As usually is done lately, these kind of phishing use extensive psychological pressure on its readers (read: preys) to take immediate actions without further considerations. This is where the success of these kinds of email phishing stems.

Now let’s [...]]]> In only three days, I’ve received three similarly subjected emails namely from HSBC. It goes something like this:

As usually is done lately, these kind of phishing use extensive psychological pressure on its readers (read: preys) to take immediate actions without further considerations. This is where the success of these kinds of email phishing stems.

Now let’s take a look at the HTML file attachment:

Take notice at how relieving it is for someone who has been led to believe that his card has really been stolen and blocked. Amazing how this psychological trap works, right?

Now let’s see what it looks like when it’s run:

Don't fill any fields, it's a phishing page

Notice the underlined fields. Those fields alone can lead to disaster for an HSBC card holder, if he decides to fill in and click continue. What’s more is that the phishing goes as far as stealing your Internet Banking Identification!

So, how come it looks so real, as if it really is an legitimate HSBC website? Simple. It gets all of its HSBC attributes such as favicon and all FROM www.hsbc.co.uk:

Where is the intercepting address, if you’re wondering. Watch this part of the html file:

Beware!

Bookmark It

Facebook Trojan in email attachment was sent to me.

Email with Facebook Trojan Attachment

Twice in only 2 days I’ve received emails claiming themselves as from Facebook Service (networks@facebook.com) and The Facebook Team (confirmation@facebook.com) respectively. At first I thought it is from the facebook as we always got notification [...]]]> Beware: Facebook Trojan Sent Via Email

By Robert Moekoe

Facebook Trojan in email attachment was sent to me.

Email with Facebook Trojan Attachment

Twice in only 2 days I’ve received emails claiming themselves as from Facebook Service (networks@facebook.com) and The Facebook Team (confirmation@facebook.com) respectively. At first I thought it is from the facebook as we always got notification emails from facebook. But after I spotted out that the email got an attachment in it, curiosity got the better of me.

I run a check, both Facebook Trojans are the same

The attachment in both emails came with different names (Facebook_details_348.zip and Facebook_details_173.zip) but as I test ran them, they proved to be exactly the same. This fact made me almost sure that the email attachments are trojans. So I decided to run one of the executable files in a save and contained virtual machine.

I test run the Facebook Trojan on a virtual machine

Notice the new SVCHOST.EXE running, and the empty Facebook Trojan folder

The result is really typical of that of an effective and efficient trojan: quiet, leave no trails behind, get the job done. As you can see in the snapshots, once I ran it, it leaves a new SVCHOST.EXE running using 2,250KB memory before it deleted its physical program file from the folder. This could mean that it has got itself into the system where it can hide and work well stealthily. Perhaps it would later download a working trojan and that it is actually only a downloader trojan. I have it that this is a trojan, and I call it The Facebook Trojan

Facebook Trojan Has Nothing to Do With Facebook.

Although the sender name and spoofing email host is Facebook, this actually is not coming from Facebook as anyone can fake any address.

Recognizing And Avoiding It.

You would want to avoid executing the .exe file or downloading the attachment altogether. But how could we recognize it without having to execute it in a virtual machine like I did? The major clues with which we can easily recognize a Facebook Trojan would be these:

First, have a look at the email subjects. They would go with the same sense of urgency (notice the exclamation mark), and the awkward terms Support Message and Customer Message:

1. Facebook Password Reset Confirmation! Support Message.
2. Facebook Password Reset Confirmation! Customer Message.

Second, the email contents are the same for both emails. It goes like this:

Dear user of facebook,

Because of the measures taken to provide safety to our clients,
your password has been changed.

You can find your new password in attached document.

Thanks,

Your Facebook.

More Obvious Clues

Pay attention to the same sense of urgency and awkwardness of the message as those of the subjects. It uses the word safety as an urgency trigger.

The first awkwardness comes with the message stating that the password has been changed. No one can change passwords without our prior consent. That’s it.

The second awkwardness is that instead of just provides us with the new password in the email body; it instructs us to find it for ourselves in the attachment. Can you imagine that? What a lame lure.

Going beyond just that, if you’d downloaded the .zip file and examine the content, you’d find the ultimate proof that indisputably indicates that this is a trojan: the file is an executable .exe file. Whoa. I can’t say anymore. Beware of Facebook Trojan in emails.

Bookmark It

It’s best to install virtual machine such as Microsoft Virtual PC or VMWare as it takes the place of a separate computer which is contained and easy to manage as it runs in our desktop. Using a separate computer, as we do with a virtual machine, we [...]]]> Install Virtual Machine – And Be Free!

By Robert Moekoe

It’s best to install virtual machine such as Microsoft Virtual PC or VMWare as it takes the place of a separate computer which is contained and easy to manage as it runs in our desktop. Using a separate computer, as we do with a virtual machine, we can do the followings without any fear or harm:

1. Test and run trials, suspicious and strange programs or software.
2. Experiment with suspected files.
3. Quarantine external files or software to make sure they’re safe.
4. Browse into suspicious or new untested web pages in a safe and isolated environment.
5. Smile when we actually got infected, as all we need to do is restore to the point where we want to be in the virtual machine, and start over if we like.

It is a very effective way of 100% protecting ourselves from any malicious threats.

After we install virtual machine, managing (i.e. creating, deleting and restoring) each machines can be done in a very controlled environment right on our desktop, thus making things very easy to do and safe at the same time.

We can test-run suspicious and strange files or software, browse into suspicious or new untested web pages in a safe and isolated environment of the virtual machine. Using this technique alone can eliminate most of the threats we all have been afraid of, namely virus-infected file, spyware, adware, hacker exploitation, and best of all, should any of those happen, we only need to restore to a desired state of the system without fuss.

So, why wait? Install virtual machine now…

This article is a part of the Ten Ultimate Computer Security Must-Do’s steps.

Bookmark It

The idea of how to protect computer here is to have a private computer of your own, separated from the computer that’s meant for others. To really get a solid grip on your computer’s security, you have to decide and limit as to who can access your [...]]]> Private Personal Computer, How to Protect Computer
By Robert Moekoe

The idea of how to protect computer here is to have a private computer of your own, separated from the computer that’s meant for others. To really get a solid grip on your computer’s security, you have to decide and limit as to who can access your computer. The point is not to let your computer be treated worse than it is conditioned to be treated in a secure manner.

Letting others use your computer without previous warnings about the way you want it to be treated will end up in opening many security holes, most of which are coming from human-decisions psychologically-appealing malicious software downloads. A better practice is to separate your own private personal computer from your public personl computer. Treat your private computer with strict rules. Here are some common warnings how to protect computer I personally uphold to begin with:

1. Never download anything, unless I’m around. When I’m around, I’ll make sure he/she doesn’t download executable files including software installations, software upgrades, hot-fixes, scripts, dll’s, or anything executable.
2. Never give up any information on the internet on my name, passwords (if any), where-about, family members’ information, card information, bank account information or even friends information. This has more to do with information security than computer security.
3. Never turn off or change settings of firewall, antivirus, internet security, or any running security software without my permission. Some security solution provides password protected control panel settings. Supply password for such programs to prevent other users from changing settings.

What About The Public Computer?

As for the public computer, there are brute ways you can put into it. Any way there is how to protect computer that you can apply. You have to prepare for the worst. That way, you can keep your personal computer to yourself and have another for public ready for abusive use, usually coming from your children or friends, without any confidential data to leak out. Meanwhile, you might have developed certain settings on your personal computer that you don’t want other people to change, also you might have pseudo confidential data such as coded passwords in an easy to open document for straightforward access that you don’t want anybody else to play around with.

Bookmark It

Having business firewall software is like putting a filter between each computer in your business and the world outside. With a business firewall you can filter out information coming from certain websites or addresses, or packets containing certain signatures. By doing that, we can be [...]]]> Firewall, The Effective Way to Have a Business Firewall Software Installed.

Having business firewall software is like putting a filter between each computer in your business and the world outside. With a business firewall you can filter out information coming from certain websites or addresses, or packets containing certain signatures. By doing that, we can be shielded from unauthorized access usually made with malicious intensions.

With that in mind, when you need to have a business firewall installed you also have to know what to filter and what not, in order to make use of the business firewall software effectively. These are tailor made settings. You can consult with every individual that uses the network and get every detail about their network traffic’s boundaries.

Who does know best what information we don’t need thus needs to be filtered? Nobody does exactly but us. Not even the best business firewall software vendors put together. The best it can be is that the business firewall software is already set up to a default set of rules commonly used but not yet detailed to your specific needs. What are your special needs to set up on the business firewall software rule? To begin with, these might be some good examples:

1. What IP addresses in your home network you want to grant access to your computer. They might just be the IP addresses of some computers in the office network where various users can use, where those computers have high risk of being compromised by malicious software.
2. What programs in your computer you want to give access to the network. The best configuration is to set a default deny to all programs but trusted ones. This requires you to fill the list with program names you know of that actually need to access the network in order to work properly. Programs that are not in the list will be blocked out.

A business firewall software could also be a firewall that comes bundled with an internet security software. Make sure you fine-tune the business firewall software before use, as leaving it with a default setting will either prevent you from connecting to the internet smoothly or render the business firewall software but more of a system burden.

Bookmark It

Related posts: AOL McAfee, Antivirus Ranking 2009, Antivirus Software Downloads

Antivirus Software Download: Disambiguation: none

Related posts: Antivirus Software Downloads

nigerian scam warning

If you have ever heard of Nigeria Scam or romantic scam before, you know what I mean. Online (and online only) friends, acquaintances, or even lovers should be treated with prudence. Unless you have proven them to be offline-trustworthy, always put precaution, [...]]]> Beware of Online Friends and Mates, Nigeria Scam

By Robert Moekoe

nigerian scam warning

If you have ever heard of Nigeria Scam or romantic scam before, you know what I mean. Online (and online only) friends, acquaintances, or even lovers should be treated with prudence. Unless you have proven them to be offline-trustworthy, always put precaution, make sure you have a good spyware privacy, and never let go off sensitive information to them. Among them could just be a Nigeria Scam or romantic scam.

So, what harm could romantic or Nigeria scam do to us? Some of the modus operandi online scams (Nigeria scam) are pulling nowadays are listed here:

1. An heir of a very wealthy but overthrown leader of a distant country, needing help to get the family’s money in a bank account out of the country. The help the Nigeria scam says it needs is an amount of money to make the bank account transfer possible. A victim who buys the story usually transfers the money and lost it to the Nigeria scam.
2. Someone who you’ve known of for only a short period of time via an online social networking or an online matchmaker devours special attention to you, usually in the name of love and all about love. In the mean time he / she might or might not offer you something such as money, present, or anything that might be of bonding value to you. In the end, the scenario is that you have to pay for a gift sent via mail as a customs official somewhere tells you that some money is needed to let the cargo in to your country.

There might be more scenarios played by con artists in  an online or Nigeria scam waiting for us to be their preys. So just beware and keep our judgment straight.

Bookmark It