Monthly Archives: November 2016

PayPal malware social engineering

Posted on by
17

I instantly got very suspicious when I received this from PayPal today:

Hello [my name here],

Colin Neal would like to be paid through PayPal.

Note from Colin Neal: Good afternoon. There was a pay of 200$ from my wallet on your wallet , as if I bought smth from you on Ebay. But I didn’t do this. It must be a mistake. Write me on kcsystems1@gmail,com i’ll send you the copy of invoice. Sorry to disturb you.

Details

Request Date: November 29, 2016
Requested Amount: $200.00 USD
Your Email Address: [my PayPal email address]

Click the button below to send Colin Neal your payment and see the details of this money request.

[ Pay now! ]

Of course I did not click on the “Pay Now!” button, but looking at the email header, the mail was actually sent via PayPal’s mail servers!

I logged into PayPal from scratch on another machine by typing in the PayPal domain name and verified that there was indeed a money request for $200 in my PayPal account. However, it came from a random looking Gmail address, “pvbkrngkjqo@gmail.com” and not the address I was told to contact. Even more suspicious than the first email!

So I fired off an email from another mail account (not my PayPal mail account) to “kcsystems1@gmail.com” and explained that I had not received any funds and that this must be a scam. But as suggested in the initial message, they then sent me a link to an “invoice”:

Good afternoon. This is a copy of invoice.
https://paypal.com/user/files/paypalInvoice_000092419298377.doc

Looking forward your reply. Thanks.

Looking at the actual target of the link, it pointed at a completely different location:

http://myotaku.com.my/system/helper/json/paypalInvoice_000092419298377.doc

When I downloaded it using a secure tool and submitted it to VirusTotal.com, six of the tools consulted detected it as malware:

AVware LooksLike.Macro.Malware.k (v) 20161130
Avast VBA:Downloader-DSH [Trj] 20161130
Fortinet WM/Agent.CBW!tr 20161130
Qihoo-360 virus.office.gen.85 20161130
Symantec W97M.Downloader 20161130
VIPRE LooksLike.Macro.Malware.k (v) 20161130

This scam uses a clever bit of social engineering. The original email comes from a real PayPal server, a trusted source and it doesn’t include any malicious links or attachments.

By getting you to initiate contact with the malware scammer, the subsequent reply with its malicious link will arrive from an email address that you have previously contacted, which will subject that email to less severe filtering. This makes it more likely the malicious link goes through.

Always be alert to how scammers set up mail exchanges where malware will only arrive after several steps specifically designed to defeat filtering. For example, they may contact you first to ask for a quote and then email you what is supposed to be an order, but is really malware.

Donald Trump’s most outrageous statement

Posted on by
1

There has been no shortage of outrageous statements by Republican candidate Donald Trump in the US presidential election campaign. However, the one that shocked me most was this boast about the loyalty of his supporters:

“I could stand in the middle of 5th Avenue and shoot somebody and wouldn’t lose any voters, ok? It’s, like, incredible.” (Donald Trump, 23-Jan-2016)

The statement says something about both Trump and his supporters.

It would never occur to most people to even think about murdering someone, let alone boasting about the hypothetical ability to get away with murder — not because murder is illegal, but because killing is wrong. It’s one of the most basic moral rules in any society. That this doesn’t apply to Trump is revealing. He doesn’t have this moral compass that most people at any layer of society have. He’s the ultimate narcissist who would do anything that he thinks benefits him, from stiffing his contractors to “grabbing (women) by the pussy”. That makes him totally unsuitable for the most powerful position on the planet.

Trump has said many things that would have sunk the campaigns of ordinary politicians, but this is not politics as usual any more. For a certain segment of voters, the fact that he does not behave like a regular politician is the very reason they vote for him. Decades of rabid propaganda and conspiracy theories on talk radio by the likes of Rush Limbaugh and on Fox News have established an alternate reality for them where the system is totally broken and has to be trashed before it can be rebuilt from scratch. In this alternate reality crime is at an all-time high, rather than 50% below what it was under President Reagan as it actually is. Facts don’t matter.

These people are scared and prepared take their chances, almost regardless of the evidence. In reality, Trump has no solution for them. He will not bring back the lost industrial jobs that largely went to computers rather than to Mexico. His anti-trade policies would send the economy into a tail spin and his budget proposals would drown the country in debt. His victory would have foreign dictators cheering and would encourage imitators in other countries.

When Hitler came to power in my homeland in 1933, he did not win a majority in free elections, but he managed to get enough support from other parties and politicians who feared a communist revolution more than they disliked the Nazis. Most of Hitler’s plans that he executed so brutally once firmly in power, from “Lebensraum im Osten” (living space to the east, i.e. the invasion of Poland and the Soviet Union) to the mass murder of Jews had already been openly announced in “Mein Kampf” a decade before the Nazi takeover, but people on the right did not care too much about that. They were happy as long as Hitler was going to smash the communists.

Likewise, most of what Trump says doesn’t really matter to his followers, as long as he is the anti-Obama. No other Republican candidate was as different from Obama as Trump is. People voting for Trump despite his glaringly obvious character flaws are willing to write him a blank check, the same way the German Reichstag gave Hitler a blank check when it signed the Enabling Act (Ermächtigungsgesetz) that effectively gave him unlimited powers and put parliament out of business.

Even if, as most of the world hopes, voters will manage to stop Trump this coming Tuesday, this alone will not end the problem. His voters and their alternate reality views will still be there. They will impact the political culture for years to come. The Republican party and its media circus has nurtured an ever more toxic political base that it now has trouble controlling. In some ways it reminds me of the jihadists the US supported in Pakistan and Afghanistan in the 1970s/80s against the Soviet Union, which now have become the West’s enemy #1.

Unfortunately, even if the most unqualified US presidential candidate ever is defeated at the polls it will take a long time for the US to recover from the political poison the Republicans have been brewing for decades in order to secure power to further the interests of the top 1%.