I just received this mail from a friend:
Dear friend
Welcome to stwoxy.com ! We are one of the largest electronic distributors
and wholesalers in Beijing China. We offer qualified digital products:
Motorcycles?TVs, Notebooks, phones. PSP, projectors, GPS, DVD, DV, DC, MP3/4
and so on, which are of world famous brands, such as Sony, IBM, PHILIPS,
NOKIA, DELL and so on. All our items are brand new from the manufactures
and they come with 1-3 years’ after service. These days we are expanding our
overseas market, and every item is sold in extremely low price. Such
chances should never be missed, ladies and gentlemen, do come to
stwoxy.com! you will surely have a big surprise! We are looking
forward to hearing
from you!
It was sent from a HTTP connection into GMail, and was delivered from there
using valid DKIM, Domain Keys and SPF signatures. In addition, it was sent to
all the addresses in his address book. In other words, this was no
run-of-the-mill impersonation spam — for this one, the spammer obtained my
friend’s username and password somehow, logged into GMail, scraped the address
book, and then sent spam via GMail that way.
My friend says he didn’t access GMail using a desktop mail client, but did have
his Google password saved in his web browser (a pretty typical configuration).
My theory is that some virus/malware has infected his desktop machine, captured
the saved-passwords file from the web browser configuration, and used that to
log into GMail. Alternatively, it could also be a guessable username and password which was picked up
via dictionary attack, I guess…
This is the first case I’ve heard of where spammers are actively stealing
user account authentication tokens, in order to take over the accounts for
spamming. (We’d long predicted it, of course, since it’s a natural response to
“pay for mail” schemes… but since there’s no widely-used pay-for-mail system
available yet, it’s premature!)
It seems this is not just a GMail thing, btw. Here’s a report of the same thing happening to some French guy via HotMail last month (or in english). I don’t speak Dutch, but this forum post looks like it might be the same situation.
If you’re curious, here’s a copy of the spam, delivered to a Yahoo! group; it appears these spammers aren’t too sophisticated in terms of the text they’re sending, since they haven’t morphed that text, HTML, or even the domain in the link yet. It’s just the malware that’s sophisticated, at this stage.
Tags: accounts, gmail, hotmail, malware, passwords, spam, yahoo
