COMPUTERS

Pages in the RED MENU are text only.


America did not invent human rights,
Human Rights invented America.

click on image for larger view

VIRUS ALERT
none

ON THIS PAGE

Links
WHAT'S NEW NOW
Internet ScamBusters

Weekly Security Tools Digest

SecurityPortal's Weekly Newsletter
INTERNET WORLD NEWS
eWEEK
Search Engines
National Do Not Call Registry

How an online scam could run up your phone bill

How an online scam could run up your phone bill

Robert Vamosi
Senior Associate Editor, Reviews
Monday, Oct. 6, 2003
Have you recently noticed any expensive calls on your phone bills that you didn't make? If you use a modem to connect to the Internet (and, in some cases, if you're a broadband user as well), this may be the result of an online scam that's been occurring in Europe for some time. If you haven't fallen victim to this scam, and if you're careful, you should be able prevent it from happening to you.

The scam involves tiny Trojan horses that are installed on your PC without your knowledge--and which then run up your phone bill by dialing for-pay numbers. They're able to do this in part because of security holes within Internet Explorer.

THESE SOFTWARE phone dialers do have legitimate uses. They're often used by sites that offer pay-per-view content, such as interactive games, sports trivia, or pornography, as a way to keep track of the minutes you've used and to charge you on your phone bill.

It works like this: The site asks you to download a small applet containing the dialer. Once loaded on your system, the applet disconnects your ISP service and dials the pay-per-view site. You are then charged for however many minutes you remain connected to the site. The fact that you downloaded and installed the app is considered consent for the telephone charges.

The problem is that sometimes dialers are installed on your system without your consent, and change your dial-up settings to call expensive long-distance numbers. This scam is usually perpetrated by fraudulent companies that set up sites full of ActiveX multimedia content. Should you visit the site or click a pop-up ad for the site, the dialer would be downloaded onto your system along with the rest of the site's content. The only possible clue this has happened to you is the appearance of pop-up ads from sites you don't use; the real proof is the extra charges on your next phone bill.

These fraudulent companies have two ways of running up your phone bill. One is a high per-minute charge (as much as $5) for allegedly using their service. This appears on your phone bill but actually will be paid to the company. The other is to have your computer make direct calls to international numbers. If you complain, your phone company may be willing to forgive the high per-minute service charges, because they're used to scams that take advantage of their customers in this way. But they're less likely to forgive the charges for the direct dialed numbers, because it's harder to convince them that you didn't call the number yourself.

SO WHAT DOES Internet Explorer have to do with this? It's a flaw in this browser that allows the scam to work. The flaw, discovered by security company eEye Digital Security in August 2003, allows Web site visitors to unknowingly install malicious code, including dialers, from compromised sites. Because of the flaw, Internet Explorer doesn't distinguish between legitimate ActiveX content and malicious Trojans.

While Microsoft has issued a patch for this flaw, several security experts insist the patch does not solve the problem, only the immediate symptoms. And, to make matters worse, there's also a new Trojan horse, Qhosts, that, while unrelated to dialers, makes use of the same IE flaw to change the way infected users look up Web sites on the Internet.

It's not only dial-up ISP users that are vulnerable to this scam, but some DSL and cable-modem users too. How? In some cases, 56K modems (either internal or external) remain connected to active phone lines even after broadband service is installed on a computer.

MY ADVICE to DSL and cable-modem users is to remove the phone line to your PC's internal modem, and, if you're not using it, to remove your external modem all together. If you need your modem for receiving faxes on your PC or other purposes, then crank up the volume so you'll be sure to hear every time it dials a number.

My advice to everyone is to download and periodically run Spybot Search & Destroy, a free anti-spyware app that removes virtually all known dialers from your PC.

By and large, the Internet is safe to surf, but even I am surprised at some of the things Spybot finds loaded on my PC. Yes, it's a bit of a hassle to run one more app, but it's like maintaining a car. If you don't periodically clean it out, it might not run one day--or worse, it may end up costing you a small fortune.

SPAM

Tip #1 If you receive an email from a company you've never heard of, and there is a REMOVE ME link available � don't click it! This will actually alert the company that you are reading their ads, and they'll put you at the top of their "Send To" list.
Tip #2 If your Internet Service Provider (ISP) allows you to have multiple screen names and email addresses, we recommend using one address for chatting and buying goods from unknown companies � and have another screen name/email address to give out to your friends and financial/utility companies. Did you know that some Spammers will actually snoop through chat rooms stealing screen names/email addresses, and may even buy your contact information from disreputable companies? Always protect your primary screen name and/or email address.
Tip #3
When you get SPAM email, be sure to forward the email to [email protected] (Federal Trade Commission). Did you know that our government is actually storing this information in a database, and is starting to deliver the information to law enforcement agencies?
 
Tip #4 You might also want to contact your ISP about an "Abuse Desk" in their company. Most ISP's encourage their customers to forward SPAM email to their team for investigation. Sometimes your ISP can put a system wide block on all emails from that company.

Learn about a charity before you donate-FREE!

Learn about a charity before you donate-FREE!
 
Consumer protection advocates are warning Internet users that scam
artists are trying to take advantage of Tuesday's terrorist attacks.
Spam solicitations have been sent out urging Citizens to donate money
to the Red Cross or other relief organizations. But the e-mails direct
potential donors to private Web sites apparently designed to steal
credit card numbers! 

http://www.ministrywatch.com/mw2.1/H_Home.asp

GOOD FREE SOFTWARE

Does your Computer have Spyware installed on it?
Try the following link.
If you do not have Spyware it will come up with
the SkyMaps page.
If you have Spyware the Spyware information page
will come up.
Click here to find out:.

Good Anti-Spyware Program (Spybot)
eCleaner
ANTIVIRUS--Inoculate
Free Anti-Virus Protection!
Use our unique offer - AVG 6.0 Free Edition.
FIREWALL--ZoneAlarm

LINKS

Way Back Machine (12-20-01)
Relief groups turn to handhelds (07-06-01)
Four PC Mistakes You Don't Have To Make (03-15-01)
Atlas of Cyberspaces (01-07-01)
New Wallpaper: Earth at Night (01-02-01)
Internet Bandwidth Speed Test (12-28-00)
RFIing YOUR COMPUTER (10-22-00)
Battle Over Your Inbox: Why the Feds Want Snooping Rights (07-26-00)
FBI�s system to covertly search e-mail raises privacy, legal issues (07-16-00)
Napster (07-16-00)
Father of the Mouse (07-01-00)
At long last somebody got smart and wrote
this...thank goodness!!!! NOW EVERYONE SAY IT WITH
ME ...

1) I will NOT get bad luck, lose my friends, or lose
my mailing lists if I DON'T forward an email!

2) I will NOT hear any music or see a taco dog, if I
DO forward an e-mail.

3) Bill Gates is NOT going to send me money,
Victoria Secret doesn't know anything about a gift
certificate they're supposed to send me, and Ford
will not give me a 50% discount even if I forward my
e-mail to more than 50 people!

4) I will NEVER receive gift certificates, coupons,
or freebies from Coca Cola, Cracker Barrel, Old
Navy, or anyone else if I send an e-mail to 10
people.

5) I will NEVER see a pop-up window if I forward an
e-mail ... NEVER!!!!

6) My phone will not MYSTERIOUSLY ring after I
forward e-mail.

7) There is NO SUCH THING as an e-mail tracking
program, and I am not STUPID enough to think that
someone will send me $100 for forwarding an e-mail
to 10 or more people!

8) There is no kid with cancer in England collecting
anything through the Make-a-Wish program! He had
cancer when he was 7 years old. He is now cancer
free and 35 years old and DOESN'T WANT ANY MORE POST
CARDS, CALLING CARDS, or GET-WELL CARDS.

9) The government does not have a bill in Congress
called 901B (or whatever they named it this week)
that, if passed, will enable them to charge us 5
Cents for every e-mail we send. (Refer back to item
7.)

10) There will be NO cool dancing, singing, waving,
 colorful flowers, characters, or program that I will
 receive immediately after I forward an e-mail.
> >
11) The American Red Cross will NOT donate 50 cents
to a certain individual dying of some never-heard-of
disease for every e-mail address I send this to. The
American Red Cross RECEIVES donations. (Refer back
 to Item 7.)

12) And finally, I WILL NOT let others guilt me into
sending things by telling me I am not their friend
or that I don't believe in Jesus Christ. If God
wants to send me a message, I believe the bushes in
my yard will burn before He picks up a PC to pass it
on! "

Now, repeat this to yourself until you have it
memorized, and send it along to at least 5 of your
friends before the next full moon or you will surely
be constipated for the next three months and all of
your hair will fall out!!!

-------- WHAT'S NEW NOW --------

none

eSecurity News

ISSN 1444-9994

Symantec Security Response Newsletter

June 2003

Best viewed at 1024x768 resolution

Bugbear Makes a Comeback!

 

Bugbear made a comeback this month in the form of W32.Bugbear.b@mm. This variant has some significant differences to the original version. Of most concern is the key logging and data export. Of course users wouldn't be infected if their systems were patched up to date. It's the same problem, an old vulnerability, first discovered in March 2001, still giving viruses and worms like Bugbear a way onto your PC.

We are late publishing the June edition, I've been busy with the next version of Symantec's Internet Threat Report, due out in September, analysing the Newsletter survey results and working on the new HTML format.

In response to the survey conducted on this newsletter we have added a couple of new sections, changed a few sections and taken note of your comments. Later editions will be further enhanced but in this edition you'll find a calendar of selected security events and IT Security news links that may be of interest.

One of the more controversial additions are the 'Symantec Solution' boxes embedded in the articles. These are a compromise, we didn't want to carry advertising but many subscribers want to know what products we have to combat security issues, so these boxes are, I think, a reasonable way of covering these issues.

AVAR (Association of anti Virus Asia Researchers) have just issued their call for papers for the conference that will be held in Sydney, Australia later this year. As an AVAR VP I'm proud to be the conference chair on behalf of AVAR for this year. Details of the event are in the calendar.

I've recently had the pleasure of working with Syngress to write the Forward to a new book; Configuring Symantec AntiVirus Corporate Edition (ISBN: 1-931836-81-7). You can get a copy from Amazon here, and no I won't make any money from promoting this link. :)

Best Regards

David Banes

 

Viruses, Trojans & Worms


W32.Bugbear.B@mm

Aliases :
Win32.Bugbear.B [CA], W32/Bugbear.b@MM [McAfee], PE_BUGBEAR.B [Trend], W32/Bugbear-B [Sophos], I-Worm.Tanatos.b [KAV], W32/Bugbear.B [Panda], Win32/Bugbear.B@mm [RAV]

Risk : High [4]

Date : 4th June 2003

Systems Affected:
Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me

Overview
W32.Bugbear.B@mm worm is:

- A variant of W32.Bugbear@mm .
- A mass-mailing worm that also spreads through network shares.
- Polymorphic and also infects a select list of executable files.
- Possesses keystroke-logging and Backdoor capabilities.
- Attempts to terminate the processes of various antivirus and firewall programs.

The worm uses the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability to cause unpatched systems to auto-execute the worm when reading or previewing an infected message.

In addition, the worm contains routines that specifically affect financial institutions. This functionality will cause the worm to send sensitive data to one of ten hard-coded public Internet e-mail addresses

 

The information sent includes cached passwords and key-logging data. � 


Because the worm does not properly handle the network resource types, it may flood shared printer resources, which causes them to print garbage or disrupt their normal functionality.

 

NOTE : If you believe your computer may already be infected with W32.Bugbear.B@mm because your antivirus software does not work, scan your system over the Internet with Symantec Security Check .

Symantec Security Response has created a tool to remove W32.Bugbear.B@mm, which is the easiest way to remove this threat.

Credits

Write-up by: Eric Chien, Security Response EMEA.

References
Symantec Security Response
http://www.sarc.com/avcenter/venc/data/[email protected]


W32.Sobig.E@mm
Aliases
Win32.Sobig.E [CA], W32/Sobig-E [Sophos], W32/Sobig.e@MM [McAfee], WORM_SOBIG.E [Trend]
Risk :Medium [3]
Date : 25th June 2003
Systems Affected
Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me

Overview

W32.Sobig.E@mm is a mass-mailing worm that sends itself to all the email addresses that it finds in the files with the following extensions:

.wab
.dbx

.htm

.html

.eml

.txt

The email falsely purports that Yahoo sent it ([email protected]).

Email Routine Details
The email message has the following characteristics:

From: [email protected]
( NOTE : W32.Sobig.E@mm spoofs this field. It could be any address.)

Subject: The subject line will be one of the following:

Re: Application
Re: Movie
Re: Movies
Re: Submitted
Re: ScRe:ensaver
Re: Documents
Re: Re: Application ref 003644
Re: Re: Document
Your application
Application.pif
Applications.pif
movie.pif
Screensaver.scr
submited.pif
new document.pif
Re: document.pif
004448554.pif
Referer.pif

   

Attachment: The attachment name will be one of the following:

Your_details.zip (contains Details.pif)
Application.zip (contains Application.pif)
Document.zip (contains Document.pif)
Screensaver.zip (contains Sky.world.scr)
Movie.zip (contains Movie.pif)

NOTE: The worm de-activates on July 14, 2003, and therefore, the last day on which the worm will spread is July 13, 2003.

Symantec Security Response has created a tool to remove W32.Sobig.E@mm.


References

Symantec Security Response
http://www.sarc.com/avcenter/venc/data/[email protected]

 

Featured Analyses
from Symantec DeepSight Threat Management System
http://tms.symantec.com/

Fu Rootkit Analysis

Fu is a kernel rootkit created for Microsoft Windows NT4, Microsoft Windows 2000, and Microsoft Windows XP. By directly accessing Windows kernel data structures, Fu creates an effective avenue of clandestine access, which attackers may use to conceal their presence and perform operations with elevated privileges on a compromised system.

Manifesting itself in the form of a device driver, Fu is especially dangerous because it modifies the behaviour of the underlying operating system at the lowest possible level. Once deployed, operations performed via this utility may be extremely difficult to detect.


Spybot version 3 Analysis
Spybot, also known as Milkit, is an open source trojan that contains several mechanisms of propagation. Spybot can spread using file sharing applications and vulnerabilities in other trojans as propagation vectors. Spybot will attempt to take control of systems that were previously compromised and are running the Sub-Seven or Kuang2 trojan. An infected system will connect to an Internet Relay Chat (IRC) channel and wait for the attacker to issue instructions. Once a system has been infected, that attacker will have complete control of the system via IRC.

An attacker can modify the Spybot source code to create a trojan that will meet the attackers needs. The customisable nature of Spybot can result in dynamic behaviour and unique binaries, which can make detection and removal a complex task.


W32.Illpatient IRC-based RAT Analysis
W32.Illpatient is an IRC-based Remote Access Tool (RAT), written in C, which runs on the Win32 family of operating systems. It was obtained from a compromised Symantec DeepSight Honeypot and was found compressed with UPX.

This utility was loaded onto a compromised Symantec DeepSight Honeypot, with what may have been a scripted installation routine, as this utility does not appear to be capable of propagating automatically.

W32.Illpatient receives commands from its owner through Internet Relay Chat (IRC). During startup, it connects to a hard-coded IRC server, and joins a private, keyed channel. Although W32.Illpatient contains several features, including a Denial of Service (DoS) routine, testing has indicated that it is not very stable.

 

Top Malicious Code Threats


Risk Threat Discovered Protection  
4

W32.Bugbear.B@mm

4 Jun 2003 5 Jun 2003  
4

W32.Klez.H@mm

17 Apr 2002 17 Apr 2002  
3

W32.Sobig.E@mm

25 Jun 2003 25 Jun 2003  
3

W32.HLLW.Fizzer@mm

8 May 2003 9 May 2003  
3 W32.SQLExp.Worm 24 Jan 2003 24 Jan 2003  
 

 

Latest Malicious Code Threats


Risk Threat Discovered Protection  
2 W32.Vivael@mm 28 Jun 2003 28 Jun 2003  
2 W32.Klexe.Worm 27 Jun 2003 28 Jun 2003  
2 W32.Mumu.B.Worm 26 Jun 2003 26 Jun 2003  
1 W32.HLLW.Lovgate.L@mm 25 Jun 2003 25 Jun 2003  
1 W32.Yaha.T@mm 24 Jun 2003 25 Jun 2003  
 

 

Common Vulnerabilities


Microsoft IE MIME Header Attachment Execution Vulnerability
Bugtraq ID CVE Reference Exploited by
2524 CVE-2001-0154 W32.Klez, W32.Sobig, W32.BugbearW32.Yaha, W32.Nimda, W32.Lirva
     
MS IIS/PWS Escaped Characters Decoding Command Execution Vulnerability
2708 CVE-2001-0333 W32.Nimda
     
Microsoft IIS and PWS Extended Unicode Directory Traversal Vulnerability
1806 CVE-2000-0884 W32.Nimda
     
Microsoft Windows 9x / Me Share Level Password Bypass Vulnerability
1780 CVE-2000-0979 W32.Opaserv
     
Microsoft SQL Server Resolution Service buffer overflows allow arbitrary code execution
5311 CAN-2002-0649 W32.SQLExp.Worm
 

 

Security News

PetCo Plugs Credit Card Leak
By Kevin Poulsen Jun 30 2003
Pet supply site offered more than kitty litter and flea collars. ... >>


AT&T lets phone fraud victims off the hook
By�  Kevin Poulsen Jun 25 2003
The company will abandon its efforts to collect on four-figure phone bills left by a voice-mail cracking scheme. ... >>


 

Useful Links

 

Incorrect MIME Header Can Cause IE to Execute E-mail Attachment


Virus Removal Tools
Fix tools for threats such as W32.HLLW.Lovgate , W32.SQLExp.Worm , W32.Sobig.A@mm and W32.Bugbear@mm


Virus Hoaxes

There are many email virus hoaxes, please check here before forwading email virus warnings.


Joke Programs

Joke programs are not malicious and can be safely deleted.

 

Security Events Calendar

SANSFIRE 2003
July 14-19, 2003
Washington, DC, USA.

http://www.sans.org/sansfire03/


Department of Homeland Security IT Security Conference
July 9-10, 2003
Baltimore, MD, USA
VB2003 - VB Conference 2003
Sept 25-26, 2003
Toronto, Canada
http://www.virusbtn.com/conference/vb2003/index.xml
AVAR 2003 - Malicious Code Conference 2003

November 6-7, 2003.
Sydney, Australia

http://www.aavar.org/

 

Security Advisories

FastTrack P2P Supernode Packet Handler Buffer Overflow Vulnerability

Risk :High

Date :26th May 2003

Components Affected: Many, listed here;

http://securityresponse.symantec.com/avcenter/security/Content/7680.html

Overview

FastTrack P2P Supernode Packet Handler has been reported prone to a buffer overflow vulnerability. The issue presents itself in the FastTrack Supernode packet handler. The handler does not perform sufficient bounds checking on supernode entries received before they are copied into a reserved buffer in internal memory.


An attacker may exploit this vulnerability to trigger a denial of service condition or ultimately have arbitrary attacker supplied code executed. Code execution would occur in the context of the user running an application that incorporates the vulnerable FastTrack P2P Packet Handler.

 

It should be noted that this vulnerability has been tested on KaZaA version 2.0.2. Other versions of KaZaA and similar file-sharing clients based on FastTrack P2P technology may also be affected.

Recommendations
Block external access at the network boundary, unless service is required by external parties.
If applicable, block all incoming FastTrack P2P based traffic at the network boundary.

Credits

Discovery of this vulnerability has been credited to random nut <[email protected]>.

References
Source: Grokster Homepage
URL: http://www.grokster.com/

Source: iMesh Product Homepage
URL: http://www.imesh.com

Source: KaZaA Homepage
URL: http://www.kazaa.com/

Source: Morpheus Homepage
URL: http://www.musiccity.com

Symantec Security Response

http://securityresponse.symantec.com/avcenter/security/Content/7680.html


PMachine Lib.Inc.PHP Remote Include Command Execution Vulnerability

Risk :High

Date :15thJune 2003

Components Affected
PMachine PMachine 2.2.1

Overview

It has been reported that PMachine does not properly handle include files under some circumstances. Because of this, an attacker may be able to remotely execute commands.


Recommendations

Block external access at the network boundary, unless service is required by external parties.


Filter untrusted network traffic at border routers and network firewalls.

Running the server in a closed or restricted environment may limit the consequences of successful exploitation. Execute server processes with the least privileges required, and place processes in a restrictive environment.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] .
PMachine PMachine 2.2.1:

Credits
Discovery credited to "Frog Man" <[email protected]>.

References
Source: SecurityFocus
URL: http://www.securityfocus.com/bid/7919/info/

Source: PMachine Homepage
URL: http://www.pmachine.com

 

Internet ScamBusters

Internet ScamBusters (tm)
The #1 Publication on Internet Fraud

By Audri and Jim Lanford
C o p y r i g h t (c) 2003 Audri and Jim Lanford.
All rights reserved.

Issue #64  July 16, 2003

Hi everyone:

This Special Issue of ScamBusters (which is short) includes
info on the Do Not Call Registry, a new Telemarketing scam and
an important update to the last issue.

Reminder: If you haven't yet done this, it is VERY Important:

We are moving list servers. In order to continue receiving
Internet ScamBusters, we ask that you go to the link below to
remove yourself from the old server, and then follow the link
on that page to subscribe on the new list server.

http://scambusters.org/new/new.html?id=300070&[email protected]

We'd appreciate if you'd do it now -- it only takes a moment.
Thanks so much.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Special Telemarketing Issue
++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Do Not Call Registry

It's become very clear that US consumers are completely fed up
with telemarketers.

More than 3.4 million people visited the new DoNotCall.Gov Web
site on the day it launched, June 27, 2003. Twenty-three
million people had signed up by July 11!

The new National Do Not Call Registry was created by the
Federal Trade Commission (FTC) to allow consumers to register
their phone numbers in a national database with the goal of
limiting telemarketing calls.

There are two ways to register: online or by phone.

Online is easier. Simply visit:

==> http://www.donotcall.gov

You will need to provide an email address so you can get a
confirmation email when you register.

To register by phone, you must call from the phone you wish to
register in the directory. Call 888-382-1222.

You must register by August 31, 2003, to be included when the
program goes into effect on October 1, 2003. Thereafter, you
will be included in the Registry three months after you
register.

Registration lasts for five years or until your phone number
is disconnected. You may also un-register a number if you wish
(although we don't know why you'd want to).

Unfortunately, the Do Not Call Registry won't stop all
telemarketing calls. The loopholes include:

- Political organizations.

- Charities.

- Telephone survey calls.

- Companies with whom you have a "prior business
relationship."

Cell phones may be registered. Business phone numbers may NOT
be registered.

There are stiff penalties for companies that do not comply.
You can get more information, including how to file a
complaint, at:

==> http://www.donotcall.gov/FAQ/FAQConsumers.aspx

We signed up right away and recommend you do the same if you
want to eliminate many of the telemarketing calls you receive.
We predict one downside: some companies that can no longer
telemarket will increase their use of spam.

~~~

New Nigerian Fee Telemarketing Scam

It was bound to happen: A new variant of the Nigerian fee scam
is being spread via telemarketing. Last week someone called
and said they were trying to send us a fax. They asked for our
fax number.

When Audri asked who was calling, the caller said, "It's about
a payment."

When she asked, "What kind of payment?"

He responded: "A payment to you." Then he asked her, "Who is
this?"

She asked again, "Who is this?" without answering. After a bit
of going back and forth, he finally said, "It's a fax from the
Office of the President of Nigeria." At that point, she hung up.

So, be very careful about giving out your fax number when
someone calls and says they are trying to send a fax.
Otherwise, you may well be giving your fax number to scammers.

As we were getting ready to send this Special Issue, we heard
about another new variant to this scam:

Apparently, scammers are now visiting business and financial
chat rooms. After some interaction, they tell you they want to
deposit millions of dollars into your bank account (this time
from a bank in Iraq).

It doesn't matter how scammers find you (spam, phone, fax,
chat room, etc.). Or what country they're from (Nigeria,
Congo, Iraq, etc.). Or why they want to give you the money
(contract issues, they prayed and found your church was the
answer, someone died, etc.).

Here's the important point: If a stranger wants to deposit
millions of dollars into your bank account, it's almost
certainly a scam.

~~~

Another Identity Theft and/or Credit Card Scam: The
Massachusetts Lottery Scam

Here's another spam scam similar to those we described in the
last issue:

Imagine getting an email saying you've won $30,000 from the
Massachusetts Lottery. You are directed to the "official" Web
site of the Massachusetts Lottery at mass-lottery.org. (This
site has been taken down.)

The real official Massachusetts Lottery site is at:

==> http://www.masslottery.com/

What is different and somewhat convincing is that this email
includes a user name and password that supposedly allows you
to claim your prize.

The home page of the fake site did look authentic.

However, the page you went to when you logged in to collect
your prize was very different. This page contained many
spelling and grammatical errors.

Even worse though, is that this page includes the scam. You're
told, "If you are a US resident, not a resident of the State
of Massachusetts, you'll br (sic) required to pay the
US$500.00 gaming tax. If you are receiving from outside the
united states (sic), you will have to pay US$100.00 foreign
gaming tax."

Naturally, they ask for your credit card number, social
security number and other personal information.

What to do if you get this kind of email: First, realize it is
probably a scam. It's unlikely that you will be notified by
email if you win the lottery. More important, lottery
organizations never ask you for credit card information.
Lottery tickets are purchased via cash.

Most important: Do not give your credit card number, social
security number and other personal information to any Web site
that you visit from spam.

Finally, you might be interested in Les Christie of CNN/Money's
excellent article called "Burden of spoof," which is more
about how scammers use fake Web sites to steal your credit
card number and your identity:

==> http://money.cnn.com/2003/07/14/pf/saving/spoofing/

~~~

Enjoy the rest of the month -- scam-free.

----------==========**********O**********==========----------

SecurityPortal's Weekly Newsletter

NONE

INTERNET WORLD NEWS

NONE

eWEEK

NONE

Search Engines

 

 

 

 

 

 

 

 

 

 

 

 

RETURN TO TOP OF PAGE

copyright � 2000, 2001, 2002 & 2003 by Frank Cross.
All rights are reserved