Jeff's Customer Tech Notes
Current Trojan, Spam & Phishing Notes - July 2, 2010
The current trojan threat appears to be a scheme where e-mails purporting to be
from WVI Admins, using a variety of e-mail addresses (support@wvi.com,
action@navicom.com, customersupport@wvi.com as well as many others), instruct
the recipient to download and install a program on their computer to update their
settings for some vaguely worded security upgrade. WVI will never notify you of an
upgrade in this manner and I cannot foresee us ever doing anything that would
require you to download an upgrade to your computer. A variation on this involves
an e-mail identifying itself as being from Microsoft and stating that some program
needs to be updated. Microsoft will not distribute updates to it's software through
any method than the Microsoft Update (http://update.microsoft.com) website or the
Automatic Updates tool that comes with Windows.
A new threat is an e-mail with the subject line of "Delivery Status Notification (Failure)"
that
mimics a valid e-mail that an e-mail server might send out. It contains an attachment
that
installs a "Fake Antivirus" program on your computer which then attempts to make
you pay
for it - or at least to get rid of it. Extortion by any other name. It may install
other programs
as well. Deleting the e-mail without launching the attachment will
prevent infection.
Another current threat, either phishing or trojan, is an e-mail masquerading as a
"Notice of underreported income" from the Internal Revenue Service. This can be
determined as being fake for a variety of reasons - the first of which is that most of
us have never given our e-mail address to the IRS. Additionally, I believe that when
they send out notices of this sort they use Registered Mail or the equivalent, since it
can be tracked and is a legally acceptable way of delivering such notices.
What is a Trojan?
A Trojan is a program, similar to a virus, that is installed surreptitiously on your computer
in order for other people to gain access to your computer. Normally this is done by e-mail
spammers or people working for them in order to turn your computer into a spam relay -
accepting spam e-mails to be sent to other people. The vast majority of spam is sent in
this manner, which is why it is so hard to shut down - it's being sent from literally hundreds
of thousands of personal computers, most of whose owners don't know that anything is
wrong. Some of the more sophisticated trojans can be used for multiple purposes
including Distributed Denial of Service attacks, where thousands of computers will send
streams of nonsense traffic at a target computer or network, shutting it down.
What is Phishing?
Phishing (pronounced "Fishing") is when a spammer or scammer sends you an e-mail
purporting to be from a company, usually financial in nature, that they hope you have a
relationship with. Using what appears to be a valid link in the e-mail, they attempt to
direct you to a fake website that instructs you to log in - thereby providing them with
your username and password for that institution. The really technically astute of them
will pass that information onto the valid website as well, logging you into it so that you
are none the wiser.