I just got a windows virus. It looks like this:
*eBay Security Center *
You have 1 new Security Message Alert!
*Resolution Center:* Your account is limited. *Click to Resolve* http://mail.gecaz.com/cmd=SignIn&co_partnerId=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&ru=&pp=&pa2=&errmsg=&runame____DHGWUCGNS0372AKD83JE.html
Thank you for using eBay !
Loretta Guirguis , Security Team ------------------------------------------------------------------------ Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered. Email ID: 36121
It is very clean and sure looks official. Even has a Email ID :-)
On Thu, 23 Aug 2007, Karl Larsen wrote:
I just got a windows virus. It looks like this:
*eBay Security Center *
... snip ...
It is very clean and sure looks official. Even has a Email ID :-)
in that case, i'd run that baby. crossover office. vmware. kvm. the possibilities are endless, karl. go for it.
rday
Robert P. J. Day wrote:
On Thu, 23 Aug 2007, Karl Larsen wrote:
I just got a windows virus. It looks like this:
*eBay Security Center *
... snip ...
It is very clean and sure looks official. Even has a Email ID :-)
in that case, i'd run that baby. crossover office. vmware. kvm. the possibilities are endless, karl. go for it.
rday
I followed the thing you click and it's a odd web page that will take your E-Bay name and password if you give it. So more Scam than Virus it appears.
On Thu, 2007-08-23 at 08:12 -0600, Karl Larsen wrote:
I followed the thing you click and it's a odd web page that will take your E-Bay name and password if you give it. So more Scam than Virus it appears.
Nothing new in that. But standard advice is to never to respond to junk mail, in any way (which includes not following links in them), other than hitting your delete key. That link could have had an ID in it unique to you, and you could have just added yourself to more spammer's lists. Never mind the potential of exposing yourself to exploits through your browser.
Reporting junk mail isn't always advisable, either, unless you really know what you're doing. Those who don't know can end up making the report to the spammer, making a report to a host that doesn't care, making a report to a host that forwards your complaint onto the spammer, making a report that cause trouble for the people who's addresses were forged in the spam, and so on. Various anti-spam systems have their own ways of collecting data to identify spam that manage quite fine without the trying-to-be-helpful amateur.
Reporting junk mail isn't always advisable, either, unless you really know what you're doing. Those who don't know can end up making the report to the spammer, making a report to a host that doesn't care, making a report to a host that forwards your complaint onto the spammer, making a report that cause trouble for the people who's addresses were forged in the spam, and so on. Various anti-spam systems have their own ways of collecting data to identify spam that manage quite fine without the trying-to-be-helpful amateur.
I second everything you say.
In fact, forwarding the spam to this list in the first place, is pretty much to akin to just sending the spam yourself, to 1000's of new people on this list. Not too clever :(
Chris
On Thu, 2007-08-23 at 08:12 -0600, Karl Larsen wrote:
Robert P. J. Day wrote:
On Thu, 23 Aug 2007, Karl Larsen wrote:
I just got a windows virus. It looks like this:
*eBay Security Center *
... snip ...
It is very clean and sure looks official. Even has a Email ID :-)
in that case, i'd run that baby. crossover office. vmware. kvm. the possibilities are endless, karl. go for it.
rday
I followed the thing you click and it's a odd web page that will
take your E-Bay name and password if you give it. So more Scam than Virus it appears.
WELL YOU LIKE TO LIVE DANGEROUSLY. NEVER CLICK ON A VIRUS WEB PAGE. WEB BROWSERS CAN COLLECT THE ADDRESSES OF PEOPLE WHO GO TO THE WEB SITE, SO YOU ARE ALREADY COMPROMISED.
======================================================================= Suffering alone exists, none who suffer; The deed there is, but no doer thereof; Nirvana is, but no one is seeking it; The Path there is, but none who travel it. -- "Buddhist Symbolism", Symbols and Values ======================================================================= Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam@sbcglobal.net
On Thu, 23 Aug 2007, Aaron Konstam wrote:
On Thu, 2007-08-23 at 08:12 -0600, Karl Larsen wrote:
Robert P. J. Day wrote:
On Thu, 23 Aug 2007, Karl Larsen wrote:
I just got a windows virus. It looks like this:
*eBay Security Center *
... snip ...
It is very clean and sure looks official. Even has a Email ID :-)
in that case, i'd run that baby. crossover office. vmware. kvm. the possibilities are endless, karl. go for it.
rday
I followed the thing you click and it's a odd web page that will
take your E-Bay name and password if you give it. So more Scam than Virus it appears.
WELL YOU LIKE TO LIVE DANGEROUSLY. NEVER CLICK ON A VIRUS WEB PAGE. WEB BROWSERS CAN COLLECT THE ADDRESSES OF PEOPLE WHO GO TO THE WEB SITE, SO YOU ARE ALREADY COMPROMISED.
Please turn off your capslock key. It makes you look foolish.
Web browsers do not collect anything. Web _servers_ might.
If any e-mail address was revealed, it was of the guy who posted it. If it had tried to infect my system it would have gone into the collection of other Windows rootkits. (I can always use more.) Lynx is your friend.
On Thu, 2007-08-23 at 14:53 -0700, alan wrote:
On Thu, 23 Aug 2007, Aaron Konstam wrote:
On Thu, 2007-08-23 at 08:12 -0600, Karl Larsen wrote:
Robert P. J. Day wrote:
On Thu, 23 Aug 2007, Karl Larsen wrote:
I just got a windows virus. It looks like this:
*eBay Security Center *
... snip ...
It is very clean and sure looks official. Even has a Email ID :-)
in that case, i'd run that baby. crossover office. vmware. kvm. the possibilities are endless, karl. go for it.
rday
I followed the thing you click and it's a odd web page that will
take your E-Bay name and password if you give it. So more Scam than Virus it appears.
WELL YOU LIKE TO LIVE DANGEROUSLY. NEVER CLICK ON A VIRUS WEB PAGE. WEB BROWSERS CAN COLLECT THE ADDRESSES OF PEOPLE WHO GO TO THE WEB SITE, SO YOU ARE ALREADY COMPROMISED.
Please turn off your capslock key. It makes you look foolish.
Web browsers do not collect anything. Web _servers_ might.
If any e-mail address was revealed, it was of the guy who posted it. If it had tried to infect my system it would have gone into the collection of other Windows rootkits. (I can always use more.) Lynx is your friend.
You are right it is web servers that collect addresses. However I kept the caps lock key on purpose since opening a phish web site is a silly thing to do and I wanted to emphasize that. To subtle I guess.
======================================================================= Are you ever going to do the dishes? Or will you change your major to biology? ======================================================================= Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam@sbcglobal.net
WELL YOU LIKE TO LIVE DANGEROUSLY. NEVER CLICK ON A VIRUS WEB PAGE. WEB BROWSERS CAN COLLECT THE ADDRESSES OF PEOPLE WHO GO TO THE WEB SITE, SO YOU ARE ALREADY COMPROMISED.
(snip)
Please turn off your capslock key. It makes you look foolish.
Web browsers do not collect anything. Web _servers_ might.
(snip)
You are right it is web servers that collect addresses. However I kept the caps lock key on purpose since opening a phish web site is a silly thing to do and I wanted to emphasize that. To subtle I guess.
Aaron Konstam
It depends on why you are opening it, and what precautionary measures you are taking when doing so (i.e. using Linux instead of Windows, via a virtual machine, using a Live CD, from a public access point, etc). The OP's posting doesn't say he opened it in Linux, but that appears to be the case reading between the lines. So he is not at risk of any IE/Windows exploits. That being the case, why would he be compromised for having visited the site? In this scenario at most the web server will have the IP of the person who visited, and the browser they used (and some other non-compromising information).
I agree that caps lock is not necessary other than perhaps to emphasize a word, but not an entire posting.
We are straying off topic seeing none of this relates to Linux. But seeing the issue is out there now, as was pointed out this is a phishing scam not a virus. These scams are a dime a dozen (I've seen many of them). Prudent advice is to delete without opening the message or visiting the site. Or participate in fighting the problem through phishtank.org and such sites, and reporting it to the organisation being represented so that they can take action. Visiting one of these sites does not necessarily automatically compromise you (especially when running Linux and a non-IE browser).
Jacques B.
On Fri, 2007-08-24 at 11:19 -0400, Jacques B. wrote:
WELL YOU LIKE TO LIVE DANGEROUSLY. NEVER CLICK ON A VIRUS WEB PAGE. WEB BROWSERS CAN COLLECT THE ADDRESSES OF PEOPLE WHO GO TO THE WEB SITE, SO YOU ARE ALREADY COMPROMISED.
(snip)
Please turn off your capslock key. It makes you look foolish.
Web browsers do not collect anything. Web _servers_ might.
(snip)
You are right it is web servers that collect addresses. However I kept the caps lock key on purpose since opening a phish web site is a silly thing to do and I wanted to emphasize that. To subtle I guess.
Aaron Konstam
It depends on why you are opening it, and what precautionary measures you are taking when doing so (i.e. using Linux instead of Windows, via a virtual machine, using a Live CD, from a public access point, etc). The OP's posting doesn't say he opened it in Linux, but that appears to be the case reading between the lines. So he is not at risk of any IE/Windows exploits. That being the case, why would he be compromised for having visited the site? In this scenario at most the web server will have the IP of the person who visited, and the browser they used (and some other non-compromising information).
I agree that caps lock is not necessary other than perhaps to emphasize a word, but not an entire posting.
We are straying off topic seeing none of this relates to Linux. But seeing the issue is out there now, as was pointed out this is a phishing scam not a virus. These scams are a dime a dozen (I've seen many of them). Prudent advice is to delete without opening the message or visiting the site. Or participate in fighting the problem through phishtank.org and such sites, and reporting it to the organisation being represented so that they can take action. Visiting one of these sites does not necessarily automatically compromise you (especially when running Linux and a non-IE browser).
Jacques B.
We just disagree. Opening up the web site gives the sender the information that it has found a live user who can be conned in some way. This conning has nothing to do with using Windows.
-- ======================================================================= It is better for civilization to be going down the drain than to be coming up it. -- Henry Allen ======================================================================= Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam@sbcglobal.net
We just disagree. Opening up the web site gives the sender the information that it has found a live user who can be conned in some way. This conning has nothing to do with using Windows. Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam@sbcglobal.net
If done as Ian stated, yes they could determine that a particular e-mail address responded by clicking on the link. I have not observed that. If they are cleverly obfuscating my email address in the URL then perhaps they may have sneaked one past me.
As for having nothing to do with Windows, you are correct as far as the social engineering aspect of it is concerned. But you said by visiting the site you were compromised. That would only occur if the site had code in it to exploit your browser - hence why I mentioned Windows and IE as being at risk of being compromised by "simply visiting" whereas Linux with Firefox is not. The part about getting you to enter personal information is the social engineering aspect which agreed has nothing to do with the OS and everything to do with what's in between the ears.
I'm certainly not advocating that people start following these links. To the contrary I agree they should not. I was simply disagreeing with your statement that the OP was automatically compromised for having just visited the site. Re-read my last posting and you will see that that was the point I was making. We agree on most, just not on the part that you are automatically compromised for having followed such a link. Some personal information (email address if done as Ian explained) and non-identifying information (IP, browser, OS) is potentially harvested by the server. Maybe it's just a difference in how we interpret "compromised". I do not call that being compromised as to me that would involve either your system becoming infected or you sharing personal/identifying information that could allow a person to steal your identity or otherwise leverage that personal information for financial gain.
Anyhow, enough OT for me. Feel free to post a rebuttal. If you wish to debate beyond a rebuttal then let's take it off-line or on a list dedicated to such debates.
Jacques B.
On Fri, 2007-08-24 at 12:41 -0400, Jacques B. wrote:
But you said by visiting the site you were compromised. That would only occur if the site had code in it to exploit your browser - hence why I mentioned Windows and IE as being at risk of being compromised by "simply visiting" whereas Linux with Firefox is not.
I think what I said, earlier, is more accurate. You expose yourself to the *potential* of an exploit. Firefox on Linux is not immune, though it is far less likely for you to be exploited, that way. And there are those who "dare to tread" who persist in running as the root user, with a higher risk.
On 24/08/07, Jacques B. jjrboucher@gmail.com wrote:
WELL YOU LIKE TO LIVE DANGEROUSLY. NEVER CLICK ON A VIRUS WEB PAGE. WEB BROWSERS CAN COLLECT THE ADDRESSES OF PEOPLE WHO GO TO THE WEB SITE, SO YOU ARE ALREADY COMPROMISED.
That being the case, why would he be compromised for having visited the site? In this scenario at most the web server will have the IP of the person who visited, and the browser they used (and some other non-compromising information).
To clarify Aaron's comment: the supplied URL may encode an id for the mail you received, marking the receiving address 'live' on a spammer's database. (In fact, marking it live and read by someone who follows such links, making it more valuable to them.) This used to be a favourite trick with 'if you have received this mailing in error click here' type scams which were aimed at collecting addresses to sell on. I have no idea whether the current crop of phishers bother with such tricks or if collecting people's bank account details is lucrative enough for them.
On Fri, 2007-08-24 at 16:56 +0100, Ian Malone wrote:
On 24/08/07, Jacques B. jjrboucher@gmail.com wrote:
WELL YOU LIKE TO LIVE DANGEROUSLY. NEVER CLICK ON A VIRUS WEB PAGE. WEB BROWSERS CAN COLLECT THE ADDRESSES OF PEOPLE WHO GO TO THE WEB SITE, SO YOU ARE ALREADY COMPROMISED.
That being the case, why would he be compromised for having visited the site? In this scenario at most the web server will have the IP of the person who visited, and the browser they used (and some other non-compromising information).
To clarify Aaron's comment: the supplied URL may encode an id for the mail you received, marking the receiving address 'live' on a spammer's database. (In fact, marking it live and read by someone who follows such links, making it more valuable to them.) This used to be a favourite trick with 'if you have received this mailing in error click here' type scams which were aimed at collecting addresses to sell on. I have no idea whether the current crop of phishers bother with such tricks or if collecting people's bank account details is lucrative enough for them.
-- imalone
It seems appropriate to tell a story. I was in the room when Java was first announced by a Sun representative to a local Unix user group. It was explained that Java would allow a program from a remote server to run on your local machine through the web browser. In the audience was a group of employees from the Defense Security Command. These are people who have been known to run their computers in a Faraday cage ( a metal cage that prevents radio signals to cross its boundaries). They told the Sun representative that under no circumstances would they allow programs from remote servers to be downloaded onto their machines.
And some of you believe it is safe to open a connection to a random phishing or virus web site. Incredible! -- ======================================================================= Q: How do you catch a unique rabbit? A: Unique up on it! Q: How do you catch a tame rabbit? A: The tame way! ======================================================================= Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam@sbcglobal.net
On Thu, 23 Aug 2007, Karl Larsen wrote:
I just got a windows virus. It looks like this:
*eBay Security Center *
You have 1 new Security Message Alert!
*Resolution Center:* Your account is limited. *Click to Resolve* http://mail.gecaz.com/cmd=SignIn&co_partnerId=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&ru=&pp=&pa2=&errmsg=&runame____DHGWUCGNS0372AKD83JE.html
Thank you for using eBay !
Loretta Guirguis , Security Team
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered. Email ID: 36121
It is very clean and sure looks official. Even has a Email ID :-)
Not a virus. It is a phish to get your eBay login information.
On Thu, 2007-08-23 at 05:49 -0600, Karl Larsen wrote:
I just got a windows virus. It looks like this:
*eBay Security Center *
You have 1 new Security Message Alert!
*Resolution Center:* Your account is limited. *Click to Resolve* http://mail.gecaz.com/cmd=SignIn&co_partnerId=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&ru=&pp=&pa2=&errmsg=&runame____DHGWUCGNS0372AKD83JE.html
Thank you for using eBay !
Loretta Guirguis , Security Team
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered. Email ID: 36121
It is very clean and sure looks official. Even has a Email ID :-)
--
Karl F. Larsen, AKA K5DI Linux User #450462 http://counter.li.org.
That is not particualrly a Windows virus. My spam filter finds them regularly. -- ======================================================================= Mencken and Nathan's Fifteenth Law of The Average American: The worst actress in the company is always the manager's wife. ======================================================================= Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam@sbcglobal.net