My Million dollar ATM is ready for delivery??

I have just received an interesting Scam mail. Think it will be useful to share with all my readers.



The email claims to be from FedEx. They are ready to deliver "my" million dollar ATM card in GHANA.

-Below are the extract-

Dear Valued Customer.

The office of the FedEx Managements in the capital city of ACCRA GHANA do hereby wish to inform you that your ATM card package is ready for delivery.

The issuing bank of this ATM card has instructed us to inform you that your card has been credited with the total sum of US$4,750,000.00 (Four Million-Seven Hundred & Fifty Thousand Dollars) which is now accessible and you can make your withdrawal from any ATM machine worldwide.

This ATM card with the PIN code and other vital documents has peen packaged into an Envelop which has been assigned for immediately delivery but unfortunately, the issuing bank has cleared (PAID) the delivery fee, insurance fee, custom duty fee, delivery permit fee but they were not allowed to pay the security bonded keeping fee because we have not been told when you will be coming for your claim not until the bank instructed us to contact you and inform you of the security bonded keeping fee which is only the sum of US$98 dollars, this is the only fee that you has to pay.

We further request you to kindly clear security bonded keeping fee of US$98 Dollars to enable us effect the delivery of your ATM card to you as soon as possible. At the meantime, you have to get back to us with your address where your package would be delivered to you within the nest 48hrs.

Your complete Name:…………………………
Your Complete Address:………………………
Your Mobile Number:…………………………..

Upon your swift response, we shall instruct you on how you will make the payment to the security office before we would be allowed to move your package. Our delivery duration is only 48hrs starting from the time when your package was picked up and dispatched out from our office here in Ghana.

We anticipate your response.

Thank you.

Mr. Mac Moses
FedEx Delivery Officer
Tel: 233- 247630112

-End of email-

From the email header, you will able to see some useful information:
1> Source email address.
2> Source mail server
3> Source IP address connected to mail server
4> Reply to address



From the "1> Source email address", you know that the email is coming from "chinkyeyes@rogers.com". Rogers.com is exactly a Canadian ISP, which uses Yahoo mail gateway (as shown below). So it has verified the "2> Source mail server" in the mail header.


From the "3> Source IP Address" (41.218.192.255), it was from Ghana. So it is likely that the user "chinkyeyes" account was compromised by the scammer.


Scam mail tends to show tell-tale sign such as spelling error.

I won $10,000 worth of shopping voucher??

I received an email informing me that i have won $10,000 worth of shopping voucher coming from HardwareZone's newsletter.

The email format really give me the impression that i am the lucky winner, with two other "winners" listed in the email.



But after reading through the emails, it start to show tell-tale sign that it is just an advertisment and i did not really won a prize. They skillfully claims that "you may be a possible winner" as not to be accused as fraud later.



After clicking the link "www.greatsingaporevoucher.com.sg" to "verify" your details, it was obvious that the email is actually a legal "spam".

By "verifying" your details, you are actually joining the lucky draw instead. It also allow them to collect your information so to legally "spam" you further via Handphone, email, and mailing address.




w01f advise: If anyone still interested to join this lucky draw (or any similar online contest) and to be "spam" further, make sure you read and understand their "Terms and Conditions" and "Privacy Policy" before releasing your personal information to them.

Email Scam Reloaded

I have not been receiving any scam email for some time. Finally got last week. This one spoofed to be from the director of United Nations Compensation Commission.

- Extracted from the Scam mail -

From: Jeffrey S. Mears
To: brady@pisem.net
Subject: Swift Transafer Notification

Jeffrey S. Mears Director,
United Nations Compensation Commission (UNCC)
3 Vivian Avenue, London SW1Y 4TE
London UK
We need to confirm from you if JP Morgan Chase NA, London UK has credited your
account, with the approved amount of US$18Million dollars as
instructed by United Nations and African Union.
The African Union and UN has instructed for an immediate transfer to all
beneficiaries who has an outstanding payment to collect

We will be obliged to confirm from you if you have received the money from our
corresponding bank the JP Morgan Chase NA London UK,
to enable us close your file and put our record straight.

Thanks for the anticipated cooperation.

Jeffrey S. Mears Director,
United Nations Compensation Commission (UNCC)
3 Vivian Avenue, London SW1Y 4TE
London UK

- End of Email -

The letter may looks genuine to many, but it gives alot of tell-tale sign that it is actually a scam mail.

Firstly, the mail was send "To:" some unknown email instead of your own email address. for this case, "To:" field is to "brady@pisem.net".

Secondly, the sender is suppose to be "Jeffrey S. Mears" of the United Nations Compensation Commission. But the "From:" field is from "wangqm@im.ac.cn", which the domain is not from UN.org.



From the Mail header, the mail seems to be coming from "mail.im.ac.cn" and the message body was not in plain text but encoded.



Checking on the "mail.im.ac.cn", it is actually from the email system of the "Institute of Microbiology, Chinese Academy of Science" in China. Seems that the user "Wangqm" account was being hacked and used by the scammer.

More MSN Spam

I receive some new Spam again. It was nothing new, coz i have post on MSN Spam since May (MSN spam or malicious link??).

This time around, they "recommend" slimming product and the message as follows:
- "Woah those acai berry pills are no joke I just lost like 23 pounds in two weeks, I am living proof that they work with no special diet or nothing, they only cost me five dollars over at www.towndesk.com"

The website "www.towndesk.com" (shown below) is actually selling the diet pills. But don't be easily fool by the webpage, it may contains malicious links or capture user information such as credit card numbers.



w01f advise: If you notice, Spam messages always send when your friend's account is "offline". Be careful on message that were send when "offline", especially those that contains URL links. Make sure you check with your friend on the message/link before clicking it. It may contains malicious script for all you know.

Senegal Scam?? No more Nigerian scam

Received this interesting Phishing email in my Gmail mailbox. I have seen many Spam/Scam mails, but find this "Pen Pal" email very interesting.
For many, it may looks like a perfectly normal mail. But if you look carefully, you will see that the mail is send "from" the address d24alle@katamail.com but the "reply-to" address is goodnessjohn@yahoo.com. The "To" address also looks suspicious with the address goodnessyyy@yahoo.com instead of your email address.


The above was an extract of the email header. You will see that the mail was sent from Katamail.com. It successfully pass the SPF and Anti Spam check on the google mail server. The sender actual source IP was found inside the mail header (196.207.194.10), likely to be added by Katamail. I have check on the IP and it is belonging to "SOCIETE NATIONALES DES TELECOMMUNICATIONS" (should be "National Telecom of Senegal". See picture below).

From the look of it, it is likely to be a Scam mail that would lure guys who is looking for a date to send money, either by using emotion or some "too good to be true" business plan.

So next time you received any email from a unfamilar sender, be extra careful. Make sure you check the email header ("From", "Reply-to" and "To" field). Many times when the email is too good to be true, it is a SCAM.

Glossary:
Phishing emails - Emails that disguised as a trustworthy sender and trying to steal sensitive information or money from the recipients.

SPF - Sender Policy Framework (SPF), an anti spam initiatives, that allow mail server to identify emails that are authorized to use the domain name in the "Return-path" address ("From" field in mail header)

Anti Spam check - There were many types of Anti Spam techniques. Those commonly used were by Key-words, heurestic filtering with score, Real-time blocklist on IP, Domain and URL. Reputation scoring was also widely used these days where each domain or IP were given a score to see how "trustworthy"were those emails coming from it.

Anti Spammer sued by "Spammer"

David Ritz, the veteran American spam-fighter, was sued by Sierra Corporate Design, a North Dakota business run by alleged former spammer Jerry Reynolds for hacking and trespass offenses.

The court has order Ritz to pay $53,000 in damages, a $10,000 fine for contempt against breaching an injunction and lawyers' fees, which could run into tens of thousands.

Can you believe it, Anti spammer like David was trying to stop spammer by getting domain information on the "possible" spamming systems. Publishing them for the anti-spam community, but was being punished. Further more, he only uses DNS host command and Whois command, which are commonly used by system administrators to troubleshoot problems, admin their systems, and track spammers.

Spammer "scores"..!! Spammer WON!! Hopefully there will be a "re-match" where David (with the help of "Spam-Fighters Legal Defense Fund") go for an appeal.

BTW, i don't like SPAM, i prefer fried China's luncheon meat. :P

Related Report:
- Anti-spammer fined $60K for DNS lookup 'hack' (The Register)

You've got spoofed mail

Have you ever receive mails that claims to be from "microsoft" or "paypal", which is actually a spoofed mail?

Do you know that you can easily send a spoofed email without even using any special software or application?

For people who understand SMTP, it is very easy to send an spoofed email using simple SMTP commands. You will see how it can be done with a few simple steps below.

For any mail server or application that needs to send out emails, they will need to know the address of the destination mail server.

A DNS query on the MX (Mail Exchange) record is required to know the address of the mail server of the recipent domain (e.g Disney.com - shown in the picture).

From the command prompt, type nslookup, to query the DNS. (You can see that the DNS server i am accessing was from Maxonline)
You can query the IP address by simpling typing the URL (eg. http://www.disney.com/).
To query the MX record, type set type=mx, to change the DNS query mode. Then follow with the domain (disney.com)

From the MX record of "disney.com", you can see 4 mail servers' name and also their IP address
-mx1.disney.com
-mx2.disney.com
-mx3.disney.com
-mx4.disney.com

After getting the mail servers' address, you can use some simple SMTP command to send a spoofed mail.

Connect to Disney mail server
- telnet mx1.disney.com 25

When connected, you will see the banner that "welcome" you. Type "helo" to initiated the SMTP service with the server. you will see your IP address in the reply (covered in the picture). It will be logged in the Disney's mail server.
To set the sender address, you can use any address, even a spoofed one (like the example below)
- mail from:hacker@hacker.org
For the Recipient address, make sure you type in the correct recipient address.
- rcpt to:mickeymouse@disney.com
To send Subject and email message, use "data" command and enter them after it. Use a "." on an empty line to end the email.

Open Relay
If you notice, even if your have spoofed the sender address of the email, the recipient mail server have already logged your system IP address. One of the ways to hide the your IP is to use an open relay to forward your email to the actual recipient mail server.

To see whether the mail server is an open relay, you can try to send to the recipient of another domain (e.g. sending to "openrelay@hacker.org" using Disney.com mail server).

Make sure your mail server is configured to only allow recipients of your domain. If your mail server is use for Disney.com, it will only allow recipient for Disney.com.
If you want to further protect it, you can configure to query your email directory to only allow valid recipient. This will protect against Footprinting.