Facebook Email Spoof Contains Trojan Horse

Websense® Security Labs(TM) ThreatSeeker(TM) Network has discovered a new malicious social-engineering spam campaign masquerading as official emails sent by the popular Web 2.0 social-networking site, Facebook. The email is spoofed to appear from the domain facebookmail.com, an official domain used by Facebook for their outbound emails when notifying their users of an event.

It is common for Facebook to send an email to notify their users when another Facebook user adds them as a friend on the social network. However, the spammers included a zip attachment that purports to contain a picture in order to entice the recipient to double-click on it. The attached file is actually a Trojan horse.

A login page to Facebook is included in the body of the email. We have previously alerted on our discovery via our HoneyJax system about a viral Facebook phishing campaign, and thus would not be surprised if the login page presented was merely a fake front to a phishing site. However, an examination of the HTML form's source code shows that it was indeed passing the user name/password to Facebook itself. This may be to increase the legitimacy of the email to evade reputation-based spam filters.

To view the details of this alert, click here.

Spammers Automatically Creating Hotmail And Yahoo Accounts

BitDefender researchers found that spammers are easily bypassing the captcha system, to automatically set up new e-mail accounts to use to send out waves of spam.

By Sharon Gaudin, InformationWeek

Spammers have a new trick up their sleeves. According to researchers at BitDefender Labs, spammers are automatically creating Yahoo and Hotmail accounts, and using a Trojan to help them send waves of spam. The spammers, according to the security company, have figured out how to outwit the "captcha" security system. That's the one which won't allow a new e-mail account to be created until the creator correctly types in the twisted letters depicted in an image.
A piece of malware, Trojan.Spammer.HotLan.A, actually has been set up to access the e-mail accounts, pull down encrypted e-mails from another site, unencrypt them, and then send them to e-mail addresses stored in yet another Web site. "They've found a way to bypass the captcha system by using optical character recognition," said Vitor Souza, a manager at BitDefender, in an interview. "The software reads the images and transforms it into text. Once it bypasses the captcha system, it enables them to automatically creates the e-mail accounts." Souza said the automatic system creates accounts extremely quickly. "It's beyond what we've ever seen before," he said, adding that it can create 500 new e-mail accounts every hour and up to 15,000 a day.
"With this kind of speed, they can send spam from thousands of different accounts and that's a lot more resources for them," he added. "[Companies] have to look at this new threat," said Souza. "The captcha system has become a norm in the industry for setting up e-mails and different kinds of accounts. Responsible companies, like Yahoo and Hotmail, will have to find a way to fight this through more sophisticated security systems or they're going to have to find a new system all together." The spam is set up to currently lure unsuspecting users to a site that advertises pharmacy products, BitDefender researchers said.

Redmond Readers Pick Their Fave Tools of 2007

You voted and the results are in: Find out which products you've chosen as the cream of the crop.

By Lafe Low / SECURITY WATCH

FIREWALL: HARDWARE-BASED
The Cisco Systems PIX series has proved it can consistently evolve and continues to win in this market. It wins here with a 38.8 percent vote. Ease of use, ease of integration and its position as the de facto industry standard were all frequently cited as reasons for choosing Cisco. "Cisco has been in the game a long time and knows what to do when protection is needed," says Bud Moore of the Tracer Corp.
SonicWALL's TZ and Pro series firewalls brought in a 10 percent vote, while Symantec's Velociraptor earned 7.7 percent.

FIREWALL: SOFTWARE-BASED
Microsoft's ISA Server is the clear winner with 22.2 percent of the votes. After ISA Server's dominance as a software firewall, Check Point and Symantec are in a fairly close matchup, earning 15.8 and 14.5 percent, respectively. Check Point, emerging as the ISV Winner, wins points for being easy to remotely manage, says Ralph Hoefelmeyer. McAfee Personal Firewall Plus brought in 8.3 percent.

INTRUSION DETECTION SYSTEM
Cisco Systems' Cisco Secure IDS is a decisive winner with 20.9 percent of the votes. Open source alternative Snort brought in a 13.1 percent vote. BlackICE Pro, from Network ICE, earned 6.8 percent.

INTRUSION PREVENTION SYSTEM
Cisco Systems also takes the IPS category with its Cisco Security Agent bringing in a 15.4 percent vote. Network Associates IntruShield is up next with 7.3 percent. The next spot is a tie between Symantec ManHunt and Internet Security Systems, each earning a 5.1 percent vote.

SMART CARD/BIOMETRIC/TWO-FACTOR AUTHENTICATION SYSTEM
RSA ran away with the votes for Best Smart Card Authentication System with its SecureID earning 35.3 percent. It helps that they've been around for such a long time and have refined the product and developed a solid reputation. "They're a trusted vendor and it's a workable product that limits false positives and false negatives," says independent consultant Chris Apgar. DigitalPersona brought in 3.5 percent and the next place was a 3.2 percent tie between ActivCard Trinity and Griffin Technologies SecuriKey Pro.

SECURE MESSAGING TOOL OR SERVICE (SPAM AND CONTENT FILTERING)
Microsoft Exchange Server takes this category with a 17.6 percent vote. The ISV Winner is Symantec with a 7.8 percent vote. Microsoft Defender (now Forefront) earned 4.7 percent and Barracuda Networks' Spam Firewall brought in 3.8 percent.

ANTI-VIRUS
Symantec also took a commanding lead in the anti-virus category, thanks to its Anti-Virus tool, which earned 33.8 percent of the vote. "It catches virtually all viruses in real-time and requires very little maintenance," says Dan Roach, IT manager with Dunn Engineering Associates. McAfee's GroupShield took 14.9 percent and Trend Micro 11.4 percent.

ANTI-SPYWARE
McAfee takes top honors here with 15.1 percent of the votes, with Trend Micro Anti-Spyware trailing closely behind with a 12.1 share. Webroot places again with a 9.7 percent vote.
* Excerpted from "Star Power: Redmond Best of the Best Readers' Choice Awards 2007," in the April 2007 issue.