loose wire blog

Whaling in Singapore?

Singapore appears to be the source of a virus cleverly designed to hoodwink U.S. executives by appearing to be an emailed subpoena which mentions them by name, as well as their title.

The SANS Storm Center said three days ago that

We've gotten a few reports that some CEOs have received what purports to be a federal subpoena via e-mail ordering their testimony in a case. It then asks them to click a link and download the case history and associated information.

One problem, it's total bogus. It's a "click-the-link-for-malware" typical spammer stunt. So, first and foremost, don't click on such links. An interesting component of this scam was that it did properly identify the CEO and send it to his e-mail directly. It's very highly targeted that way.

The report says that the server that the trojan reports back to is "hard-coded to an ISP in Singapore at this time," from where, according to Ars Technica, it "steals copies of any security certificates installed on the system."

(This, by the way, is calling whaling, since it is like phishing but is more targeted, and going for bigger phish, so to speak.)

The Inquirer says that the web servers delivering the emails are based in China, and, in language too loose to take seriously, "the cyber ruffians who later nefariously take control of the victims’ computers, based in Singapore."

There's no evidence the "cyber ruffians" are based in Singapore, as far as I can work out. The only possible connection could be the English and errors in the emails, which, John Markoff of the NYT reports, "led several researchers to believe that the attackers were not familiar with the United States court system and that the group might be based in a place that used a British variant of English, such as Hong Kong."

That said, just because an ISP may have been compromised doesn't mean that those involved are physically located in Singapore. Indeed, it would seem very unlikely they are; if they're smart enough to launch an attack like this, you'd have to bet against them being anywhere near the 'command and control' center itself.

Still, it's unsettling that an ISP may have been compromised. So far we don't know much more, though I've put in requests for more information. (The source of the information about Singapore appears to have come from someone at Verisign, whose Asian PR address bounces. So don't expect something anytime soon.)

Technorati Tags: phishing, whaling, singapore, scams, security, NYT, china, trojan

Facebook is Dead. I'm Not Being Facetious

Either there's a glitch in Facebook, or else it's dead. Well, not dead, exactly, but I noticed that, at nearly 10 pm, none of my friends have done anything today to merit appearing on the News Feed of stuff (see above).

(The News Feed, for those of you with real lives, lists recent activity by your friends in adding little widgets, updating their photos, tagging other photos, and all that sort of thing that merits an evening at home.)

(And no, I'm not filtering my News Feed at all:)

(And yes, I do have some friends. Well, Facebook friends. They're like fairweather friends except they don't even hang around when the weather's good:)

Now, this could be a glitch. A glance at one of my most active Facebook chums indicated she's accepted flowers, a caveman and a fire in the past hour.)

And we should distinguish between activities and updates. Status updates are still going fine: 22 of my chums have updated their status in the last six hours. But none, as far as I can work out, have added an application, tagged photos or done anything that merits being put into the News Feed (indeed a lot of the activity in the News Feed seems to be a couple of days old.)

To me that's kind of significant. If my friends have tired of Facebook as a place to hang out and do stuff, then how long has it got left?

Technorati Tags: facebook, networks, status, presence, lifestreams