Vulnerabilities / Threats

4/26/2018
11:22 AM
50%
50%

New Phishing Attack Targets 550M Email Users Worldwide

In an attempt to steal financial data, the attack bribes users with coupons in exchange for taking an online quiz.

A new phishing campaign was discovered sending more than 550 million emails within the first quarter of 2018, according to data from Vade Secure. The threat was discovered in early January and has primarily hit users in the US, UK, France, Germany, and the Netherlands.

Victims receive emails disguised to come from popular brands and services in their home country. Attackers try to steal their banking information by offering coupons or discounts in exchange for their participation in an online quiz or contest.

Experts believe a serious criminal organization is behind this campaign, which doesn't use pirated websites as many phishing attacks do. This one appears to use leased and legitimate IP addresses, servers, and domain names, which would drive infrastructure costs up to tens of thousands of dollars. They also use tools to shorten URLs and conceal the ultimate destination.

These sophisticated techniques caused the threat to bypass many existing email security tools, researchers report. Read more details here.

Interop ITX 2018

Join Dark Reading LIVE for a two-day Cybersecurity Crash Course at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the agenda here. Register with Promo Code DR200 and save $200.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/30/2018 | 9:24:09 PM
Re: online quiz or contest
True enough, but I have been known to search for a coupon code or two.... Anything that actively searches for you can turn into trouble.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 6:00:11 PM
Re: Coupon lure is emblematic of broader concern
As data is shared, sold, stolen, inherited and otherwise obtained from a variety of sources and over time It becomes more valuable. Now it is noy only the raw data but also the relation, that is invaluable.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 5:57:59 PM
Re: Coupon lure is emblematic of broader concern
The real threat from casually proffered data I woudl agree, that is the one actionable and most impactful.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 5:55:57 PM
Re: Coupon lure is emblematic of broader concern
enterprise might invest large sums to attain data of a similar nature shouldn't surprise us. When facebook says we do not sell user data, they play with the wording, of course they sell data, that is what ads are about, they would not get any ads if they did not have the data
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 5:53:06 PM
Re: Coupon lure is emblematic of broader concern
others value data which we don't That is true, we give ot away for free to facebook , google and otehrs without any concern what so ever.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/29/2018 | 5:51:38 PM
online quiz or contest
online quiz or contest are good way of gettign people engage and trapped. My rule is: I do not need any coupon or discount on anyting from the Internet.
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
4/26/2018 | 1:19:38 PM
Coupon lure is emblematic of broader concern
For decades, retailers have used "with your card" coupons to generate data about their customers (who doesn't have a wallet, keychain or smartphone full of "membership cards"?).  The key takeaways with these incentives are: that others value data which we don't, and that we have come to accept these forms of coercion to participate.  That a criminal enterprise might invest large sums to attain data of a similar nature shouldn't surprise us. 

Also, the enticements to participate in social media services, such as Facebook, are of a similar nature, and serve the same purpose: to leave us little choice but to take the bait.  After all, how many can afford to pay a third more at the grocery store, or not to participate in a "Facebook only" web event? 

The data gathered, even if we are aware of the extent, never seems to be anything we should worry about - and taken as individual packets, utilized by the original entity, perhaps it isn't.  The real threat from casually proffered data is when it is processed in combination with data from a number of sources and instances.  As data is shared, sold, stolen, inherited and otherwise obtained from a variety of sources and over time, the value of this "information ore" to someone we never met far exceeds the cost of collection. 

At the end of the day, does it really matter if the organization or website used to obtain this "trivial" data is legitimate or not?  Data has no loyalty

 
Meet 'Bro': The Best-Kept Secret of Network Security
Greg Bell, CEO, Corelight,  6/14/2018
Containerized Apps: An 8-Point Security Checklist
Jai Vijayan, Freelance writer,  6/14/2018
Four Faces of Fraud: Identity, 'Fake' Identity, Ransomware & Digital
David Shefter, Chief Technology Officer at Ziften Technologies,  6/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-0291
PUBLISHED: 2018-06-20
A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application on an affected device to restart unexpectedly. The vulnerability is due to improper validation of SNMP protocol ...
CVE-2018-0292
PUBLISHED: 2018-06-20
A vulnerability in the Internet Group Management Protocol (IGMP) Snooping feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in ...
CVE-2018-0293
PUBLISHED: 2018-06-20
A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a nonadministrative user. The attacker would have to possess valid user credentials for the device. The vulnerability is du...
CVE-2018-0294
PUBLISHED: 2018-06-20
A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unauthorized administrator account for an affected device. The vulnerability exists because the affected software does not properly delete sensitive...
CVE-2018-0295
PUBLISHED: 2018-06-20
A vulnerability in the Border Gateway Protocol (BGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the device unexpectedly reloading. The vulnerability is due to incomplete input validation of the BGP update...