Author Topic: Phishbank attacks (Read 5413 times)

ZWarrior · « **on:** March 23, 2005, 11:50:03 PM »

Greets,
just a heads up, there is a fairly new phishing message out there that will also try to install malicious software also.

It is called Phishbank, and there are already several variants.

I recieved a valid looking message from PayPal in HTML format. The Link looked real, and all looked kosher. But my spidey-sense said otherwise. So I right clicked and tried to view the source code for the message. As soon as I did that my virus protection software went ballistic and deleted the text, and alerted me to the virus.

here is a link to some basic info:
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=39292

Apparently only CA has the new variants that load the software, all the others only have the strict Phishing attempt alone.

ZWarrior · « **Reply #1 on:** March 24, 2005, 12:15:50 AM »

Took a little finagling, but I now have the source for the email. these guys were pretty sneaky. They actually do send you to the PayPal website for all the links, but one of them first runs some code from a different website before sending you there. Very sneaky.

here is the addresses with the http:// disabled in front if anyone wants to get sneaky. The site must still be up because the virus was still being sent to me. I have also reversed the leading "<" to stop the webpage from hiding the code.

Quote

>FORM action="(http:// removed)rds.yaho
o.com/*(http:// removed)www	.google.com/url" method=get target=_blank>

>INPUT type=hidden value=(http:// removed)rds.yahoo.com/*(http:// removed)82.76.121.28/%6D%61%6E%75%61%6C/webscr/ name=q>

>INPUT style="BORDER-RIGHT: 0px solid; BORDER-TOP: 0px solid; BACKGROUND: none transparent scroll repeat 0% 0%; BORDER-LEFT: 0px solid; COLOR: #000080; BORDER-BOTTOM: 0px solid" type=submit value=(https:// removed)www.paypal.com/cgi-bin/webscr?cmd=_update>

>/FORM>

Notice that the INPUT tags have correct addressing, but the FORM tag sends you to somewhere else entirely.

Nasty that.

[Edited on 3-24-2005 by ZWarrior]

Mr_Anderson · « **Reply #2 on:** March 24, 2005, 12:14:29 PM »

Thanks for the update!

JollyRoger · « **Reply #3 on:** March 24, 2005, 12:23:21 PM »

that was was nice most of the time you get sent to a dummy site.
these guys were pretty sneaky. Now I want to smack them around a little. ZW did you get an origin?

ZWarrior · « **Reply #4 on:** March 24, 2005, 12:52:50 PM »

I haven't had a chance to pursue beyond the code above. It was late and I didn't want to try and wrap my head around the obfuscation, just my pillow.

JollyRoger · « **Reply #5 on:** March 24, 2005, 01:45:01 PM »

Dude, you're not suposed to wrap your head aound the pillow, it's suposed to wrap aroud your head! and you think Snauz is backwards Sheesh!

Mr_Anderson · « **Reply #6 on:** March 24, 2005, 02:51:55 PM »

Do it eaither way, you'll just end up choking.

JollyRoger · « **Reply #7 on:** March 24, 2005, 03:06:13 PM »

what you don't use a pillow?

Mr_Anderson · « **Reply #8 on:** March 24, 2005, 03:07:51 PM »

I do use a pillow, it's just I don't wrap it around my head.

JollyRoger · « **Reply #9 on:** March 24, 2005, 03:09:27 PM »

:lol:lol you should try, you might get a more restful sleep

Mr_Anderson · « **Reply #10 on:** March 24, 2005, 03:12:58 PM »

Who needs sleep?

Drink more bawls!
:beer: :beer: :beer:

ZWarrior · « **Reply #11 on:** March 24, 2005, 03:27:33 PM »

*Looks at Anderson, looks at Jolly, shakes his head and walks away*

*sigh*

Mr_Anderson · « **Reply #12 on:** March 24, 2005, 03:28:23 PM »

JollyRoger · « **Reply #13 on:** March 24, 2005, 03:29:07 PM »

Mr_Anderson · « **Reply #14 on:** March 24, 2005, 03:29:35 PM »

Wolverine of Ambush! · « **Reply #15 on:** March 30, 2005, 12:55:22 PM »

I had a guy that sits next to me that gets several 'phish' emails everyday... WOW! it's everywhere.:touched;

Mr_Anderson · « **Reply #16 on:** March 30, 2005, 01:21:25 PM »

Ouch....

Wolverine of Ambush! · « **Reply #17 on:** March 30, 2005, 02:43:59 PM »

he gets like 100 or so everyday....

JollyRoger · « **Reply #18 on:** March 30, 2005, 02:45:20 PM »

someone needs to start deploying his spam filters.

Wolverine of Ambush! · « **Reply #19 on:** March 30, 2005, 02:45:41 PM »

I don't get them....

?

JollyRoger · « **Reply #20 on:** March 30, 2005, 02:56:37 PM »

nor do I, Me thinks your buddy at work needs to set up his spam filters

Mr_Anderson · « **Reply #21 on:** March 30, 2005, 03:28:23 PM »

Yea, I get tons of spam for some weird reason. I have to basically filter everything.

News:

Recent Posts

Fiction

Permissions

Author Topic: Phishbank attacks (Read 5413 times)