Home / mailings

PDF

WSLabs, Malicious Website / Malicious Code: Dell lure installing Trojan Horse

Posted on 17 May 2007
Websense Security Lab

Websense Security Labs has received reports of a new email campaign starting in Australia that attempts to lure users to connecting to a malicious website. The Australia CERT has reported emails that are spoofing the Dell online store. The emails claim that the user is being charged for a camera purchase and requests they connect to a site in order to view their profile. The site is encoding there code via Java Script which decodes to 8 different IFRAMES, all which attempt to load exploit code and download and install new malicious code. The site itself appears to be going up and down sporadically.

See: http://www.auscert.org.au/render.html?it=7595

Sample Email from original advisory:

Subject: Your order #[number] has been accepted for the amount
865.00 AUD
From: Dell online Store <order_[number]@dell.co.uk>

Thank you for shopping with us.

Your order #[number] Canon DF-E037 8.0 MP Digital Camera has been
accepted for the amount 865.00 AUD.

Your card will be charged in that amount.

Thank you for your purchase.


You can check the order in your profile.

HTTP://URL Removed

Thank you.
Dell Online Store.

Although this appears to be a new deception technique the website has been used in malicious code attacks in the past and Websense customers are protected from connecting to it already.

Screenshots are available within full alert.

For additional details and information on how to detect and prevent this type of attack:
http://www.websensesecuritylabs.com/alerts/alert.php?AlertID=774

 

TOP