New "Spear Phishing" Attacks Target IT Admins 134
snydeq writes "A new breed of 'spear phishing' aimed at IT admins is making the rounds. The emails, containing no obvious malicious links, are fooling even the savviest of users into opening up holes in their company's network defenses. The authentic-looking emails, which often include the admin's complete name or refer to a real project they are working on, are the product of tactical research or database hacks and appear as if having been sent by the company's hosting provider. 'In each case, the victim remembered getting a similar sort of email message when they first signed on with a service and, thus, thought the bogus message was legitimate — especially because their cloud/hosting providers keep bragging about all the new data centers they're continuing to bring online.' The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares. Certainly fodder for some bone-headed mistakes on the part of admins, the new attack 'makes the old days of hoax messages that caused users to delete legitimate operating system files seem relatively harmless.'"
This is why... (Score:2, Interesting)
The less information floats about you on the net, the better.
Re:Try "fishing for noobs", not admins. (Score:5, Interesting)
and think "Hey, I better do this right away."?
It's funny you should say that... (Score:4, Interesting)
I have one of those e-mails in my inbox right now... Supposedly from 1and1.com. It looks legitimate enough, but when hovering over the links with my mouse, I get some not very nice links... some of which go to Denmark.
This is the problem with "sysadmins" (Score:5, Interesting)
I've been a Unix sysadmin all my life.
I've worked in the IT departments of non-tech related companies (or at least companies where the servers I maintained where not the actual service being provided by the company). I've worked on the Hosting industry (Where the servers I maintained where the core of the business), in software factories, and other industries. For the last 8 years, I've worked on telephony. I'm currently on charge of the whole operation of a small telco (When I got here, they were cisco+oracle+asp based, and I migrated the whole thing to Asterisk+MySQL+Perl.
I would never, EVER, fall for such a thing. Actually, I keep fighting with my providers over this crap. Even the big guys send updates in plain motherfucking email. Carriers set up and bring down POPs for inbound calls and signalling/media gateways all the time. They insist on notifying us of such additions on plain email.
I'm not going to whitelist on my firewall and add to my sip.conf as a peer/user/friend an IP I got in some random email!.
You want to notify me: Sign your fucking messages! They are fucking Verizon, and the bastards refuse to just sign their freaking email messages. So, what I do is, I have a template explaining the dangers of notifying of such changes in plain email. I reply to every mail I get with that template, and then call my account manager or whoever I have to in order to confirm the information.
Level 3 (Now owned by Verizon too), Verizon, British Telecom, Global Crosing, and other HUGE players on this industry, all do the same stupid shit. And all this guys are fucking Tier 1!
Believe it or not, some other small Telcos seem to be more conscious about this stuff. VoipJet, for example (a small A-Z IAX-only route), sends all the notifications signed and they provide a link to the notice on their website where you can double check the information.
So, the blame here goes to BOTH the stupid Admins that just do whatever they get told over email, and to the companies that get them used to accept unauthenticated communications.
Re:Try "fishing for noobs", not admins. (Score:4, Interesting)
Exactly. I'm just going to open up some port, or change my mail settings because some schmuck sends me an email?
I changed an IP address on a single server and it ended up being 6 hours on the phone with corporate VPN jockeys and contractor VPN jockeys and failover tunnel configuration, and the WAN guys, and the next day I had to put in another hour because a different business unit on an outsourced customer service portal had missed that we were moving the server, and they had to get set up as well.
Firewall/Server changes from an ISP over email? Right.
Re:Interesting choice of IPs... (Score:2, Interesting)
(*hand up*)
Made me wonder why the spear-fishee didn't check the "legit" addresses in the attack email. My first thought was "What, an admin that doesn't know whois?"
Repeat after me: Anybody can get your name and other personal info. If you're not on Facebook, someone else is and they've already given your personals up for you on your behalf. We are officially in the "John Anderton" age. Beer commercials will address you by name. It doesn't mean jack.
Get used to the future. Numb your response to being personally addressed, the same way we've had to numb our sense of "photographic proof," without a degree in forensics.
Re:Try "fishing for noobs", not admins. (Score:5, Interesting)
Some people will click anything... (Score:1, Interesting)
But sometimes user education does work.. kind of. Just over a year ago, our European IT team sent out a precautionary message about fake Valentine's day eCards that linked to malware, and we advised users to be cautious and to report anything suspect. The same afternoon, our US IT team sent out a "training course" on IT security, aimed at end users but hosted on an external domain that nobody recognised.. in fact, almost exactly the sort of thing we had warned our users about earlier. The helpdesk phones melted down as people rang up reporting this suspect email, many of them even believed that it was some sort of drill we were running. So.. I guess not all of the people click on all of the links all of the time..
It's worse than that - My boss got one! (Score:1, Interesting)
Re:This is the problem with "sysadmins" (Score:2, Interesting)
Totally. That crap happens all the time. That's why any serious facility will have security outsourced to a company that is held legally responsible for the physical access to said facility.
Short story:
Once, I had my servers at iPlan (large ISP in Argentina, they have 2 HUGE datacenters in Buenos Aires). One weekend, a server went down and I was out of town. So I sent a friend to take care of it. I called the NOC to authorize him. They said they could only take my authorization in written form. So, I emailed my account manager asking for the right procedure, and he said mailing him the Name and DNI (sort of like SSN) of the person was enough. He then had to show some credential (Actually, his DNI) to prove his identity. I sent a simple email with this data, and they authorized him.
The next week, when I got back, I went to see my account manager. I got to his office, opened up my laptop, telneted into their SMPT server, and and delivered an email to his account, said email coming from info@fbi.gov.
That's simply the best way to explain to an illiterate bastard that email is totally insecure.
They many times rejected me access to the datacenter if I happened to forget my ID. Even when all the guards knew me very well (I went there very often.). The people in charge of that kind of stuff DON'T understand technology, they have the right intentions, and implement many security measures, and all said measures fall down when they put some really weak and stupid link somewhere in the chain. Like plain email authentication.
Re:Try "fishing for noobs", not admins. (Score:3, Interesting)
I hear you, I tend to get this from internal staff.
Developer: I need ports 10,000 to 65,000 opened on the firewall to all IP's so I can run $APPLICATION_OF_THE_DAY.
Me: No, you don't. I'm not opening up a security hole in our firewall for something you don't need.
Dev storms off in a huff.
Phone rings 5 minutes later.
Head Dev: Jeff needs ports 10,000 to 65,000 open on the firewall to all IP's.
Me: No, he doesn't. I'm not opening up a security hole in our firewall for something he doesn't need.
Head Dev: Don't make me speak to your boss.
Me: Oh Noes, don't make it readily apparent that I'm doing my job by not opening a massive hole in our firewall.
5 minutes later the phone rings again,
IT manager: I'll sort Jeff out for you.
This happened about every three weeks in my last job, my boss took the position of dealing with the hard cases after he found out I'm not good at soothing ruffled feathers. Fortunately the CIO had a clue about proper security and listend to a well reasoned argument.