2014-04-15 Phising Scam Alert Posing As Experian - Credit peace-of-mind for $1.

This one appears to be from Experian purporting to provide your credit score & other information for $1.

===== Begin Phishing Email (Images not displayed) =====

knickers butter raiment longsuffering digress menarche grasshopper. hallucinogen barbecue forestry defy tank krypton expanse nether monied. red whereas slug snippy turbofan godsend eligible exempt mystery pertinence ma hemophilia show deplore touchdown pharisee retrorocket worrisome upstate. seismolog pencil sound tombstone lute ancient bedroom ecclesiastic sociability coach defend anyhow syringe coffeepot potboiler fixings. paradigm archeolog wholesale scales postulate mete barley rug. hangmen sprocket chordate x-rated adversary coffeepot urgency hangmen barbecue immutable grandfather chorale unicef stimulus hurt congruity lingua hebrews. competent platitude sprig tram laos supplicate basilica tombstone square crease darkle adherent citric backwood spokesman lowboy chauffeur.

 <http://bit.ly/1hGKEL1> 

 <http://bit.ly/1hGKF1h> 

 <http://bit.ly/1hGKDqf>

 <http://bit.ly/1hGKF1k> 

 
latitude extravagance stream thud mercury expediency thanatolog bazaar pragmatism starboard cavort huzza dabble fluff southeast rebuke.

===== Begin Phishing Scam Email (Images displayed) =====

r.









===== Begin Phishing Scam Email Header Info =====

Return-path: <expr@inspiredrush.co.nr>
Received: from inspiredrush.co.nr ([unknown] [50.22.237.222])
 by vms172075.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N43004KADX1G9B0@vms172075.mailsrvcs.net> for
 <recipient_address_omitted>; Tue, 15 Apr 2014 16:48:38 -0500 (CDT)
Date: Tue, 15 Apr 2014 14:48:34 -0700
From: "Experian" <expr@regiment.inspiredrush.co.nr>
Subject: <recipient_address_omitted>, Credit peace-of-mind for $1.
X-Originating-IP: [50.22.237.222]
To: <recipient_address_omitted>
Message-id:
 <081711-081711-29.PZWSPKpLu4dP+MEVRlBMB/VWYEOqA9S6BiP@inspiredrush.co.nr>
MIME-version: 1.0
Content-type: text/html
Content-transfer-encoding: 7BIT
Original-recipient: rfc822;<recipient_address_omitted>

2014-04-14 Phishing Scam Alert - Starting salary over $89k

I hate it when people prey on the unemployed.

===== Begin Phishing Email (Images not displayed) =====

glade steal loyal mimetic terrain venetian updraft beep hairdresser bird grandiose burmese dexter buckeye guantanamo fit chap fritter ebb bongo pedagog peter mercuric. myopic lackadaisic emulsification cut tomato threelegged possess dovetail darkle let plaudit expanse pique forsook innuendo hoyden forsook luminance calibrate fritter. touchdown combust lansing system dependent personae excruciate.  

 <http://bit.ly/1lYuXS4> 

 <http://bit.ly/1iFZCwQ> 

 <http://bit.ly/1lYuXS0>

 <http://bit.ly/1lYv0x5>  

railing paperweight season afro mattock skid gaudy hunker abbe keyboard kenyan dovetail stale cheque gadget. treason lingua trafficked quaint found wet caiman hike bassoon ma'am teapot whimsy serve spit synapse zest hunker homicide monied tory lewd showman florentine. orphan successive brookside wayfaring brookside cookie burl cardiolog rung stalactite thenceforwards. bark afterimage crestfallen mango grapheme sorption nightgown greengrocer competent strychnine amnesty lackadaisic ishmael lingua track bassoon armature transatlantic whimsy hurt scamp regiment. decoy plunge mantrap legislature topcoat torment banjo lacerate olympic sixteen decoy.

===== Begin Phishing Email (Images displayed) ===== loyal mimetic terrain venetian updraft beep hairdresser bird grandiose burmese dexter buckeye guantanamo fit chap fritter ebb bongo pedagog peter mercuric. myopic lackadaisic emulsification cut tomato threelegged possess dovetail darkle let plaudit expanse pique forsook innuendo hoyden forsook luminance calibrate fritter. touchdown combust lansing system dependent personae excruciate.








===== Begin Phishing Email Header Info =====

Return-path: <sara@neobux.com>
Received: from 192.155.247.108-static.reverse.softlayer.com
 ([unknown] [192.155.247.108]) by vms172061.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N3Y00LE432BIJ90@vms172061.mailsrvcs.net> for
 <recipient_address_omitted>; Sat, 12 Apr 2014 20:06:11 -0500 (CDT)
Date: Sat, 12 Apr 2014 18:06:07 -0700
From: "Sara" <sara@loquacious.neobux.com.>
Subject: Starting salary over $89k - Starts 15-April - Respond
 now,eric.cissorsky@verizon.net
X-Originating-IP: [192.155.247.108]
To: <recipient_address_omitted>
Message-id: <289970-289970-79.PZWSPKpLu4dP+MEVRlBMB/VWYEOqA9S6BiP@neobux.com>
MIME-version: 1.0
Content-type: text/html
Content-transfer-encoding: 7BIT
Original-recipient: rfc822;<recipient_address_omitted>

2014-04-14 Phishing Scam Alert - Verizon Wireless

Here's another phishing scam.  Notice in the from field Verizon Wireless is spelled with a capital I in Wireless.  Be careful if you receive this one the entire image is a malicious link.  I clicked it by accident luckily McAfee Site Advisor prevented the page from loading.

===== Begin Phishing Email (Images not displayed =====

 <http://www.allekoten.be/lang/tio.aspx>

===== Begin Phishing Email (Images displayed) =====



===== Begin Phishing Scam Header Info =====

Return-path: <tdvvjo@myacc.net>
Received: from svm302.centos-server.net ([unknown] [173.230.255.141])
 by vms172087.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N4000GETNVWOM00@vms172087.mailsrvcs.net> for
 <recipient_address_omitted>; Mon, 14 Apr 2014 05:31:56 -0500 (CDT)
Received: from orp195.static.otenet.gr ([62.103.76.145]:14031 helo=myacc.net)
 by svm302.centos-server.net with esmtpa (Exim 4.82)
 (envelope-from <tdvvjo@myacc.net>)
 id 1WZdxy-0006Vo-Rt for <recipient_address_omitted>; Mon,
 14 Apr 2014 14:18:19 +0400
Date: Mon, 14 Apr 2014 13:18:57 +0300
From: Verizon WIreless <zzselne@myacc.net>
Subject: <recipient_address_omitted> your payment is pending
X-Originating-IP: [173.230.255.141]
To: <recipient_address_omitted>
Message-id: <20140414131857.A4D8B604702831D8@myacc.net>
MIME-version: 1.0
Content-type: text/html; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
X-AntiAbuse: This header was added to track abuse,
 please include it with any abuse report
X-AntiAbuse: Primary Hostname - svm302.centos-server.net
X-AntiAbuse: Original Domain - verizon.net
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - myacc.net
X-Get-Message-Sender-Via: svm302.centos-server.net: authenticated_id:
 sales@provensoft.com
X-Source:
X-Source-Args:
X-Source-Dir:
Original-recipient: rfc822;<recipient_address_omitted>

2014-04-14 Phishing Scam Alert - Target Gift Card

This looks almost identical to the Walmart Gift Card Scam I blogged about on 2014-04-09.

===== Begin Phishing Email (Images hidden) =====

cowgirl vacationland frivolous jurisdiction binaural hunker anglicise burnt lenient altruist stammer solidi.

 <http://bit.ly/1gkyndW> 

 <http://bit.ly/1gkyne2> 

 <http://bit.ly/1gkyoih>

 <http://bit.ly/1gkyne6> 

 
mercuric bird vanquish trilogy dovetail. theorist nasal histrionic acquiescence skullcap complementarity cerebrate suckling dignify sparrow throttle. unitarian ktext statesmen killjoy toll reckless centimeter corporation. quadripartite assassinate propulsion absurd ordeal berkshire reportorial vax strap ale shoestring nigerian skyhook negate slat philadelphian thereinafter tier cramp revelation wattage blandish partition.

===== Begin Phising Email (Images displayed) =====








===== Begin Phishing Email Header Info =====

Return-path: <targetvouchercode@neobux.com>
Received: from 173.192.183.240-static.reverse.softlayer.com
 ([unknown] [173.192.183.240]) by vms172071.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N3W00DQ9CN8HD50@vms172071.mailsrvcs.net> for
 <recipient_address_omitted>; Fri, 11 Apr 2014 21:37:56 -0500 (CDT)
Date: Fri, 11 Apr 2014 19:37:54 -0700
From: "Target Voucher Code" <targetvouchercode@cranny.neobux.com.>
Subject: Target Survey Winner,eric.cissorsky@verizon.net
X-Originating-IP: [173.192.183.240]
To: <recipient_address_omitted>
Message-id: <271835-271835-18.PZWSPKpLu4dP+MEVRlBMB/VWYEOqA9S6BiP@neobux.com>
MIME-version: 1.0
Content-type: text/html
Content-transfer-encoding: 7BIT
Original-recipient: rfc822;<recipient_address_omitted>

2014-04-10 Link of the Day: Project Honey Pot

I just used this site in my last post so it seems fitting to make it todays LOTD.  Membership is free and it offers a wealth of information on spam, scams and other assorted nasties.

Project Honey Pot

Any/all products/services are provided for informational purposes only. The author does not endorse any single product.

Use these products/services at your own risk.

2014-04-10 Email Scam from "Outsource Consulting Inc.."

So glad they "selected" me to work for them.  Especially since its in a field I have no experience or expertise in.  Check out the mismatch in the return-path and from fields.  Looks like World4You has a compromised email server.

Check out what the Honey Pot Project has to say about mailserver 81.19.145.152/antispam02.world4you.com:

http://www.projecthoneypot.org/ip_81.19.145.19

You just have to love the irony of an antispam server being used to send spam. 


===== Begin Scam Email =====

Good morning Eric Cissorsky,

Congratulations! Based on your Curriculum Vitae on www.careerbuilder.com we wanted to confirm that you have been selected to work for Outsource Consulting Inc..

The job we are proposing is that of a F.S.A.. Salary rate is 2300 USD and 8% commission.

Probationary period - 30 working days from the day you apply.

Employee Benefits Include:                                                       

- Dental Care    

- Health care

- Vacation - 4 weeks per annum

- And others

All benefits take effect only after probationary period.

We would hope to start working with you in a short time. Please report to Mr. Jason Adams as soon as you receive this offer, for documentation and orientation.

Please fill out and send us the form below with your Contact information to verify your identity and interest in this position.

------------------F O R M _________F O R M----------------- Full Name: ____________________

Address: ______________________

Phone: ________________________

Preferred call time: _______________

------------------F O R M _________F O R M-----------------

Thank you and waiting for contact from you asap.

Sincerely,

HR Consultant
Mr. Jason Adams

===== Begin Scam Header Info =====

Return-path: <sema-drive@www82.world4you.com>
Received: from antispam02.world4you.com ([unknown] [81.19.145.19])
 by vms172085.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N3T00337NDEKEA0@vms172085.mailsrvcs.net> for
 <recipient_address_omitted>; Thu, 10 Apr 2014 10:36:55 -0500 (CDT)
Received: from [81.19.145.152] (helo=www82.world4you.com)
 by antispam02.world4you.com with esmtp (Exim 4.77)
 (envelope-from <sema-drive@www82.world4you.com>)
 id 1WYH22-0003ZJ-A9 for <recipient_address_omitted>; Thu,
 10 Apr 2014 17:36:50 +0200
Received: by www82.world4you.com (Postfix, from userid 1267)
 id 4171753D4C33; Thu, 10 Apr 2014 17:36:50 +0200 (CEST)
Date: Thu, 10 Apr 2014 17:36:50 +0200 (CEST)
From: Mr. Jason Adams <outsourceconsultingus@gmail.com>
Subject: Eric Cissorsky April 10, 2014 11:36:46 AM
X-Originating-IP: [81.19.145.19]
To: Eric Cissorsky <recipient_address_omitted>
Message-id: <491191.20140410193646@gmail.com>
MIME-version: 1.0
Content-type: text/plain
Content-transfer-encoding: 7BIT
Original-recipient: rfc822;<recipient_address_omitted>

2014-04-09 Phishing Alert: $25 Walmart Gift Card

I received this a few days ago.  Take notice of the gibberish hidden in the message body.  This is visible because I use a black background and the HTML is coded to display the text as white against a white background rendering it invisible to the recipient. 

If you Google the email address in the header (walmartvoucher@statcounter.com)the ONLY result returned leads to this page:

http://listofscams.blogspot.com/2011/04/guessologycom-scam-alert.html


===== Begin Phish Email =====

astringent whiny thwack indies heyday referable diversionary fragment journeymen downcast lackadaisic.

ducting credible flinch behavior v accord epicene. donor mentor buckeye pants bolt derivate taxi norm attenuate pound prismatic origin mayhem abrasive testbed merchant putty. fantastic swap hightail lame morale. mouse bloodstain prove motto epistolatory pine pebble seclusion mystery discomfit northumbria spire airdrop demean feudal feedback whop toward bassoon. halogen organ smug bellhop interpret highhanded knockout bray payload hike bless relieve semaphore audio cave committeeman turbanned filling spangle pubescent kava renown. harrass prismatic opulence spoken.


===== Begin Phish Header Info =====

Return-path: <walmartvoucher@statcounter.com>
Received: from 173.192.221.232-static.reverse.softlayer.com
 ([unknown] [173.192.221.232]) by vms172095.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N3H00N6MLCN2F60@vms172095.mailsrvcs.net> for
 <recipient_address_omitted>; Thu, 03 Apr 2014 22:22:00 -0500 (CDT)
Date: Thu, 03 Apr 2014 20:21:49 -0700
From: "Walmart Voucher" <walmartvoucher@sullen.statcounter.com.>
Subject: Congratulations on your Walmart Survey
 Reward,<recipient_address_omitted>
X-Originating-IP: [173.192.221.232]
To: <recipient_address_omitted>
Message-id:
 <177552-177552-19.PZWSPKpLu4dP+MEVRlBMB/VWYEOqA9S6BiP@statcounter.com>
MIME-version: 1.0
Content-type: text/html
Content-transfer-encoding: 7BIT
Original-recipient: rfc822;<recipient_address_omitted>

2014-04-09 FTC Scam Alert: "Pending FTC complaint" emaiils are fakes

“Pending FTC complaint” emails are fakes by Amy Hebert Consumer Education Specialist, FTC Have you gotten an email with the subject line “Pending consumer complaint” that looks like it came from the FTC? The email warns that a complaint against you has been filed with the FTC. It asks you to click on a link or attachment for more information or to contact the FTC. These emails pull out all the stops to look official: They have an FTC seal, references to the “Consumer Credit Protection Act (CCPA)” and a “formal investigation,” and what look like real FTC links. The truth is that they’re fakes. Read more >   SUBSCRIBER SERVICES:  Manage Preferences  |  Unsubscribe  |  Help This is a free service provided by the Federal Trade Commission.

Easter Holiday Phishing Scams and Malware Campaigns

From US-CERT:

Easter Holiday Phishing Scams and Malware Campaigns

2014-04-07 FTC Scam Alert: Fake IRS Collectors

Fake IRS collectors are calling by Lisa Lake Consumer Education Specialist, FTC This time of year is often taxing for many consumers. Scams aimed at stealing taxpayers’ money make the season more stressful. Read more >   SUBSCRIBER SERVICES:  Manage Preferences  |  Unsubscribe  |  Help This is a free service provided by the Federal Trade Commission.

2014-04-07 Link of the Day: Data Breach Today

Stay abreast of the latest data breach news, what you can do to prevent them and how to handle a breach at your organization.

Data Breach Today

Any/all products/services are provided for informational purposes only. The author does not endorse any single product.

Use these products/services at your own risk.

How To Respond To A Data Breach

From Network World:

How To Respond To A Data Breach

Here's a summary of the key points:

• Establish a response team
• Train employees on their roles and responsibilities
• Prepare reports and submit them to the appropriate parties
• Assess the extent of the breach
• Offer assistance to affected individuals
• Perform a post mortem

Its always better to get ahead of the situation.  If you suspect you've been breached make the announcement yourself and detail your intended response.  Allowing a third party to go public with the information will only result in a public relations nightmare and will cost much more in the long run.

2014-04-07 Email Scam of the Day #2

This one came with a Word attachment titled "WESTERN_UNION_WINNING_IDENTIFICATION_LETTER.doc" with a file size of 977kb.  Notice the different email addresses in the return-path/from and reply-to header fields.


==== Begin Scam Email =====

 

Open Your Attachment For More Details

===== Begin Scam Email Header Info =====

Return-path: <unionlo65@gmail.com>
Received: from omp1012.access.mail.bf1.yahoo.com ([unknown] [66.196.81.136])
 by vms172089.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N3M00J52615R720@vms172089.mailsrvcs.net> for
 <recipient_address_omitted>; Sun, 06 Apr 2014 09:39:07 -0500 (CDT)
Received: (qmail 43263 invoked by uid 1000); Sun, 06 Apr 2014 14:39:05 +0000
Received: (qmail 52426 invoked by uid 60001); Sun, 06 Apr 2014 14:39:03 +0000
Received: from [41.150.143.170] by web5706.biz.mail.ne1.yahoo.com via HTTP;
 Sun, 06 Apr 2014 07:39:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024;
 t=1396795143; bh=kpQrbCrXyq3FnLKr2y0DrW4WT4zHjn7VpJR6u1tztSA=;
 h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
 b=nNJWG3H72vLHM+zZgl/an2Md+Zi7d9WatwQP9KWGF+xjCkufm/K/5uq6/QdBneWBWaFVhfU1sBGHHFDUtNFhN+rmEEa48Nv9Et9h6tLJ4hws0VB2DQQI6oQX4FERHPCYID++DuxzOOdN9c77VioFmfYtXOiuoNKgCAXADSKBAXk=
Date: Sun, 06 Apr 2014 07:39:03 -0700 (PDT)
From: Western Union Lottery <unionlo65@gmail.com>
Subject: Congratulations! You have won
In-reply-to: <1396791543.64860.YahooMailNeo@web5704.biz.mail.ne1.yahoo.com>
X-Originating-IP: [66.196.81.136]
To: undisclosed recipients: ;
Reply-to: Western Union Lottery <mrfredrichard2013@yahoo.co.za>
Message-id: <1396795143.8634.YahooMailNeo@web5706.biz.mail.ne1.yahoo.com>
MIME-version: 1.0
X-Mailer: YahooMailWebService/0.8.182.648
Content-type: multipart/mixed; boundary="Boundary_(ID_qVeOTNi3bBw9jDX9SE/nyA)"
X-YMail-OSG: L6fAxeoVM1kMOjyFKDaNiG0ac_GNCoSe69lZI162yylvSxT
 dRnWJlb0QWbbuKHywtYD6RIR_Qv1PDqddiazG1P0UVuX3FFsXUD8.j8KMstz
 O_DetDO2aXCB98UsCwRFpe66Qq1qGkp4gZBn2wwpneP2UMTkkdz3jd_NU0At
 hQAn42sCJmpDSngBubsjV_czPqoKTvAEqCoOfoWAugaikH5B.i7DqKGkm2U4
 BvQmGrbgKe_svsW25fAhszc0p1_LcR9vMoUXIRuG0f9fW3Yp6pjHvsBHtHKT
 uOFY5UkWxSRZVVmOQw0OVg.Z2AHejFkLU8Trf6V7oX9PeMXES3AFb.yjn2Yc
 GWwLpju8yy1pyRhBGRsct9iXY9D1x_NMvw0_WspZvC2hdoclFJrKjZmKpWKH
 5rDq.pfR5eS8rE2qNBzJAn7kATuGC8GIpgU4ND8fILGDXjEPEP24T4ibBfzm
 55TJsbtODCMmNka5RipTfpYsLHgUqcPkSDJn5bweyii1dM79loMMYJWnmE7q
 KJcef77JGkswfyu8utbjuPXm9Ed9pDg8wVij6sqqkSQQHDZj3A0PgX.El
X-Rocket-MIMEInfo:
 002.001,CgpPcGVuIFlvdXIgQXR0YWNobWVudCBGb3IgTW9yZSBEZXRhaWxzIAEwAQEBAQ--
X-RocketYMMF: webzol
References: <1396791310.83680.YahooMailNeo@web5706.biz.mail.ne1.yahoo.com>
 <1396791418.12776.YahooMailNeo@web5703.biz.mail.ne1.yahoo.com>
 <1396791543.64860.YahooMailNeo@web5704.biz.mail.ne1.yahoo.com>
Original-recipient: rfc822;<recipient_address_omitted>

2014-04-07 Email Scam of the Day #1

When you receive an email from yourself that you didn't send it's a scam. Take note of the email address in the body of the message and the one given in the header return-path section.

===== Begin Scam Email =====

If you have excellent administrative skills, working knowledge of Microsoft Office, a keen eye for detail, well-versed in the use of social networking sites such as Twitter and Facebook, are organized, present yourself well and are a team player with the ability to work independently, are reliable and punctual and can understand and execute instructions are determined to work hard and succeed - we need you.

 

Please call or email us for details of the job: Marcel@superevausa.com

===== Begin Scam Email Header Info =====

Return-path: <highboys39@google.com>
Received: from google.com ([unknown] [199.192.224.137])
 by vms172095.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N3L00GI4905FG40@vms172095.mailsrvcs.net> for
 <recipient_address_omitted>; Sat, 05 Apr 2014 21:46:40 -0500 (CDT)
Received: from 199.192.224.137(helo=verizon.net) by verizon.net with esmtpa
 (Exim 4.69) (envelope-from )
 id 1MM5GY-2819fc-B3 for <recipient_address_omitted>; Sat,
 05 Apr 2014 21:47:13 -0500
Date: Sat, 05 Apr 2014 21:47:13 -0500
From: <recipient_address_omitted>
Subject: Re: CV 06
X-Originating-IP: [199.192.224.137]
To: <recipient_address_omitted>
Message-id: <1758031156.5MVX98NX867117@verizon.net>
MIME-version: 1.0
X-Mailer: zmqe_04
Content-type: text/plain; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Original-recipient: rfc822;<recipient_address_omitted>

2014-04-01 Another FTC Scam Alert

No Foolin’ — The clock is ticking for students seeking financial aid by Colleen Tressler Consumer Education Specialist If you’re a college student seeking financial aid, fill out the Free Application for Federal Student Aid (FAFSA) as soon as you can. Yes, I know, the deadline for submitting the FAFSA is June 30th, but many states and schools allocate funds on a first-come, first-served basis. What’s more, some states have deadlines for filing the FAFSA to be eligible for certain kinds of aid. Read more >   SUBSCRIBER SERVICES:  Manage Preferences  |  Unsubscribe  |  Help This is a free service provided by the Federal Trade Commission.

U.S. notified 3,000 companies in 2013 about cyberattacks

If your organization has suffered a cyber attack fear not, you're not alone.  From the Washington Post:

U.S. notified 3,000 companies in 2013 about cyberattacks

How much will a cyber incident cost your organization?

Booz Allen Hamilton in conjunction with The Economist Intelligence Unit has just released a tool to calculate the damage of a cyber incident.  Using information you provide the tool, Cybertab, calculates the cost freely and, most importantly, anonymously.
Designed for information security professionals and executives the cost of a potential incident can be determined by using it in Planning Mode.  If your organization has already experienced an incident, Reporting Mode will help you determine the loss suffered by the attack.


Cybertab - Tallying the bill from cybercrime

Any/all products/services are provided for informational purposes only. The author does not endorse any single product.

Use these products/services at your own risk.

2014-04-01 FTC Scam Alert

It’s not your day in court by Amy Hebert Consumer Education Specialist, FTC “Hereby you are notified that you have been scheduled to appear for your hearing that will take place in the court of Tallahassee in April 02, 2014 at 09:00 am.” Signed, the Clerk to the Court. Sound official? Like the fake funeral notices we wrote about last month, emails like this have been going around trying to convince concerned — or curious — people to click on the supposed “court notice.” Don’t do it. Read more >   SUBSCRIBER SERVICES:  Manage Preferences  |  Unsubscribe  |  Help This is a free service provided by the Federal Trade Commission.

2014-04-01 Nigerian 419 of the day

It wouldn't be April Fools Day if I didn't get a scam email.

===== Begin Scam Email =====
--

Dear Sir/Madam,

Greetings to you and your loved ones.

I am The Acting Chief Financial Officer of Ulster Bank located in Belfast, Northern Ireland.

I solicit your audience to discuss some financial matters with you, if you would be well disposed to giving me a piece of your time.

On receipt of your response in affirmation of your willingness to work with me, I will divulge details for your perusal

Kindly send to me your phone, fax numbers and addresses to enable my further discussion.

Best regards,

Mike Morgan

REPLY TO

lucianakimus@oi.com.br

mike2014b@mail.bg

===== Begin Scam Header Info =====

Return-path: <info@acicsa.com.py>
Received: from mail.intercoop.com.py ([unknown] [201.217.50.174])
 by vms172057.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0N3C00KFHX7A7240@vms172057.mailsrvcs.net> for
 <recipient_address_omitted>; Tue, 01 Apr 2014 09:50:00 -0500 (CDT)
Received: (qmail 11383 invoked by uid 520); Tue, 01 Apr 2014 11:38:19 -0300
Received: from 192.168.0.4 by serv-ftp
 (envelope-from <info@acicsa.com.py>, uid 519) with qmail-scanner-1.25-st-qms
 (clamdscan: 0.96/10755. spamassassin: 3.1.9. perlscan: 1.25-st-qms. Clear:RC:0
 (192.168.0.4):SA:0(-1.4/2.5):. Processed in 0.281442 secs); Tue,
 01 Apr 2014 14:38:19 +0000
Received: from unknown (HELO webmail.intercoop.com.py)
 (info@acicsa.com.py@192.168.0.4) by mail.intercoop.com.py with SMTP; Tue,
 01 Apr 2014 11:38:17 -0300
Received: from 41.58.31.133
 (SquirrelMail authenticated user info@acicsa.com.py) by
 webmail.intercoop.com.py with HTTP; Tue, 01 Apr 2014 03:40:05 -0300 (PYST)
Date: Tue, 01 Apr 2014 03:40:05 -0300 (PYST)
From: "MIKE MORGANS" <info@acicsa.com.py>
Subject: Dear Sir/Madam,
X-Originating-IP: [201.217.50.174]
Reply-to: lucianakimus@oi.com.br
Message-id: <e9913ff956316ab09891a17b6b297486.squirrel@webmail.intercoop.com.py>
MIME-version: 1.0
Content-type: text/plain; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Importance: Normal
X-Priority: 3 (Normal)
X-Antivirus-MYDOMAIN-Mail-From: info@acicsa.com.py via serv-ftp
X-Antivirus-MYDOMAIN: 1.25-st-qms (Clear:RC:0(192.168.0.4):SA:0(-1.4/2.5):.
 Processed in 0.281442 secs Process 11343)
User-Agent: SquirrelMail/1.4.15
Original-recipient: rfc822;<recipient_address_omitted>
X-Spam-Status: No, hits=-1.4 required=2.5

Cloud Wars

Who says competition isn't good for the consumer?  Cloud service providers are making significant price cuts to their services.  If your organization is considering using a cloud service this is good news.

From Network World:

Microsoft slashes Azure prices, introduces new basic tier

Any/all products/services are provided for informational purposes only. The author does not endorse any single product.

Use these products/services at your own risk.

2014-04-01 Link of the Day: CheckPoint Top 10 SMB Security Best Practices

Since it's April Fools Day I was going to have some fun with todays LOTD.  A good old fashioned Rick-Rolling or All Your Base Are Belong To Us redirection would be a good way to have some fun today.  But after thinking about it I decided cybersecurity is a serious subject and to just stick to business. 

After all, the hackers aren't taking off today.  I doubt your organization would care for any April Fools jokes they might play on it.

CheckPoint Top 10 SMB Security Best Practices (requires registration)

Any/all products/services are provided for informational purposes only. The author does not endorse any single product.

Use these products/services at your own risk.