New "Spear Phishing" Attacks Target IT Admins 134
snydeq writes "A new breed of 'spear phishing' aimed at IT admins is making the rounds. The emails, containing no obvious malicious links, are fooling even the savviest of users into opening up holes in their company's network defenses. The authentic-looking emails, which often include the admin's complete name or refer to a real project they are working on, are the product of tactical research or database hacks and appear as if having been sent by the company's hosting provider. 'In each case, the victim remembered getting a similar sort of email message when they first signed on with a service and, thus, thought the bogus message was legitimate — especially because their cloud/hosting providers keep bragging about all the new data centers they're continuing to bring online.' The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares. Certainly fodder for some bone-headed mistakes on the part of admins, the new attack 'makes the old days of hoax messages that caused users to delete legitimate operating system files seem relatively harmless.'"
Re:So when did text have to become an active paylo (Score:5, Informative)
Did you even RTFS? The emails contain instructions for things that the attackers want the admins to do. It's called social engineering, and it's not a computer glitch, it's a critical thinking glitch.
I got one today (Score:2, Informative)
Posted anonymously. Public company. You get it.
Anyhow, I've got one from un-named webhost today. (Hint, they were one of the companies that got hit when Google got slammed)
Whoever it was, they new my name, and IP addresses that we host some sites on. The ploy was for me to open up all ports to my site to establish a trust to a range they've provided for "enhanced security analysis" thats now "part of their package" as well as email content filtering.
1. I host Exchange in house. (Even though I hate it)
2. I host nothing but web @ Host X.
3. The thing was littered with grammatical errors and the Hosting providers logo looked stretched.
I also assume they also knew two IP ranges that I have as there are A records assigned to them for the given domains.
savvy? (Score:1, Informative)
An admin who would "[open] up mail servers to enable spam relaying, to disable ... host-based firewalls, and ... open up unprotected network shares" is not savvy. Any admin who does not guard his or her network with the viciousness of a mother lion guarding the den containing her young, even from the actions of his own coworkers, vendors, and business partners, is worthless. These people are the first and last defense in corporate security.
Circa Blackhat 2007 (Score:4, Informative)