Download - Help Net Security

On a daily basis, online spammers and hackers are hard at work conjuring up
crafty ways to compromise unsuspecting PC users. E-mail inboxes and social
networking sites are two popular attack targets. This article looks at a selection
of nefarious Internet activity that has made recent headlines, including
geolocation and URL shortening e-mail attacks, along with emerging threats
plaguing sites like Twitter. In each case discussed below, you will notice that
the techniques used by scammers are actually simple by design, but are quite
effective and can often have damaging effects.
Geolocation
In recent months, a malware variant known as
Waledac has resurfaced. Believed to be a reincarnation
of the infamous Storm Worm, the
Waledac worm is embedded in an e-mail attachment
and spreads using the infected
computer!s e-mailing networks. Waledac has
generated several spam campaigns in 2009 -
a number of which have featured a technique
called geolocation.
Geolocation, also known as IP geolocation, is
relatively simple. When in action, it looks at
the IP address of a person visiting a Web
page and cross references that IP address
against a database that tells it exactly where
the IP address is assigned. The result is a
Web page that appears to be customized for
you. This is similar to the frequently seen
banner ads promoting dating sites, such as
“Hot Singles in Kalamazoo are waiting for
you,” or something along those lines where
“Kalamazoo” would obviously be your city of
residence. By utilizing a visitor!s IP address
when they arrive at Waledac!s target sites, the
information can be customized to appear to
be local to the visitor.
However, Waledac attacks do not usually wait
for the user to download the malicious executable
on his or her own. Oftentimes, a hidden
iframe on the landing page will begin the
download without the need to click any of the
links. These domains are always on the same
fast flux type of networks that this group has
www.insecuremag.com 34