applied social engineering
before we get started:
--A------the email itself----
Dear user of Softhome.net,
Our main mailing server will be temporary unavaible for next two days,
to continue receiving mail in these days you have to configure our free
auto-forwarding service.
For further details see the attach.
Attached file protected with the password for security reasons. Password is 85140.
Best wishes, The Softhome.net team
http://www.softhome.net
---------------------
--B------the header-----------
Return-Path:
Delivered-To: myemail_theATsign_softhome_dot_net
Received: (qmail 18811 invoked by uid 417); 9 Apr 2004 10:25:49 -0000
Received: from unknown (HELO BILL) (222.124.37.19)
by 192.168.0.35 with SMTP; 9 Apr 2004 10:25:49 -0000
Date: Fri, 09 Apr 2004 17:26:51 +0700
To: myemail_theATsign_softhome_dot_net
Subject: E-mail account disabling warning.
From: administration@softhome.net
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------rrevyqllbhyqemessvwq"
-------------------
--C------the attachment-----------
a 12,1 KB (12.422 bytes) zip archive
------------------------------------------------------
well well well.. as I expected, this was a scam - the attachment was indeed passworded.. the password was 85140 as the message said.. the EXE contained in the archive was.. Win32.Bagle ;-)
so… it seems that these assholes are still attacking, and the common user is likely to turn into a victim.
At first I thought.. "eh, who cares, I only use this account for group-emailing, if its down for two days - I wont die".. but then I took a look at the "file has a password for security reasons" part.. hmm.. so if the folks at softhome.net passworded this file it means that all the 'usual' emails can be seen by anyone [as theyre not sent as zipped and passworded attachments].. of course this aint true..
I unzipped it, the password did work :-) checked the file with AVP and I saw that it was infected..
What next? I checked the header of the email. usually a message is forwarded thru a few servers before it reaches you, this one came straight from 222.124.37.19. take a better look: HELLO BILL ; 192.168.0.35. hmmm.. it must be some **cker named Bill whose probably the 35th computer of a LAN :-) there is a SMTP-server on the machine that offers access to the other ones. Since its 'his' smtp server, he configured it so that he could send emails without providing his REAL return-address… I see Return-Path: advanced_delphi-unsubscribe@yahoogroups.com
Hey! Like I said, I only use this @softhome.net address for groups.. nobody else knows about the existence of this account.. so it must be some other subscriber of the group who thinks he\she :-) does a good job by spreading this worm.
But hey - why would the person do that? I would understand if I was sent a Trojan - someone wanted to get my passwords or something… but Bagle - is a worm - it spreads by sending itself to as many machines as possible - no humans needed :-) all you have to do is execute the file and it will do the rest :-)
But still, I KNOW it was manually sent by a person. There are several things that prove this:
1. a 'personal' smtp server
2. the return address is a yahoo-group [I assume the asshole is subscribed to it as well]
3. the worm is a program, its goal is to spread as fast as possible - the chance is higher if there are less barriers. In other words - no zip's, no passwords etc… some people may not know what ZIP is and what to do with the password.. you know what I mean ;-)
***the interesting part***
as u probably heard in the news - social engineering is what helps these worms spread over the internet. What is social engineering? it's a way to manipulate someone during a dialogue by using the right intonation and words. It can be applied in written form as well.
In this case the trick is in 'security' and 'password'… the person who reads the message feels very very secure ;-) even if it has no idea 'bout internet security. 'FREE forwarding service' plays a major role in this thing… most of us say 'yes' when we hear 'free', just because its free and we have nothing to lose. What else.. whats the point in sending a password protected attachment for 'security reasons' AND providing the password in the exact same message?? :-) this is a damn good one! Well, the password trick is actually a very smart move: the antivirus scanner wont be able to see whats inside the archive - because its password protected [that's why such emails wont be auto-erased by mailservers], and the password also makes the victim believe that the message is indeed harmless.
I believe that communication is a very powerful tool. The possibilities are enormous… as long as you know what you're doing, too bad that in this case the sender is pretty bad at English ;-)
"will be temporary _unavaible_ for next two days". No, its not only that 'unavailable' is misspelled, it should be temporarily and not temporary.. and 'for _the_ next two days'. And I believe "dear softhome.net user" is better than "dear user of softhome.net".. "attached file _IS_ protected"… a "the" in front of 'attached' is a good idea.. protected with 'a' password… and 'attach' is not a noun..
with various tools, such as Neotrace, the ip could be verified - this could give me the location of the sender… haven't done that, but I wont be surprised if I find out the user is a russian, because these folks tend to keep the original order of the words when translating.. ïîëüçîâàòåëü softhome.net' (polyzovately softhome.net) -> 'user of softhome.net' :-) the only problem is that Billy is not a russian name… maybe 'billy' is just a random choice.. u neva no..
so we're dealing with a person
-from a non-english-speaking country.. coz these folks are pretty good at English :-)
-maybe a foreigner who recently established his ass in the US\UK\whatever…
-must be a programmer [these folks do their best to know as many languages as possible - pascal, php, c, asm, bla bla… but they rarely pay attention to the languages people actually speak.. except their native language of course] :)
-originating from a country that has a primary language, in which things are ordered not as in english.. mite be russian, mite be french…
-maybe its just an ordinary alien who hasn't learned english yet ,trying to hack into our systems ;-)
damn, why am I writin' all dis?? An IP-trace will give a rather accurate answer.. and it takes a minute..
anyway - its time for the conclusion: social engineering is a nice tool, it can get you out of trouble… but it may get you IN trouble if you get caught ;-)
my idea is that there should be a science called 'reversed social engineering'. This 'article' is a very basic example. Now try to imagine what a hi-tech psychologist can squeeze out of this email?
hey Bill, make sure you lock all the doors before going to bed ;-)