Managed Solutions » Email

Dr. Dan wants to buy Real Estate (Phishing)

Joe Hackman — Thu, 12 Aug 2010 15:40:29 +0000

We’re paid to be paranoid here at Managed Solutions. When this message arrived in my inbox today it was a rarity. Rare because it is one of very few phishing Emails that have bypassed my anti-spam mechanisms. Phishing is a process by which a criminal pretends to be a legitimate entity in an effort to gain passwords, identity, bank account or other private data. Here is the text of the message:

I am interested in purchasing a private residence in your country or in any country you are well-acquainted with.

The Property must be located in a well-reserved,serene,secure and highly-hygienic environment because I am most particular about the safety and sound health of my family.
I wish to make this transaction with you in a very secret and confidential manner due to my position as a cabinet minister here in my country Ghana.

Therefore,upon response from you I will connect you with my agent here whom I trust so much to represent my interest in this purchase.franciskweme2007@[hidden].com
Thank you and accept my kindest regards,

Dr. dan

Want to complete this article?

What issues do you see with the text of this message and why would I assume that it is a Phishing Email? Complete this story via comment and we’ll feature your comment as a part of the article and link back to your website.

We have a winner, David Schur completed the article via this comment on Facebook:

David Schur – I’ll take a shot Joe.
1) does not address you by name. Nobody will buy your house, or send you millions of dollars without knowing who the heck you are
2) Total lack of pii. If this was legit, they would know your address, which is the relevant pii in this case. My bank or cc includes the last 4 digits of my account to let me know the email is real.
3) Typo’s…when will the phishers learn that simply hiring a native english speaker to proofread would make a difference (maybe there is ba business opportunity here)
4) simple common sense…to good to be true = false…100% of the time

This won’t work for a real hack…but luckily phishers these days never invest in data that connects your email to any meaningful form of pii…luckily axiom 4 will ALLWAYS be true

Joe’s comment – I really like David’s rule #4, I think Phishers best tool is exploiting people’s greed. Also David had no desire to have a link back to anywhere so I asked him what Charity he likes, here is his response:

“American Red Cross…when bad stuff happens they get my money…then I can safely and with good conscience ignore the inevitable scam charity emails” – David Schur

Using the proper Importance Flag with Email

Joe Hackman — Mon, 02 Aug 2010 16:19:54 +0000

I received an Email Friday from a friend, I receive a lot of Email so sometimes I don’t get a chance to review non critical business Email until I have some free time. This morning while responding from the message I realized that part of the message involved a timely issue for Friday evening. The title did not indicate it and the message was flagged normally. This incident was a reminder to me of the usefulness and etiquette of the Importance options with Email correspondence. Here is my interpretation of the three options:

Low Importance

I recommend using this flag when sending Emails to people who you know to be very busy that are not time critical. Chances are busy people will respond promptly to all most messages anyway but it is a nice way to say “Hey I know your time is valuable, there is no rush here.”

Not Flagged or Normal Importance

Most Email fits in this category, most people don’t flag messages at all or use the subject line of the Email to indicate the nature of the message.

High Importance

This option is sometimes over utilized, I’ve seen some Email users that seem to flag a large percentage of their messages as high importance. This is acceptable if it is factual. I recommend using this option for messages where the response required is timely or the information will be considered urgent by the recipient. In conjunction with some carefully crafted subjects you can provide a range of urgency to the recipient.

Here is the location of this tag in Microsoft Outlook 2010:

Check out more Quick Tips.

Anatomy of a Phishing Email

Joe Hackman — Mon, 14 Jun 2010 06:23:11 +0000

I encountered a great opportunity this evening, the opportunity to share an inside look of a Phishing Email. What is Phishing?

“In the field of computer security, phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.” – Wikipedia

What I noticed was an Email purportedly from Bank of America telling me that there was an “Account Resolution Required”:

Message in Outlook Allegedly from Bank of America

I scanned over to the preview pane and noticed that it had a link that appeared to be correct, so I hovered over the link to see if the link was spoofed and to no big surprise, it was. Here is how the message looked in my preview pane, I did not download pictures because that is a popular way for spammers/crooks to confirm Email addresses of their targets/victims:

Full Phishing Email Screenshot

Let me further clarify in lay terms, the link that reads:

https://www.bankofamerica.com/home/1244618/ddjdfdkfi126.aspx?screenid=Update_Acct

is actually:

http://prostyle-esports.nl/index.php

and this is evident when I hover over, or place my mouse cursor on the “alleged” link. This is a tactic you can use to check links you are unsure of. However I should clarify that it doesn’t always work. There have been occasions where this has been spoofed effectively typically it has to do with the Email client or Browser and security patches on your computer.

Testing the Link

Using a test environment I pasted the link to see what the target site looked like:

Blocked - Forgery

I was pleased to see it had been blocked, this saved me the time of researching and Emailing the Internet Provider involved. After confirming this I used “properties” on Outlook to get the header information, there is a lot of information but plenty of clues to let me know that this message was not authentic (had everything else appeared right, which most certainly the SSL certificate warning would have popped up unless it was an unprecedented forgery!). Here are a few of the more obvious lines I parsed from the headers:

Received: from User ([82.128.0.69]) by post.strato.de (mrclete mo25) (RZmta
23.3) with ESMTP id 20016am5E507CT ; Mon, 14 Jun 2010 07:43:29 +0200 (MEST)
Reply-To:
From: Bank of America

In the above examples, you can see that the message replay and from don’t match and that the mail server is post.strato.de not a likely mail server for Bank of America (perhaps for Deutsche Bank next time guys?). Also after running the IP address of the sender 82.128.0.69 on Arin.net I was able to determine that it was a European Address (which I had already figured due to the .de domain on the mail server, but it was further validation):

Output of Arin.net Whois - RIPE

There are a lot of ways to spot fraudulent/Phishing Emails. Our advice to our clients is if they are not 100% certain we recommend they forward the messages to us for analysis. Most of these kinds of messages are blocked and we don’t see them, but if something doesn’t look quite right it probably isn’t.

Possible Email Outage

Joe Hackman — Fri, 18 Dec 2009 22:08:17 +0000

12/18/2009 1407 Pacific – Our hosting provider is having issues with one of their data centers and it may affect some of our clients Exchange or Email accounts. We will update you as soon as more information is available.

12/18/2009 1414 Pacific – Services have been restored, if you note any lingering issues please contact us.

Warning Facebook Phishing Email

Joe Hackman — Thu, 10 Dec 2009 17:07:21 +0000

Today I noticed a peculiar Email message from Facebook in my Quarantine. A quick investigation confirmed what I had suspected, it was a phishing attempt to compromise my Facebook account or other personal information. This video demonstrates what this message looked like and how the URL in the link gave away that it was not Facebook but in fact a .me.uk address:

Quick Tip Email Sorting

Joe Hackman — Sun, 15 Nov 2009 20:30:38 +0000

Use the “from” and “subject” fields to sort Emails while you are cleaning up your inbox. You should find it easier to get through your back log of messages by addressing issues with certain individual(s)… or certain subjects all at once. Quite often the most recent Email of a certain subject contains all the prior information and the older ones can be deleted.

Webmail/Spam Quarantine Howto

Joe Hackman — Sat, 07 Nov 2009 07:17:05 +0000

Watch this video to learn how to access and use the Webmail/Spam quarantine options as well as our forwarding and auto responder options. If you cannot view or don’t see the video the analog directions follow:

There are 2 important things you should know about your new Managed Solutions email account.

1. Your spam quarantine is by default only accessible via the webmail interface.
2. You have flexibility if you do not like the default Spam quarantine options.

Step 1 – Login to Webmail – Point your browser to https://webmail.managedsolutions.com
Step 2 – type the email address of your account and password provided. Contact us if you’ve forgotten or lost your password.

The webmail looks something like this:

Once logged in you will know if there are unread messages in your Spam quarantine by looking at the folder on the left hand side under Email Folders something like this:

In this example there is one unread message in the inbox and 116 messages in the Spam Quarantine. You can then click the Spam folder to manage those messages. The interface is fairly intuitive. Should you decide you wish to modify the Spam Quarantine options, access the Settings button all the way on the top right of your browser window (just above search). Select the Spam Settings Folder and make the adjustments that you favor. Be sure to click save if you do make a change.

We hope you’ve found this article to be helpful. Let us know if there is anything we can do to improve it.

KB910721 Spam and Virus

Joe Hackman — Thu, 25 Jun 2009 05:11:59 +0000

Just yesterday I answered a question on LinkedIn related to new scams that are circulating on the Internet. Not less than 24 hours later I saw something that was new, creative and likely to cause some damage as it actually harbors the payload Win32/Kryptik.TL – a Trojan Horse Virus that as of 6/24/2009 is not circulating much. While the format they sent has the Microsoft look and feel (Top Image), it does not duplicate the email format of Microsoft notices (Bottom Image).

Phisher Shutdown

Joe Hackman — Fri, 31 Aug 2007 05:03:37 +0000

This morning I happened to get a Phishing message from the contact form on this website. It was carefully crafted and was devised to obtain routing and bank information to most certainly relieve us of any and all funds in the account. When I went to investigate the site, I quickly learned that it had already been removed from the dns records of the hosting provider – precisely what I had intended to inform them of. Someone had already reacted to this would be phisher and stopped them in their tracks. This is always nice to see because often times when we do something as a responsible netizen administrators of websites and hosting companies lack the resources to respond and address the threats.

419 Death Threat Spam

Joe Hackman — Wed, 09 May 2007 04:59:07 +0000

A particularly despicable scam is circulating this week. It involves a Spam email that contains a “death threat” the sender claims to be a hit man hired to kill you. In typical fashion the grammar and spelling are poor. This could indicate the authors are not skilled in the English language though it could also be an attempt to protect the guilty and obscure the trail of the actual perpetrator(s). If you happen to receive this Spam don’t worry, just delete the message. They are using this method to validate targets for future scams and Spam. If you do respond you will become a validated target. You can also contact the IC3 in the United States at www.ic3.gov to file a formal complaint. The entire text of the Spam is as follows (compliments of Swa Frantzen @ ISC):

“Hello, I wish to let you know that i have been paid by a client to assasinate you at convenience,and i have signed a contract of $650,000 yesterday for this.I have never met you before,but they gave me the full description of your identity and contact,together with your photograph which my boys have used to trace you.

The reason why they want you Dead is not disclosed to me as i was not allowed to know,but you are now not better that the dead ok.

My BOYS are now contantly watching you,they are following you-home,office,everywhere…..,you go and they are waiting for my instruction to terminate you.And they will strike at convenience.

THIS IS MY MESSAGE-

LISTEN VERY WELL !!!!,the Police cannot do much to help you out in this right now because you are being watched,any such attempt is very risky cause you will push us to terminate your life without option. Your calls are not safe also.In fact you are traced. I have no business with you but at least i have cleared the way as a pro-,but you may have one chance to live again if you can contact me not latter that 24 hours after this mssage.

GOODLUCK!!!”