Don’t Click on Unsolicited Attachments

Tuesday, January 10, 2012 @ 04:01 PM gHale


If “curiosity killed the cat” then the same thought process follows when it comes to clicking on unsolicited attachments in an email.

Attackers make a fortune on those people.

RELATED STORIES
Phishing Subsets: Vishing, Smishing
Phishing Attack Hits Apple Users
Malware Target: Defense Contractors
Botnet can Direct Traffic

There is now a new scam called “Gameover,” which, once ensconced on your PC, can steal usernames and passwords and defeat common methods of user authentication employed by financial institutions, FBI officials said.

There is an increase in the use of Gameover, which is an email phishing scheme that invokes the names of prominent government financial institutions — the National Automated Clearing House Association (NACHA), the Federal Reserve Bank or the Federal Deposit Insurance Corporation (FDIC).

Gameover is a newer variant of the Zeus malware, created several years ago and specifically targeted banking information, the FBI said.

“Typically, you receive an unsolicited email from NACHA, the Federal Reserve, or the FDIC telling you that there’s a problem with your bank account or a recent ACH transaction,” the FBI said. (ACH stands for Automated Clearing House, a network for a wide variety of financial transactions in the U.S.) “The sender has included a link in the email for you that will supposedly help you resolve whatever the issue is. Unfortunately, the link goes to a phony website, and once you’re there, you inadvertently download the Gameover malware, which promptly infects your computer and steals your banking information.

“After the perpetrators access your account, they conduct what’s called a distributed denial of service, or DDoS, attack using a botnet, which involves multiple computers flooding the financial institution’s server with traffic in an effort to deny legitimate users access to the site — probably in an attempt to deflect attention from what the bad guys are doing.”

The FBI went on to say some of the funds stolen from bank accounts go toward the purchase of precious stones and expensive watches from high-end jewelry stores.

“The criminals contact these jewelry stores, tell them what they’d like to buy, and promise they will wire the money the next day. So the next day, a person involved in the money laundering aspect of the crime — called a ‘money mule’ — comes into the store to pick up the merchandise. After verifying that the money is in the store’s account, the jewelry is turned over to the mule, who then gives the items to the organizers of the scheme or converts them for cash and uses money transfer services to launder the funds.”



Leave a Reply

You must be logged in to post a comment.