Common sense in Spam identification

Published: 2010-07-22. Last Updated: 2010-07-22 12:35:30 UTC
by Joel Esler (Version: 1)
4 comment(s)

Usually when I receive an email that looks like spam, I can just mash my "Send to Junk" keyboard shortcut and it goes away.  But every once in awhile there is a decent looking spam that *might* be real.  At first glance it won't have an images or selling viagra, or anything like that in it, and might just look real.  

This is where the common sense approach to reading email kicks in.  Obviously this post it not for the expert, this is probably more of the occasional user, but maybe someone in between will find it useful.

Here's a spam I received this morning that prompted me to write this diary:

From: Comcast

"This is a courtesy reminder that your Comcast Billing Information needs to be verified.

In order to continue using comcast services,  click the link below, sign in and and follow the provided steps:

<Malicious Link was right here>

Regards,
Comcast Billing Department"

So, let's look at this and see how easy this is to detect:

  1. I'm not a Comcast customer.  So right there, it was easy to detect.
  2. "comcast" in the second line is not capitalized.  A real Comcast email would have capitalized their own companies name.
  3. Usually an email like this (from Comcast corporate) would tend to have all kinds of disclaimers and other nonsense at the bottom of the email.
  4. The link that I removed was not to "comcast.com"

Now, if we get into the weeds a bit more, we can look at the headers and see where it came from.

It came from a server at a .edu.  I don't want to talk about which .edu (but it was in the United States), as I am going to try and get in touch with their security department after I get done writing this Diary.

Even more bad though -- it came from the "root" account on this server, the headers even indicate what version of Linux this server was running (Ubuntu).  Most likely culprit?  Probably an SSH scan that compromised the root account. 

Make sure you have tight controls over those SSH accounts!  And use common sense when reading your email.  If it looks like bull, and it smells like bull.  Chances are, it's bull.

Hopefully this helped someone.

Oh, the malicious link?  Pointed you to a site that collected your usernames and passwords.

-- Joel Esler | http://blog.joelesler.net | http://twitter.com/joelesler

 

Keywords:
4 comment(s)

Comments

A possible reason for choosing Comcast customers is the company's overuse of domains. I am a customer and see at least five domains with the logo in recent legitimate e-mails. Leads to customer confusion or apathy towards URL domain verification. Other companies have the same issue, some of those are financial companies.
I have been sent account suspension notices from HSBC, B of A, and today, Citigroup. I never had accounts with any of them. I would be curious to know what is the percentage of spamees responding and how many dollars did the spamees lose?

There's another useful filter. Let's say you have several email accounts, and you get an email that purports to be from your bank but it comes to an email address that you never use for banking.

But a quick mouse-over any links will remove any doubts about the legitimacy of any email.
Unfortunately though, some genuine emails are sent out via a third-party e-marketing systems, some of which obfuscate the URLs in the email in order to track who clicked on what...

Diary Archives