Spamming and phishing driving crime

By Matt Whipp

Posted on 31 Aug 2006 at 17:57

Spamming and phishing campaigns are continuing to drive online criminal activity, claims security experts at Kaspersky.

Its 'top 20' chart for digital threats showed little movement in the month of August, with only a quarter moving in and out of a chart composed almost exclusively of variants of the Internet worm Mytob and the email worm NetSky.

However, the anomaly is the presence of the phishing Trojan Bankfraud.od in twelfth place. The phishing campaign was first seen in March, targeting customers of the German Volksbank, yet the authors modified the phish and launched a renewed attack in August.

It is unusual to see phishes charting as the trend for this type of activity is for short-lived and increasingly targeted attacks that aim for a much better percentage rates than spam, for example, which is sent out en-masse and endlessly in order to magnify its small success rate.

Indeed Kaspersky notes that August was a particularly active month for phishing campaigns in terms of numbers, but the small scale of attacks saw all Bankfraud failing to chart.

The company also noted spammers turning a few new tricks in order to keep ahead of the filters. The most notable is the adoption of animated gifs rather than text-based emails in spam campaigns.

Although the best anti-spam software can analyse animated images for text content and then filter that content against its spam rules, anti-spam software that only looks for text and email clients that only used text rules to filter mail will fail to catch this type of spam mail.

The animated gif consists of a content frame that includes all the spam content and subsequent blank frames. The trick employed is to rotate the frames so that the content frame is displayed for several seconds, while the blank frames are displayed for just tenths of a second.

Kaspersky says the technique is currently being seen in stock spam used in pump and dump campaigns.

For more information, visit the Kaspersky website.