Beware of fake Microsoft security alerts

Beware of fake Microsoft security alerts

With Microsoft's monthly patch release expected on Tuesday, scammers are sending out fake security bulletins that attempt to install malicious software on victim's computers.

The e-mail messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update."

When users click on this link, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk.

This Trojan software then attempts to reach out to other computers on the Internet in order to install more programs on the victim's computer.

The SANS Internet Storm Center received its first and only report of the scam on Thursday night, but a second sample has also been posted to the Chinese Internet Security Response Team blog.

SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. The trojan looks for three different servers, and two of them have domains that haven't yet been registered. He suspects the authors of the scam may be planning to register those domains before embarking on a more widespread campaign.

The two e-mail samples contained obvious errors that would be caught by technically savvy users. For example, although the patch Zeltser examined claimed to have been issued in June 2007, it was entitled MS06-4 instead of the more-plausible MS07-004.

Still, these scams need to fool only a small percentage of victims in order to be successful, said Zeltser, information security practice leader at Gemini Systems in New York. "You wonder, does it really matter that there are these strange discrepancies in the way the fake security alert is written," he said. "People who would notice probably would be the kind of people who wouldn't click on the link."

Another tip-off: Microsoft does send out notification e-mail when it publishes security bulletins, but the links in these alerts take users to the bulletins themselves, not to executable downloads.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?