« Another Spam Cost | Main | Ooh, a Message From the FBI »

April 28, 2011

Another day, another badly-written malware delivery email message. This one claims to originate from Facebook, trying to make you think that your Facebook account has been hacked and is being used to send out spam. Here's the message:

From: Facebook Abuse Department
Subject: Spam from your account

This is a post notification

Spam is sent from your FaceBook account.

Your password has been changed for safety.

Information regarding your account and a new password is attached to the letter.
Read this information thoroughly and change the password to complicated one.

Please do not reply to this email, it's automatic mail notification!

Thank you for using our services.
Your Facebook!

The attachment that arrived with the message I saw was named Attached_SecurityCode66002.zip. I assume that the numerals will be different for other recipients as the random number generator does its thing when sending the messages. The attachment is a Windows Trojan loader.

This round of spam took the slight extra step of forging a part of the email header that might trick the knows-only-enough-to-be-dangerous recipient into believing the message originated from a facebook.com server. The topmost Received: header is as follows:

Received: from facebook.com (cust-66.116.106.39.switchnap.com [66.116.106.39] (may be forged)) by dannyg.com (8.12.11.20060614) id p3T0fFA8061294 for <[removed]@dannyg.com>; Thu, 28 Apr 2011 18:41:16 -0600 (MDT)

My email server composed everything in that header field except for the bit before the first set of parentheses. That part is forged. But my server looked up the originating IP address and did a reverse lookup to find the real domain and server that matches — likely a switchnap.com customer's botnetted PC, and nothing to do with Facebook.

Just like the malware-delivering email message that claims you bought hundreds of dollars of stuff (so open the attached order info document), this message uses fear, concern, and/or outrage to trick recipients into opening the attachment before thinking.

When an unexpected message asks you to act in any way — click this, open that — the only action you should take is to click Delete.