Sophos Smells Super-Sized Spam Stock Scam

Bit of a mouthful title, and no – it isn’t mine!  However, it is worth noting that there is a significant increase in spam emails out there (that may or may not make it through the filters in place to your inbox) trying to encourage you to buy stock, particularly given the current financial markets.

What is continuously surprising to me, is that people keep falling for these scams.

(Edit – actually, I missed the date on this article, and it was from October 07, rather than 08.  I got confused, partly by the date, and partly because I was getting heavily hit with stock spam at the time).  Oh well, we all have the occasional slip)

Sophos Article here.

Legitimate Emails

According to Sophos, currently only email in 28 is legitimate.

So the next “unbelievable” offer, request for your account confirmation, “I really want to meet you”, “I have funds I need to get out of the country” etc etc email you get in your inbox, you might want to think twice (or more) before blindly acting upon it.

Thank goodness for spam filtering, but even so, a number always gets through, and potentially, these are the smarter ones that you really need to watch out for, as they may pose as something quite legitimate.

That isn’t to say you should stop reading emails, but like ‘they’ say: “don’t believe everything you see on TV”

msnbc.com Breaking News

If you have received any emails like the following, do yourself a massive favour, and delete them immediately.  There is nothing legitimate about the news item, or especially the included links, and by clicking on any of the links (including the unsubscribe one), you are inviting all manner of evils into your computer.  Our security officer will expand on this in the near future, but in the meantime – be careful out there!

(I don’t remember ever signing up to msnbc.com – did you?  So why would an unsolicited email from them be legitimate?  Apply this same thought process to all emails because it is a minefield, and you only have to step in the wrong place once.)

Email content to follow:

msnbc.com: BREAKING NEWS: Early Morning Coffee Conversation Entices Normally Flavorless Office Staff

Find out more at http://breakingnews.msnbc.com
======================================================
See the top news of the day at MSNBC.com, and the latest from Today Show and NBC Nightly News.

=========================================
This e-mail is never sent unsolicited. You have received this MSNBC Breaking News Newsletter
newsletter because you subscribed to it or, someone forwarded it to you.

To remove yourself from the list (or to add yourself to the list if this
message was forwarded to you) simply go to

http://www.msnbc.msn.com/id/32951920, select unsubscribe, enter the
email address receiving this message, and click the Go button.

Microsoft Corporation – One Microsoft Way – Redmond, WA 98052
MSN PRIVACY STATEMENT
http://privacy.msn.com (http://privacy.msn.com/>)

The Mythbusters of Email Hoaxes

When it comes down to it, the number of legitimate emails in the world are vastly outnumbered by the illegitimate ones. There are the spam ones, the phishing ones, and a small (but annoying) collection that are simply deliberate hoaxes, which may or may not have been sent with any specific malice, but still cause the less naive to question the legitimacy of any email received (particularly those that are forwarded on), and the more naive to simply believe everything that floods into their inbox.

I have no reason to specifically trust any of the “anti-hoax” websites either – what if one (or more) of those had been set up to legitimise hoax emails, or cast doubt on legitimate ones?

However, in saying that, I still find it useful to check a few when I receive a hoax email, to get an idea of its true source, and age. Many of these emails have been around for years, perhaps occasionally receiving a bit of a dust-off and a new coat of paint.

Hoax-Slayer is one such site. I don’t know its legitimacy, but it seems at first glance to be legitimately targetted. I’m sure there are many others.

Example of an Email Phishing Scam

This arrived in my inbox the other day, and is a perfect example of a phishing attempt (phishing – setting out a lure / bait and hoping someone bites (and sends in personal information – passwords, credit card numbers etc)

Subject: Global Email Alert
From: Global Email {Monash Email Solution} <helpdesk@monash.edu.au>
Reply to: monashhelpdesk@live.com

X-Mesa de Concertacion-MailScanner-Information: Please contact the ISP for more information
X-Mesa de Concertacion-MailScanner: Found to be clean
X-Mesa de Concertacion-MailScanner-SpamScore: s
X-Mesa de Concertacion-MailScanner-From: helpdesk@monash.edu.au X-Spam-Status: No Dear Student/Staff Due to the recent development on the circulation of email from outside the school in request of your first name, username and password, we did advise you ignore the message and remove it from your email account because it is a HOAX not from the school but from outside source trying to gain access to your private message. With regard to this development, we advise you respond to this email with the following information of your yours so that we can carry out a complete over-hauling our database and enhance security on your email account:

Your Department:{*********}

Your Complete Name:{********}

Your Username:{***********}

Your Current Password:{**********}

Your Current Possition In School :{********} STAFF ONLY

Your Current Level In school:{********} STUDENT ONLY

Upon verification of the above information, an email will be sent to you from this office on the next step to take to make sure that your email is well protected from outside intruder. Regards Global Email Center.

–
Este mensaje ha sido analizado por MailScanner
en busca de virus y otros contenidos peligrosos,
y se considera que está limpio.
For all your IT requirements visit: http://www.transtec.co.uk

There are a number of subtle clues as to why this is not genuine – see how many you can find, and also just think – if you got this in your inbox, would you have picked it at first glance or not?

The Reply-All Button

I’m increasingly of the opinion that a world-wide petition should be started to have the “Reply-All” button in email clients (such as Outlook, Thunderbird etc) removed, or at least buried to make it difficult to use by accident.

After receiving yet another couple of emails from lists that I am on where someone has mindlessly “Reply-All”‘ed to everyone, rather than just directly to the person they wanted to email (and attached personal information (one of these days someone is going to provide the world with their credit card or banking details – I’m sure of it)) I have come to the conclusion that people are just not competent enough to have access to such a tool.