hosting provider. 'In each case, the victim remembered getting a similar sort of email message when they first signed on with a service and, thus, thought the bogus message was legitimate — especially because their cloud/hosting providers keep bragging about all the new data centers they're continuing to bring online.' The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares. Certainly fodder for some bone-headed mistakes on the part of admins, the new attack 'makes the old days of hoax messages that caused users to delete legitimate operating system files seem relatively harmless.'"
The less information floats about you on the net, the better.
The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares.
Why on Earth would I do that at the whim of my ISP or web host? I've actually gotten into arguments with known, real providers that insisted they needed access to my network to work properly (correct response - "No, no you don't - and neither does your competition"), I sure as hell wouldn't say "Oh, you have a new service? Cool, guess I'll chuck that Sonicwall in the trash now...".
This may target "your nephew who does your computer stuff at the office", but it sure as hell doesn't target IT professionals.
Did you even RTFS? The emails contain instructions for things that the attackers want the admins to do. It's called social engineering, and it's not a computer glitch, it's a critical thinking glitch.
We host our mail and web ourselves. At the same time, I don't give a fuck how legitimate an email looks, if it sends me instructions to open my mail server or firewall, I'm going to be on the phone to my ISP ASAP.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I have one of those e-mails in my inbox right now... Supposedly from 1and1.com. It looks legitimate enough, but when hovering over the links with my mouse, I get some not very nice links... some of which go to Denmark.
I've been a Unix sysadmin all my life.
I've worked in the IT departments of non-tech related companies (or at least companies where the servers I maintained where not the actual service being provided by the company). I've worked on the Hosting industry (Where the servers I maintained where the core of the business), in software factories, and other industries. For the last 8 years, I've worked on telephony. I'm currently on charge of the whole operation of a small telco (When I got here, they were cisco+oracle+asp based, and I migrated the whole thing to Asterisk+MySQL+Perl.
I would never, EVER, fall for such a thing. Actually, I keep fighting with my providers over this crap. Even the big guys send updates in plain motherfucking email. Carriers set up and bring down POPs for inbound calls and signalling/media gateways all the time. They insist on notifying us of such additions on plain email.
I'm not going to whitelist on my firewall and add to my sip.conf as a peer/user/friend an IP I got in some random email!.
You want to notify me: Sign your fucking messages! They are fucking Verizon, and the bastards refuse to just sign their freaking email messages. So, what I do is, I have a template explaining the dangers of notifying of such changes in plain email. I reply to every mail I get with that template, and then call my account manager or whoever I have to in order to confirm the information.
Level 3 (Now owned by Verizon too), Verizon, British Telecom, Global Crosing, and other HUGE players on this industry, all do the same stupid shit. And all this guys are fucking Tier 1!
Believe it or not, some other small Telcos seem to be more conscious about this stuff. VoipJet, for example (a small A-Z IAX-only route), sends all the notifications signed and they provide a link to the notice on their website where you can double check the information.
So, the blame here goes to BOTH the stupid Admins that just do whatever they get told over email, and to the companies that get them used to accept unauthenticated communications.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
As my first boss and mentor used to say, "You can't fix stupid."
Posted anonymously. Public company. You get it.
Anyhow, I've got one from un-named webhost today. (Hint, they were one of the companies that got hit when Google got slammed)
Whoever it was, they new my name, and IP addresses that we host some sites on. The ploy was for me to open up all ports to my site to establish a trust to a range they've provided for "enhanced security analysis" thats now "part of their package" as well as email content filtering.
1. I host Exchange in house. (Even though I hate it)
2. I host nothing but web @ Host X.
3. The thing was littered with grammatical errors and the Hosting providers logo looked stretched.
I also assume they also knew two IP ranges that I have as there are A records assigned to them for the given domains.
I think by definition, you are not the savviest of users if you fall victim to a phishing attack.
It is hard to concentrate on multiple tasks at once. While a good sysadmin won't fall for this on the best days, an overworked one will occasionally just do stuff that looks right. If you want real security, any change should require two people (who don't know each other in physically different locations) to implement, an approved change control document that identifies the change and reason for it, and an auditor that goes follows behind the change to make sure it doesn't open any holes. I'm going for funny on this.........
Here is the ultimate OpenBDS fix to boost performance.
Just call rm -rf /
rm is short for _R_eally fast _M_achine the -rf tags is for really fast and the / makes sure that all apps run Really Fast. Just be sure to do this as root as you will need permission to change all executables to run Really Fast.
We all know that OpenBSD is one of the most secure OS out there so you can trust that this command (which is already installed in the system) will work.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
(*hand up*)
Made me wonder why the spear-fishee didn't check the "legit" addresses in the attack email. My first thought was "What, an admin that doesn't know whois?"
Repeat after me: Anybody can get your name and other personal info. If you're not on Facebook, someone else is and they've already given your personals up for you on your behalf. We are officially in the "John Anderton" age. Beer commercials will address you by name. It doesn't mean jack.
Get used to the future. Numb your response to being personally addressed, the same way we've had to numb our sense of "photographic proof," without a degree in forensics.
Targeting the admins for access was one of the major points in HD Moore and Valsmith's talk(PDF) from Blackhat US 2007.
Spyder
In Linux, people seem to add their ssh key so you can logon to pretty much every computer in your network.
Spreading your public key around like that isn't a big deal. It's when the user removes the password from the private key so he never has to type anything to log in, THAT's the real bad one.
If I have been able to see further than others, it is because I bought a pair of binoculars.
I'm at 127.0.0.1. There's a metric shitload of p0rn waiting behind that IP.
Score!
And you've got all my favorites, too!