Re: Recent Phishing Uptick

[Brandon Hume <brandon.hume () DAL CA>]

On 02/19/14 10:55 PM, Gary Warner wrote:
> Your "Modify the spam before delivering" trick is awesome!  Which mailsystem are you using, and can you share a bit 
> more about your technique?

For those organizations using MS Office 365, it's possible to do the 
same in Exchange Online, using a "Mail Flow" rule and a prepended 
disclaimer.  I've just implemented the same myself.

Dalhousie has seen phenomenal spike in phishing activity from September 
though November and again in January.  The spike after Christmas meant 
close to twenty accounts being shut down per week (I am not proud of our 
userbase).  The culprits seemed to be the standard Nigerian gang who's 
been working us over for close to a decade now, although I've seen more 
participants from Malaysia and Israel.  These guys seem to *know* how we 
work... I've even started to suspect that they've noticed the cycle in 
our responsiveness: they lay low when I'm on-call and they'll go at it 
hard when someone who's less email-oriented is carrying the pager.  
Swapping our schedules around trips them up.

Spam content is your typical fake lottery stuff, charities, and so on.  
There was a lot of leveraging going on... phishing spam sent from other 
institutions getting our users, and then our users being used to phish 
other colleges and universities, in one big glorious chain of "ugh".  
Before Christmas, there was a lot of hostile fire aimed at 
blackboard.com, both in outbound phishing spam and in fake Bb sites set 
up in our student webspace.  But that seems to have tapered off... I 
don't know if Bb has changed anything on their side to make themselves 
less vulnerable.

The main "new" thing we've noticed is that these guys are using their 
stolen credentials with an institution's offered VPN services in order 
to access stolen credentials on somebody's else's SMTP relay.  Our VPN 
was being used to spew to other universities, and our smtp relay was 
being exploited from VPNs located at other .edus, for example.

A bit of trivia: I'm certain at one of these guys is named "Abdul 
Rasheed".  If you log your email destinations, you might find them 
testing your outbound filters.  They don't try to hide very hard... one 
address was "hack_abdul.rasheed", another was "voyage_smtp_test", and 
their goals are pretty well explained by email addresses like 
"more_fundz" or "swiftcash".   :P