Wednesday, January 27. 2010Sunday, January 24. 2010Google AdWords being targeted by Phishers
A new stream of phishing emails aimed at user using Google Adwords have been noticed. The ongoing practice of phishing for personal information, especially financial details like credit card numbers makes this kind of crime low risk with high gain for the criminals.
 Phish mail Google's online advertising brings a high level of attention from criminal spammers. User using Google Adword are cautioned not get lured by such email and provide financial details.  Phish site Quick Heal browser protection will automatically block the users from visiting this fraudulent website automatically. Saturday, January 23. 2010Indian Income Tax Department Phishing Site
Today I received an unusual email which was supposedly sent by "Indian Income Tax Department" indicating that I am eligible to receive a tax refund of Rs. 820.50. Below is the image giving idea about how the email looked like.
 This reminded me of fake Income Tax Refund website that had made the rounds in October 2009. After properly examining the contents and the link of the website it was clear that its a phishing attempt. The link is in the email is pointing to the website that is hosted on some US sever. The website has similar look and feel of that of Indian Income Tax Department website. Here is the screenshot that gives idea about how the phishing website is looking.  The fake website has most of the other links to original Indian government website. Only the link of ‘Tax Refund Online Form’ is pointing to the fake phishing web page that has URL http://yoymrete .com/ iti/profile.php On this page the attacker is asking for users personal details along with the credit card details and bank details including ATM pin and CVV no. Here is the screenshot of the page that asks for bank and credit card details.  We recommend all readers to be careful and do not visit this fraudulent Income Tax Department website. To check for income tax refunds if any or any thing related to income tax please visit the Indian government website using the below link. http://www.incometaxindia.gov.in/ Quick Heal browser protection will automatically block the users from visiting this fraudulent website automatically. Friday, January 22. 2010Wednesday, January 20. 2010Tuesday, January 19. 2010Monday, January 18. 2010Buffer overflow in QuickTime A remotely exploitable vulnerability in QuickTime has been discovered. Information on vulnerable version of QuickTime available on Bugtraq 32540The vulnerability can be exploited by malformed .mov files. The latest version of QuickTime is not affected by this vulnerability. Saturday, January 16. 2010Wednesday, January 13. 2010Tuesday, January 12. 2010Possible Android based fake applications New Google Android based mobiles phone are being released one by one and the trend of fraudulent android applications has started to surface.Among the several applications that were available on Android Market, it was observed that few moblie banking applications were providing the facility of just connecting the user to mobile banking website of the bank. Unsuspecting users downloaded the applications on to their new Android phone and started to use the applications. It is now observed that the banking applications were not released by the bank and are posted by some third person on Android Market. These applications were immediately removed from the Android Market. Our advise to users is to avoid using third party applications for any banking or financial related use which are not released or authorized by the bank itself. It is not difficult for these fake applications generators to steal the users login password and PIN while you are entering them in the application to connect to the banking website. So play around the new OS and applications but not by providing critical access credentials.. 
Tuesday, January 12. 2010One more phishing attack on Indian bank
After the holiday season is over and people resumed their office with new year work load ahead, it all started with phishing scam on one of the India's popular nationalized bank. Since 8th January I had been observing that I had been receiving phishing emails targeting Punjab National Bank of India. The email looked as follows:
======================= Subject: Important Notification From Punjab National Bank Dear Valued Customer, This is an official notification from Punjab National Bank . Your account access has been limited due to a login attempt failure. To restore your account we have attached a form to this email.Please download the form and follow the instructions on your screen. NOTE: The form needs to be opened in a modern, javascript enabled, browser (ex: Internet Explorer 8, Firefox 3, Safari 3,Opera 9). We are continually improving our Web site to better serve you. Be sure to check back with us often as we add exciting new services to meet your financial needs. If you have questions or need assistance, our customer service team is here to help. Thank you for using Punjab National Bank ! =========================================== There were lot of signs that indicated it was a spam email for targeted phishing attack. One can see that this specific message was sent to "undisclosed-recipients" and starts with "Dear Valued Customer,". I knew it was a spam as they have not addressed the email to me even though they have my complete details. The message is short and OK, and the link it refers the receiver to isn't going to a bank domain at all, it points to: hxtxtxpx:x/x/x7xsearch.com/scripts/search/click.aspx?t=p&qu=204.249.69.25/in d.htm&a=0 &s=sb&r=1&du=http%3a%2f%2f2x04.249.69.25/ind.htm&cu=http%3 a%2f%2f204.249. 69.25/ind .htm which further takes the browser automatically to: htt p: // 2x0x4.249.69.25 / ind.htm (this is US based server) and further redirection happens automatically to: http://x6x1.181.83.65 /ind /pnbindia / index.php (this is China based server) On this server the fake PNB phishing website is hosted. The phishing site looks identical to the original website, only the link is different. Here is a sample screenshot:  Quick Heal Anti-Phishing plug-in is protecting users from visiting this fraudulent website. We are keeping watch on the new modifications to this on going threat. On 9th Jan we received around 6 such emails with various message in email. On 10th we did not received any message as I guess the hacker/attacker took weekly off on Sunday. On 11th Jan we again received 12 mails of PNB phishing attack. Today its 12th Jan and we have received 5 more emails of this phishing fraud. During all these days the attacker has been changing the redirection server that redirects users to his phishing website as the older pages are being deleted on the web server by the ISP. More details as it appears.. |
ArchivesCalendarSyndicate This Blog |
