Whaling in Singapore?

Singapore appears to be the source of a virus cleverly designed to hoodwink U.S. executives by appearing to be an emailed subpoena which mentions them by name, as well as their title.

The SANS Storm Center said three days ago that

We’ve gotten a few reports that some CEOs have received what purports to be a federal subpoena via e-mail ordering their testimony in a case. It then asks them to click a link and download the case history and associated information.

One problem, it’s total bogus. It’s a “click-the-link-for-malware” typical spammer stunt. So, first and foremost, don’t click on such links. An interesting component of this scam was that it did properly identify the CEO and send it to his e-mail directly. It’s very highly targeted that way.

The report says that the server that the trojan reports back to is “hard-coded to an ISP in Singapore at this time,” from where, according to Ars Technica, it “steals copies of any security certificates installed on the system.”

(This, by the way, is calling whaling, since it is like phishing but is more targeted, and going for bigger phish, so to speak.)

The Inquirer says that the web servers delivering the emails are based in China, and, in language too loose to take seriously, “the cyber ruffians who later nefariously take control of the victims’ computers, based in Singapore.”

There’s no evidence the “cyber ruffians” are based in Singapore, as far as I can work out. The only possible connection could be the English and errors in the emails, which, John Markoff of the NYT reports, “led several researchers to believe that the attackers were not familiar with the United States court system and that the group might be based in a place that used a British variant of English, such as Hong Kong.”

That said, just because an ISP may have been compromised doesn’t mean that those involved are physically located in Singapore. Indeed, it would seem very unlikely they are; if they’re smart enough to launch an attack like this, you’d have to bet against them being anywhere near the ‘command and control’ center itself.

Still, it’s unsettling that an ISP may have been compromised. So far we don’t know much more, though I’ve put in requests for more information. (The source of the information about Singapore appears to have come from someone at Verisign, whose Asian PR address bounces. So don’t expect something anytime soon.)