Spyware, viruses, & security forum: Security Watch: When two factor fails

I investigate any suspicious email I find in my inbox. I use a pre-McAfee version of SpamKiller which allows me to highlight the potential spam message and view detailed header information. I check items like the server names that it went through, the sending email address and the actual destination address. Any or all of these items send up red flags when they don't look right. If I find it to be a bogus attempt at getting information from me I report it to my ISP. I have caught several phishing messages trying to look like official eBay or PayPal messages and also reported those to the respective parties. You can't be too careful and sometimes clicking these links gives the sending party unrestricted access to your system(s). Thus the reason why I also have a combination of hardware and software firewalls on my DSL connection.

I naturally mistrust any email sent to me claiming to be from some one who is an account holder of mine and always verify it with the them first. Some times the email was from from a valid account holder and was a valid email, but most of the time it was not. By doing this, I have never been burned yet by giving out my private info to hackers. I can't say that I am sure about the people that handle my account info though. After the feasco over the VA and with some of the Banks, I'm more concerned with the people charged with the security and handling of my accounts. That's where most of the security laspes seem to be happening these days.

e-mails aren't smart enough to come to sites like this to learn about them.

I DO know how to spot them and do NOT open them UNLESS it's to report them to those who are being Spoofed (facilitating SOME of the Phishing that goes on) like, eBay, Yahoo, etc. Sites like eBay, Yahoo, etc. almost always have addresses where you can send Spoofed mail for them to track down and put a stop to.

Now this one is to me obvious - but the one thing that they are getting to me with is the close personal information - meaning exact addresses,legitimate church,knowledge of my territory, all that for some would make it sound more believable. Of course you call the church, which I should and havent, but if they are going to be THAT asstute, then why not book the church?! So as when someone calls it just looks even more legit?...Of course there are the obvious 'stop signs', 'Hello', 'hows business', those arent client greetings. Not to mention that my photographic business doesnt do weddings..lol..but! very scary to say the least. Heres the email -

Hello,
How is Business today?
My name is Mrs Dolly Gbabs. I am an handicap and i reside in U.K.
The reason i am contacting you is that my Sons will be getting married soon in Vermont,United States on the 26th of August 2006 and I will like you to take care of the Photographs.
The address for the wedding is at Community Bible Church Assembly of God,2025 Williston Road,South Burlington, VT 05403.
I came across your advert on the Internet and am impressed with your services.
All expenses would be taken care of,Please I want the best service from you, because this is my only Son so I want the best for him. So your best effort is needed at this occasion.
Pls Let me know your price to work for 4 Hours on that day,12 noon to 4 pm in the evening.We want about 40 copies of different photos in coloured form in the church and reception and of both the bride and the bridegroom,their parents, the officiating ministers and our guests.
We want you to work for at least 4 Hours at the occasion.
Also,we will have the photographs snapped at the wedding forwarded to the Publisher of a Magazine Company in United Kingdom so they could feature it in their celebrity journal.
I look forward to your response
Pls email me soon :dollygbabs@yahoo.co.uk
Best Regards

<<<P.S. Sometimes I click on spoof links and enter totally bogus information just to waste their time trying to verify it. Gives me a sense of satisfaction.>>>

*chuckle* My office's tech was telling me the same. He said he sometimes uses the fields to type out rude messages to them!

I was testing SiteAdvisor a few weeks back, using an email from PayPal. I have no PayPal account. I clicked on the email to see what would happen and there was the ''website'' asking me to log in. Since I could not, I hovered over the icons on the ''page''. Watching the status bar at the bottom of the browser, every icon gave the same result... no data, or some such. I found it highly amusing. And, by the way, even though I like and use SiteAdvisor, it gave me no warnings whatsoever.

While I do have a 2nd account on ebay that I use just for forums and don't really have any hard info inputted, this sounds fake anyways.

wadda ya guys think

=========================

from: eBay Inc. [pw-conf@02.ebay.com]

eBay Security



Dear eBay User ,


During our regular update and verification of the accounts, we couldn't
verify your current information. Either your information has changed or
it is incomplete. If the account information is not updated to correct
information within 5 days then, your access to bid or buy on eBay will
be restricted. Please update your information by completing the form
from the forwarded link :

http://www.multipledad.net/int/

And login to eBay in order to update your informations. As outlined in
our User Agreement, eBay will periodically send you information about
site changes and enhancements.
Visit our Privacy Policy and User Agreement if you have any questions.



Regards,Safeharbor Department

eBay, Inc.








Per the User Agreement, Section 9, we may immediately issue a warning,
temporarily suspend, indefinitely suspend or terminate your membership
and refuse to provide our services to you if we believe that your
actions may cause financial loss or legal liability for you, our users
or us. We may also take these actions if we are unable to verify or
authenticate any information you provide to us.






As outlined in our User Agreement, eBay will periodically send you
information about site changes and enhancements. Visit our Privacy
Policy and User Agreement if you have any questions.

Copyright 2007 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective
owners.

eBay and the eBay logo are trademarks of eBay Inc.

Find out for SURE! Send it to Ebay:

spoof@ebay.com

Forward that WHOLE e-mail to that address. Within minutes Ebay will send you first a confimation that they recieved your report, then they will send you information about that letter as to whether it is legit or not.

As a member of the private group "Scam Busters" on eBay, we've pretty much concluded that forwarding the spoofs is a waste of time. Nothing ever really comes of the thousands reported daily, other than confirmation and perhaps comfort to the reportee.

But there's something more serious going on that hasn't been mentioned here.

The scammers have honed their skills so well, they now embed malicious code that launches by merely opening an email. That means you don't need to click anything, it opens WITH the email.

I highly recommend EVERYONE to set up their accounts so all messages open in "Text Only". It's different with different accounts, usually found under Options. "Text Only" will not allow HTML codes to run, including the embedded malware.

You can always allow trusted places to open fully.