« A Real Puzzler | Main | A Spammer Revives a Lost Art (Poorly) »

January 29, 2005

Imagine you get an email message with the following From: and Subject: info:

From: "PayPal Support"
Subject: Sony DSC-F828 8.0MP Digital Camera

If you're a digital photography buff, you might be curious enough to check out the message (I hope in a safe manner described in Spam Wars). Here's the message body:

Sony DSC-F828 8.0MP Digital Camera
Your order # 12405 has been accepted for the amount 840.00$ Your card will be charged in that amount .Thank you for your purchase.
You can check the order in your profile.
http://not_the_real_domain.net

I would imagine that most everyday email folks seeing this message would be incensed at the notion of their credit card being charged $840 without their permission, and would follow the link.

That would be one of worst mistakes you'll make all week, especially if you don't have a well-patched Windows PC.

The actual link (not shown here) takes you to a page that innocently says there is nothing to see. But hidden within that Web page's HTML are two iframe elements, one of which loads a file from the Web called "installer.htm".

That can't be good.

And, indeed, it isn't. Through some more indirections invisible to you, the site uses a known Windows vulnerability to install external software into your PC without your knowledge or consent. By simply visiting that seemingly empty Web page, you have just allowed your PC to be hijacked by, well, I don't know who exactly, but someone who will likely hire out your PC's computing cycles to what are called "botnets." It could also be a "keylogger," which silently records your usernames and passwords to financial sites.

How many PCs will be infected today as a result of this email message? I shudder to think.

UPDATE: I should have mentioned that this tactic has been used in previous months, including the same "order number" and dollar amount in the messages. I also contacted the Canadian ISP hosting the damaging site (netfirms.com). They claim 24/7 support with a 4-hour turnaround. Nine hours after they confirmed receipt of my report, the site is still active. (Deeper sigh)

UPUPDATE: The evil Web page has been taken down, but it took the ISP 43 hours to do so. I guess they had to wait for the "A" support team to show up on Monday morning. Meanwhile, the damage has been done.