Web postcards hide Trojan horse programs

The SANS Internet Storm Center is warning Internet users about e-mail offers for Web postcards that install Trojan horse programs instead.

Beware of Web postcards bearing greetings. That's the advice from The SANS Institute's Internet Storm Center (ISC), which is warning about e-mail messages that pose as Web postcards, then direct recipients to a Web site that installs a Trojan horse program.

The new attacks use sophisticated social engineering techniques to trick users into installing Trojan remote access programs that can fool antivirus and firewall software by appearing to be authorised applications like IRC (Internet Relay Chat) software, ISC said.

ISC has received an increasing number of reports of the postcard scams in recent days. Victims receive e-mail messages with subject lines such as "You have received a virtual postcard from a family member," with a link to a pickup site that installs the Trojan, according to a post on the ISC Web site Sunday.

Another recent scam posed as a message from Blue Mountain Greeting Cards, a service operated by American Greetings. The messages use a spoofed sender address and appear to come from bluemountain.com. A link in each e-mail claims to go to Blue Mountain's card pickup Web page, where recipients are asked to enter a unique card ID number provided in the e-mail. However, victims who click on the link pass first through one of a number of sites that may have installed malicious software, ISC said.

Those Web sites were not available Tuesday. A customer service representative from Blue Mountain said in an e-mail message that the company has recently received reports of false e-mails purporting to come from the company and that the company's abuse team is investigating.

Web greeting cards have been used to spread malicious code before. Variants of the Zafi worm in December arrived in e-mail attachments claiming to be postcards offering Christmas greetings. Some variants of the Cult worm in 2003 also spread in e-mail attachments that were said to be Blue Mountain greeting cards.

While the method of attack is well-established, the latest threats are becoming harder to detect because they install programs that piggyback on existing, authorised applications to carry out malicious acts. For example, the Trojan horse installed through one recent Web postcard attack took over, or "hooked," IRC applications on compromised systems. Antivirus and firewall software is often instructed to trust such programs and allow traffic from them to pass to and from a protected computer unmolested, which gives remote hackers access to infected systems, ISC said.

Users are advised to be cautious when opening unexpected e-mail from unknown sources, ISC said. When links to legitimate Web sites are provided in HTML-format e-mail messages, users should note the address, then type it into the address field of their Web browser, rather than clicking on the link provided in the message, which often trigger the installation of malicious code or take the user to a Web site that will install unwanted programs.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Paul Roberts

IDG News Service
Show Comments



Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?