Spate of new spam

KAGY

Hi all, I've been getting a spate of new spam from some of my contacts in the last while. They are all similar, ususally a one word subject line with a space in the word, a short message then a link to "get your facebook message" "see their photo" etc. The link is normally

107.183.127.113/l/?xuzubi={short key}&hidi=&id={some long key]==&talijupagi={some key}

Gmail doesn't seem to be able to intercept this spam, which has come from users of both gmail and firefox.
Speaking to some of them, none have clicked on a similar mail, but I wouldn't consider them the most tech savy. Has anyone more info on this, I couldn't find anything on google. Do you think it has to do with the Heartbleed bug, as I'd assume they use the same password for everything.
PS: Ive given them the usual talk on basic security

eddiehen

KAGY wrote: »

Hi all, I've been getting a spate of new spam from some of my contacts in the last while. They are all similar, ususally a one word subject line with a space in the word, a short message then a link to "get your facebook message" "see their photo" etc. The link is normally

107.183.127.113/l/?xuzubi={short key}&hidi=&id={some long key]==&talijupagi={some key}

Gmail doesn't seem to be able to intercept this spam, which has come from users of both gmail and firefox.
Speaking to some of them, none have clicked on a similar mail, but I wouldn't consider them the most tech savy. Has anyone more info on this, I couldn't find anything on google. Do you think it has to do with the Heartbleed bug, as I'd assume they use the same password for everything.
PS: Ive given them the usual talk on basic security

Yep - seeing lots and lots of them lately. Have you noticed the short text is a Harry Potter quote? Neither did I, but when I googled it I got this:

http://www.dailyedge.ie/harry-potter-spam-explainer-1537279-Jun2014/

The links don't seem to trigger any IDS rules, and from dumping the content of the URL there doesn't seem to be any exploit or driveby download going on. Am I missing something?

lemon2

Hello,

I also had this, and it was from people in my contacts, and they send out weird spam trying to get me to login to g-mail.

I epersonally think it could even be MI5 logging people because MI5 have full control over google, AND THATS what we know for certain so think about other agent HQ's having control,etc.

KAGY

Comment from that article

That link believe it or not, contains both the email address of the person who sent the email and your email address but its encoded. When you click on that URL, you straight away confirm your email account is actively monitored by a human. Usually the website will have some form of drive by attack as well, hopefully harvesting your email account credentials and sending on the same email to all the people in your address book.

magentis

lemon2 wrote: »

Hello,

I also had this, and it was from people in my contacts, and they send out weird spam trying to get me to login to g-mail.

I epersonally think it could even be MI5 logging people because MI5 have full control over google, AND THATS what we know for certain so think about other agent HQ's having control,etc.

Hehe.
Take your tablets will ya.

KAGY

lemon2 wrote: »

I epersonally think it could even be MI5 logging people because MI5 have full control over google, AND THATS what we know for certain so think about other agent HQ's having control,etc.

Mi6 is the foreign secret service. But why do you think that Google are the puppets and not the masters ? You can save yourself now by wrapping your smart phone in tinfoil

KAGY

And on a serious note: get your friends to change their password, I've just started using keepass so I can have a different password for all my important accounts but I wouldn't recommend that for the non tech savvy

eddiehen

KAGY wrote: »

Comment from that article

Yeah, turns out the article is a bit more generic about the threat than it should be. It's correct in mentioning the email address is encoded into the URL, but the URLs are unique and change with every email sent, and the Harry Potter quotes were to get around your average Bayes filter.

If your email addy is one of the 3-4 main ones (hotmail, gmail, yahoo, live) it redirects you to a phishing page which attempts to harvest your login details. If it doesn't recognise your domain, it redirects you to a fake BBC page which advertises that "Garcinia Combogia" stuff, which is a supposed slimming product (but the page is recon for browser vulnerabilities).

And here's the nifty part - if you click on it again (from one of the recognised domains) it redirects you to the fake BBC site second time around, catching you with both phishing and browser recon attempts with 2 stupid clicks.