MWP saves the day (yet again)

mcullet · Sun Sep 05, 2010 3:38 am

Hi folks,

I know a number of people really love the ability to bounce spam emails. Maybe this example might make you more cautious about doing so.

The email (below - placed in CODE) was instantly identified as a nasty by MWP. It's not so much that the spam was correctly tagged that's of interest, it's that this is an old (as in years) variation used by criminals to hijack your accounts ... Lads (criminals) are a lazy and tend to use the same scripts (or copy from others) with a few minor variations to suit the target. In my case, it was targeted to BIGPOND (my ISP) customers but it's been used for all forms of web mail services (GMAIL, Yahoo, Messenger etc) and other ISP's for years. In the body of the email was a code "VX2G99AAJ" which produced over 6,500 Google results. I don't know how (or if it's possible) to sort Google results by date but I noticed some went back to 2007. The scams are as varied as scams can be - but all have a common purpose: to steal your info. Old scams still work.

Some of the more recent variations might appear very convincing and include links to fake / hijacked websites that tempt people to just take a look - and unless you have strong security, then you risk catching a drive-by download nasty. Yes - just looking at a site can cause major harm to your system - zombie systems, kiddy porn servers etc. It's disgusting and real.

The header is spoofed (so far as I can tell) but if I bounced or replied in any way then this lets the lads know I exist - or I might be sending it to someone who doesn't yet know their account has been hijacked. Better to lie quiet, delete and apart from giving FA a 'heads' up' - let MWP do it's thing.

My point is (a) bouncing can be counter-productive and (b) it might be useful to look for something unusual in a message (like the 'security code' in mine) and add these to a filter (c) MWP works elegantly - deletes these things before they get to my PC: I'd rather walk around naked than go without this excellent tool.

I admit I am unimpressed that my ISP did not auto-detect this before it hit my inbox on their server, specifically because the email was pretending to be from BIGPOND.

Great job Firetust!

Code: Select all

Recieved: from [87.106.143.132] with HTTP; Sat, 4 Sep 2010 17:12:30 +1000
Message-ID: <[email protected]>
Date: Sat, 4 Sep 2010 17:12:30 +1000
From: "BIGPOND ADMIN" <[email protected]>
Reply-to: "BIGPOND ADMIN" <[email protected]>
Subject: Update Your Bigpond Account(Over Quota)
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="iso-8859-1";
MIME-Version: 1.0

--
Dear BIGPOND Account User,

This message is from admin messaging center for all e-mail account BIGPOND
owners.

We are currently upgrading our data base and e-mail/sms account. We are
deleting all unused e-mail account, creating more space for new accounts. To
complete upgrading of your account, you are requested to provide details
below immediately:

Name:

Username:

Password:

Mobile:

Contact address:

You can also check your e-mail address by logging into your account via
http://bigpond.com/, Failure to provide the above details we shall
deactivate your online Account with us. Make sure you use your valid
information requested above, A confirmation code will be sent to you.

Warning! Account holders that their account within seven days of receipt of
the update to this alert is to lose his/her account permanently.

Warning Code: VX2G99AAJ Thank you, Welcome to WebMail /
Email Webmaster.

Webmail Support
BIGPOND (C) 2010

________________________________________________

This message was sent
using Dodo Webmail - www.dodo.com.au

Sun Sep 05, 2010 3:46 am

Did you plug that into spamcop.net to see what they think of it? I really like their header testing and evaluation system, it saves a lot of time over digging into it by hand.

mcullet · Sun Sep 05, 2010 1:35 pm

stan_qaz wrote:Did you plug that into spamcop.net to see what they think of it? I really like their header testing and evaluation system, it saves a lot of time over digging into it by hand.

Doh! - well ... nope. Didn't occur to me. Just went to the Spamcop site and can't find any tools to look at the header. You are quite right though ... not all header analysis tools are equally useful. I used my trusty favourite http://www.ip-adress.com but it said localhost (127.0.0.1). The other IP's were in Germany and China. And it claims to have come via the DODO ISP system - which is a real ISP in Australia.

Based upon what I've learned in my dark hobby, lad gangs are international - as in, an oga (the boss) might be in an obvious place (Nigeria or China or India or USA etc) but their RL members can be physically anywhere. And for all I know this came from a zombie - probably. Cooperation between gangs exists but not a lot - generally limited to buying and selling ID's, victim lists (victims will be hit repeatedly - sometimes lads waits months and often pretend to be from the FBI or something similar offering to 'help' get lost money) and so on. Lad gangs don't play well together, even within the same gang - lots of mistrust - hopefully because of dollar-chopping and 'other' efforts by the good guys. "Dollar Chopping" is where lads believe they are about to get a big payday and someone (another lad or a good guy) steals the pay-off.

I include spamcop in the DNSBL (origin of spam) check but think this email was detected via MWP's learning process. (Nod to the coders - cool work.)

Thanks for the tip - will spend a bit of time and explore the spamcop site in detail. Seems useful.

Sun Sep 05, 2010 4:05 pm

Sign up for a free spamcop.net account, if you like it you may want to upgrade to a faster paid one at some point. Spamcop.net offers several reporting methods, the simplest for 2010 users is to copy/paste from the source pane into the webform at spamcop.net. You can put any e-mail in there or just an IP address and see what spamcop.net has on it. You can do that to even a good message as long as you select Clear instead of Submit on the analysis page.They also offer reporting via e-mail that works in v6 and is a work in progress for 2010 and that really reduces the work of reporting a pile of spam. With my old MW my record was just over 8,000 per day and boy does that give you a warm fuzzy feeling!

Firetrust Support Forums

MWP saves the day (yet again)

MWP saves the day (yet again)

Re: MWP saves the day (yet again)

Re: MWP saves the day (yet again)

Re: MWP saves the day (yet again)