Symantec releases March Spam and Scam Trends

Even though scams don't all originate on the Internet, a great majority of them do. If you ever want to figure out what scams are making their rounds, taking a look at spam analysis is a pretty good way of doing it.

Spam is the vehicle that most cyber misfits seem to prefer when trying to pull a fast one on the unwary. Fortunately, most of them are far from geniuses and all it takes is a little awareness to foil their attempts at trickery.

Of course, providing a little body armor for your system is highly recommended, also. Especially, if you are a Windows user.

Please note that when providing body armor for your system to make sure you are buying it from a reliable vendor. I see spam come-ons for so-called computer security software that might turn your system into a spam spewing zombie, steal all the information from it, or a combination of both.

Last week, Symantec released their March report. This report is a good resource to use to see what is going on in the wild world of spam, scams and malicious software.

Kelly Conley writes:

Social engineering was the driving force behind spammers during the month of February. While overall spam volume hovered steadily at 78.5% of email and tactics remained relatively the same, the use of events, big brands, and public figures drove spam campaigns during the month. The March State of Spam report highlights several of these.

Kelly brings up another point -- which is that despite the fact that scams frequently use technology as a tool -- they also rely on a healthy a dose of social engineering (trickery) to accomplish their intentional misdeed.

Predictably, the presidential candidates are a big lure:

Last month, spammers began to spread bogus links purporting to show a Hillary Clinton speech, but in actuality the links were cloaking a malicious Trojan. Most recently we’ve seen spammers leveraging the last remaining front-runners of the 2008 presidential elections; Obama, McCain, and Huckabee. Just what are spammers linking the candidates with? Everything from Viagra, porn, get-rich-quick schemes, and portable dewrinkle machines.

If you think about it, this shouldn't surprise very many of us. After all, the candidates are filling up our mailboxes with a lot of political spin and requests for financial support, also.

It's probably a good idea to be careful when clicking on a link in any unsolicited messages. Especially, when over 75 percent of all e-mail sent is spam.

Of course, politicians aren't the only human lures spammers use. Celebrities are pretty good "spam fodder," also.

The presidential candidates aren’t the only targets. Also seen were high profile names such as Michael Jackson, Heather Mills, and Indiana Jones to name a few. Spammers are using these names to spread malicious links to videos and the names being circulated are all currently high profile. Who hasn’t heard of the McCartney/Mills divorce or Britney Spears’ woes? The spammer is banking that you want to know more about these celebrities and are therefore leveraging their names to tempt you into opening the malicious link. These are fairly easy to spot because in most cases the names are misspelled. I wonder what Paul McCartney would think of his name more closely resembling a martini (Maccartni)?

It never ceases to amaze me that spammers can't spell. A common demoninator in most scam letters is that a lot of words are misspelled. Especially, the variety that orginate out of Internet cafes in third world countries.

Other notable trends in the lures being used are International Women's Day and (too good to be true) offers of free tickets from Southwest Airlines.

The monthly reports normally includes an amusing, or not so amusing (reader's choice) "hall of shame" category. This month the mortgage crisis is being used, with a sick twist:

As economic conditions have slowed in recent months, Symantec has observed a torrent of spam messages encouraging users to “refinance before its too late,” ”take out a mortgage for the lowest APR ever,” or “this is the time to be the proud owner of your house.” While the deluge of finance spam continues, spammers have also decided to diversify their sales portfolio to include the buying and selling of burial plots. Talk about an idea to get out from being buried, no pun intended. As the message indicates, the U.S. national average price for a burial plot in 1978 was $200 and this has risen to $4500 in 2008. “Get started today” – adverts say – “because tomorrow could be too late”.

In case you missed the link to the full report (above), it can be seen (with some interesting screenshots), here.

Fine Wine and Identity Theft?

What do fine wine and identity theft have in common? According to the FTC's top cities for identity theft, the answer is Napa, California.

Christopher Null blogged about this on Yahoo:

While you're sipping Chardonnay and enjoying the beauty of the wine country, crooks may be busy swiping your identity. According to a Federal Trade Commission study, Napa, California, earned the title of worst town for identity theft, with over 300 consumer complaints per 100,000 residents in 2007.

Madera, California, (280 complaints per 100,000 residents) and Greeley, Colorado, (228 complaints) followed Napa on the list. On a state level, California (120 complaints) was surpassed by only Arizona, which had the worst per-capita trouble with identity theft (137 complaints).

I decided to go to a more local Northern California source and found that Channel 10 News out of Sacramento/Stockton/Modesto covered the story, also.

Cornell Barnard (News 10) reports:

Stockton ranks number 21 out of 50 on the Federal Trade Commission's list of the worst cities for identity theft complaints.

Stockton Police can't pinpoint why their city ranks so high, but the valley's trade take part of the blame, a constant hunger for cash.

"It's all connected. It's a brutal crime for those victimized," said Stockton Police spokesman Pete Smith.In addition to Stockton, Northern California is well-represented on the FTC list. Napa tops the list of U.S. metropolitan areas for identity theft consumer complaints, logging over 302 complaints for every 100,000 residents during 2007. Nearbly Vallejo and Fairfield rank sixth while the Yuba City area comes in 11th.

Interestingly enough, Vallejo and Fairfield are just over the hill from Napa and one of the entry points for the San Francisco Bay area. Yuba City is roughly just North of the Napa Valley. These cities aren't very far from Stockton, either.

Maybe this means, there is a higher incidence of Identity Theft in Northern California? Napa might be the worst because it is an affluent area and the better a person's credit is -- the more lucrative their identity is to a criminal.

Being a fifth generation, or so Northern California type (a lot of this blog is written from there), I'd like to point out that Northern California also hosts a lot of information to combat the identity theft problem. In fact, some of the best resources to protect and educate people originate from the area.

Sacramento, which didn't make the list is the State Capital. The Office of Privacy Protection is one of the better written information sources to educate people about the problem of identity theft. Please note the information on this site is available in English, Espanol and Chinese.

For the more frugal, this page contains all the information needed to protect a person without paying for one of those services with an alleged $1 million guarantee.

Interestingly enough, the State of California is also known as being pretty proactive when it comes to protecting the rights of victims. Many of the privacy laws enacted in California have had a worldwide impact.

A great place to read more about the problem is a document outlining Governor Schwarzenegger's 2005 Identity Theft Summit. This document includes a lot of perspective from privacy groups, law enforcement and business groups on the problem.

Last, but not least, a University of Berkeley professor, Chris Hoofnagle just issued an interesting paper based off information culled from the FTC about which financial institutions are most prone to making their customers a victim of identity theft. Professor Hoofnagle openly admits that the results might be jaded because they are only from a consumer complaint point of view and that most financial institutions seem to prefer not to release these statistics.

If your a more "visual type," Cornell Barnard's newscast on this story can be seen, here.

If you are one of those more "scholarly types," the full FTC report on this can be viewed, here.

Will counterfeit documents enable the next terrorist attack?

(Cartoon by Suad Leija. Suad is the artist, however the political opinions are those of her husband. More cartoons can be seen on her new site, here.)

With the 2008 election in full swing, most of the candidates seem content to dodge the issue of border security.

Tied into another controversial issue, which is illegal immigration, discussing it is probably considered a no-win situation. It's probably likely that no matter what stance they take, it will cost them votes.

Perhaps, the reason it's so controversial is that we are a country of immigrants and most of our ancestors came to this country to seek a better life.

In most cases, what we consider poverty in this country, is a far better standard of living than where they are coming from.

Businesses take advantage of this "cheap labor" (payroll is always a key expense in any business) and because of their illegal status, illegal immigrants don't tend to complain about low wages and no benefits.

Since illegal immigrants are human beings and get sick etc., the taxpayer normally ends up paying for all the social costs associated with their employment. This is a pretty good deal for the employers using this "in-sourced" form of labor.

If you really wanted to solve the illegal immigration problem, it would probably be pretty simple. All you'd have to do is go after the businesses hiring them.

If the process were more transparent, they would probably have to take care of the people, who work for them a little better, also.

The biggest problem with illegal immigration is that all sorts of criminals, and some say, people with political agendas (terrorists) can easily camouflage themselves in the worldwide exodus of people from poor and war-torn countries. The illegal immigration process is controlled by organized criminals, who only care if the person they are bringing in has the money to pay them.

If you think illegal immigration consists of only people from Mexico, this is no longer the case. More and more, they are coming from a lot of different places and illegal immigration is hardly a problem just in the United States.

Whether they are here to find work, commit crimes or plan the next 9/11 -- the first thing someone entering a country illegally needs to do is make themselves appear to be legal. The way they do this is by using counterfeit documents to establish a (seemingly)legitimate identity.

In the hands of terrorists, counterfeit documents are an enabler to murder innocent people because they were at the wrong place at the wrong time. Given that Atta and the 9/11 crew used counterfeit documents to establish themselves in the U.S., it amazes me that as I write this, the business in them is booming.

The story of Suad Leija has been covered extensively in the mainstream media. Suad is the stepdaughter of one of the prominent leaders of an organized counterfeit document cartel operating throughout North America. Suad met and eventually married an American businessman, with alleged ties to the intelligence community.

The businessman then tried to strike a deal with Suad's family to use their database to identify potential terrorists -- who had been provided counterfeit documents -- in exchange for the release of a prominent member of the family, who had been arrested in Chicago.

The operation took a turn when the cartel refused to provide this information and Suad ended up assisting the authorities in identifying the main players in the cartel, as well as, the scope of their operation throughout the United States.

There have been 38 arrests and the court case is still underway.

Please note that ties to an intelligence operation have not been confirmed by a government source. Nonetheless, if you've followed the story, this is probably a fairly good deduction.

I wouldn't expect the government to confirm, or deny this story. Revealing details about intelligence operations compromises their efforts. This is probably why the intelligence community is and always will be the unsung heroes in the "War against Terror."

Charlie Wilson's War, the Tom Hanks movie, although probably a little "Hollywood" in nature is probably a good example of how a few good intelligence types can make a big difference. True stories, such as this one, normally are only officially confirmed years after the fact.

Just the other day, Newsweek released an update to the Suad story, with more details about the operation.

Joe Contreras (Newsweek) writes:

When federal prosecutors indicted 22 members of the Leija Sánchez counterfeit ID organization in Chicago last April, they described the arrests as "a significant setback" to one of the largest criminal enterprises of its kind ever to operate in the United States. But they made no mention of Suad Leija and the remarkable tale of how her marriage to an undercover American agent and her choice of country over family led to the downfall of the fake-document ring. Suad began cooperating with the U.S. Immigration and Customs Enforcement (ICE) agency in January 2006 and gave investigators the names and addresses of her stepfather's siblings and top lieutenants, who had been photographed while under surveillance by the Feds. Her decision to aid ICE officials, she says, grew out of concern that the fake green cards, driver's licenses and Social Security cards churned out by her family's document mills could be used by terrorists to stage another devastating attack on American soil. "Just as I wouldn't help a drug peddler sell narcotics to kids, there's no way I'd do it for terrorists who want to use fake identification produced by my family," Suad told NEWSWEEK in a phone interview from an undisclosed location. "If another September 11 were to happen and I'd done nothing to stop my family, then I would be just as guilty."

The Newsweek story also points out that these counterfeit documents are hardly being only sold to illegal immigrants, who want them to get a job:

Senior ICE officials also see the booming fraudulent documents business as a bona fide threat to national security. The industry generates annual revenues in the hundreds of millions of dollars, and its primary markets are the estimated 12 to 20 million foreigners living illegally in the United States and teenagers wanting to sneak into a bar. But some of the 9/11 hijackers obtained legitimate ID documents under false pretenses, and a terrorist suspect linked to Al Qaeda named Nabil al-Marabh allegedly produced fake ID documents at his uncle's print shop in Toronto prior to the attacks on New York and Washington. Though the clientele of the Leija Sánchez ring was overwhelmingly Latin American in origin, federal prosecutors say that documents were sold to Algerians, other Arabs and Pakistanis. "That's where the vulnerability is," says James Spero, a deputy assistant director in the ICE office of investigations. "You can buy a set of documents that will make it appear you are legally in the U.S. for as little as $100, and nobody in these organizations does background checks on their customers."

The article ends with the conclusion by Mr. Contreras based on interviews with ICE officials:

ICE agents have arrested 38 members of the Leija Sánchez organization to date, and from his Mexican prison cell Manuel is currently fighting extradition to the U.S. His old business associate Pedro Castorena was flown from Mexico to Denver last month to stand trial later this year on fraud, conspiracy and money-laundering charges, and Suad is expected to testify for the prosecution. But as the decline and fall of Pablo Escobar's Colombian Medellin cartel proved in the 1990s, the decapitation of a criminal organization's leadership will not disrupt the industry as long as there is strong demand for its product. And as of this week, ICE officials reported no decline in the availability of bogus documents on the streets of any major U.S. city.

Not mentioned in the Newsweek article is that the lead ICE agent on this case, Cory Voorhis, was arrested and is being charged with "exceeding his unauthorized access to a federal criminal database."

Voorhis and his legal team contend that he was only exposing plea bargain practices that allowed illegal immigrants charged with serious crimes to not be deported by the Denver DA's office.

Please note the crimes in question are a little more serious than just crossing the border without the right documentation.

Some are comparing this case to another case, which has received a lot more attention in the media. As stated on his legal defense site:

There are troubling parallels with the 2005 prosecution in El Paso, Texas of two Border Patrol agents, Ignacio Ramos and Jose Compean. Ramos and Compean were convicted of shooting a fleeing drug smuggler primarily on the testimony of the drug smuggler himself, who was granted immunity by the US Attorney. It has since been revealed that the US Attorney knew of the smuggler’s long criminal history yet succeeded in withholding this evidence from the jury.

A news release from his legal defense site stated that this might jeopardize the current prosecution of the Castorena-Leija counterfeit documents cartel.

From the news release:

The federal prosecution of Cory Voorhis, the Immigration and Customs Enforcement (ICE) agent who is charged in a high-profile case with three federal misdemeanors for allegedly illegally accessing a restricted database, could lead to the dismissal of charges or to drastically reduced charges for the alleged head of the notorious Mexico-based criminal Castorena Family Organization (CFO), some say.

The Suad Leija story isn't over yet and only time will tell what the final outcome will be. The full story of Operation Paper Tiger can be purchased (which includes actual wiretap transcripts) on the Paper Weapons site.

The most recent Newsweek story written by Joe Contreras can be seen in full (recommended), here.

In case you are interested in the Cory Voorhis case, a lot of information can be seen on his legal defense site, here.

Suad has also put up a new site, to further her personal interests once this story comes to a conclusion. Please note that Suad is only 23 years old and hopefully has other things in her life to pursue once this drama is over.

Below is another example of her work, which can be seen on her site (linked above). Please note that she is only the artist and the expressed views of those of her husband.

Finjan discovers criminal database with 8700 account credentials to trusted domains!

Is the Corporate World under attack by hackers? A new report from Finjan suggests that top level domains have been compromised and access details are for sale on the black market.

It should be noted that government domains have been allegedly compromised, also.

From the Finjan press release:

Finjan Inc., a leader in secure web gateway products, today announced it has uncovered a database containing more than 8,700 harvested FTP account credentials, including username, password and server address - in the hands of hackers. These stolen credentials enable criminals to compromise servers and automatically inject crimeware to infect users visiting them. Among those stolen accounts are those of Fortune-level global companies in a wide range of industries including manufacturing, telecom, media, online retail, IT, as well as government agencies. The stolen FTP accounts include some of the world’s top 100 domains as ranked by Alexa.com.

Dark Reading Kelly (Jackson Higgins) went more into depth on the risks associated with this new discovery:

The so-called meoryprof.info (Me-or-you-Profit) site is selling username, password, and server addresses of these FTP servers as well as the NeoSploit Version 2 crimeware package, which basically lets the bad guys who buy it instantly infect these sites with malicious code -- with the goal of stealing valuable and confidential data from them as well as any visitors to the sites. It also “qualifies” the stolen accounts so that buyers either can then set a price to resell the compromised FTP credentials to other cybercriminals, or determine which are the more potentially lucrative sites to hack.

“With a click of a button they say ‘I want to infect his FTP server’ with the crimeware,” says Ben-Itzhak. Finjan did not test all of the sites to see if they had been infected yet or not.

From a more social perspective, this continues the scary trend of crimeware for sale, which enables not very technical criminals to commit fairly technical crimes at will.

Besides the fact that (in theory at least) sensitive information can be stolen from some of these sites, a visitor can be compromised when visiting a "trusted site."

Besides the risk of sensitive information being compromised, compromised sites, once publicized might face another problem a.k.a. unfavorable public exposure. This could lead to a loss of trust in their brand, and as seen recently, potential litigation.

This doesn't even take into consideration all the other assorted costs of recovering from a large scale data compromise that becomes public knowledge.

Finjan is inviting the corporate world to make inquiries, whether or not, their particular site is at risk. I'll provide the link to do so, here.

They are also providing more information on this latest crimeware kit on their "Malicious Page of the Month."

Dark Reading story, which seems to be a good information source on this story, here.