Forgot your password?
typodupeerror
Security Crime IT Technology

New "Spear Phishing" Attacks Target IT Admins 134

Posted by kdawson
from the parasitic-wasps dept.
snydeq writes "A new breed of 'spear phishing' aimed at IT admins is making the rounds. The emails, containing no obvious malicious links, are fooling even the savviest of users into opening up holes in their company's network defenses. The authentic-looking emails, which often include the admin's complete name or refer to a real project they are working on, are the product of tactical research or database hacks and appear as if having been sent by the company's hosting provider. 'In each case, the victim remembered getting a similar sort of email message when they first signed on with a service and, thus, thought the bogus message was legitimate — especially because their cloud/hosting providers keep bragging about all the new data centers they're continuing to bring online.' The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares. Certainly fodder for some bone-headed mistakes on the part of admins, the new attack 'makes the old days of hoax messages that caused users to delete legitimate operating system files seem relatively harmless.'"
This discussion has been archived. No new comments can be posted.

New "Spear Phishing" Attacks Target IT Admins

Comments Filter:
  • This is why... (Score:2, Interesting)

    by Anonymous Coward

    The less information floats about you on the net, the better.

    • by ceeam (39911)

      True. Until you're looking for a new job, probably.

      • by bsDaemon (87307)
        Or especially when you're looking for a new job, knowing some people.
        • Hey, when we were looking for co-op students, I looked them up on Facebook. At least one was vetted as a "douche" based on his pictures.

          • by KevinKnSC (744603)

            That's ammo for an EEOC complaint, right there.

            • That's ammo for an EEOC complaint, right there.

              I'm an equal opportunity employer. As long as you're not a douche, druggie, or moron, that would potentially damage my business, you have an equal opportunity to get employed regardless of being black, gay, Christian, Russian, female, etc...

              • As long as you're not a douche, druggie, or moron, that would potentially damage my business, you have an equal opportunity to get employed

                Define "druggie"... My facebook profile mentions quite clearly that I take LSD, and advocate others to do so (well, I use the words "psychedelic substance advocacy" in my list of interests). Would that disqualify me for a job from your point of view?

                Just wondering really - I'm happily employed and well paid in my current position with plenty of room for moving up from where I am to even better things, so I'm not looking right now.

                • Define "druggie"... My facebook profile mentions quite clearly that I take LSD, and advocate others to do so (well, I use the words "psychedelic substance advocacy" in my list of interests). Would that disqualify me for a job from your point of view?

                  Just wondering really - I'm happily employed and well paid in my current position with plenty of room for moving up from where I am to even better things, so I'm not looking right now.

                  If I ran my own company, probably not. If you showed up wasted to an interview, the office, etc...I would fire you. But I strongly believe that whatever you do on your own time is your own business--none of mine and none of the governments. Of course the opposite is true. As a business, I can choose to hire and fire whomever I want, and it's no business of the government's.

  • by pla (258480) on Tuesday March 02, 2010 @05:25PM (#31335906) Journal
    The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares.

    Why on Earth would I do that at the whim of my ISP or web host? I've actually gotten into arguments with known, real providers that insisted they needed access to my network to work properly (correct response - "No, no you don't - and neither does your competition"), I sure as hell wouldn't say "Oh, you have a new service? Cool, guess I'll chuck that Sonicwall in the trash now...".

    This may target "your nephew who does your computer stuff at the office", but it sure as hell doesn't target IT professionals.
    • by Fnord666 (889225) on Tuesday March 02, 2010 @05:32PM (#31336026) Journal
      Seconded. Why in the world would anyone with a quarter of a clue look at

      We are pleased to announce the go-live date for a new Data Center, scheduled to go live on April 19, 2010.
      Please update your firewall rules to allow SMTP traffic on port 25 from the following IP address ranges:213.199.180.128/26 (213.199.180.129 - 213.199.180.190)94.245.120.64/26 (94.245.120.65 - 94.245.120.126)

      and think "Hey, I better do this right away."?

      • by rmadmin (532701)
        First thing I'd do is go "OH! IPs!" and hit arin. Then I'd go "RIPE? I don't f-ing think so!" Then again, I'm goofy about looking up IPs all the time. :D
        • What I thought was, "Fucking /26 blocks? Are you kidding me?" Not to mention that opening 25 to 128 different IPs makes no sense at all.

      • by asdf7890 (1518587) on Tuesday March 02, 2010 @06:12PM (#31336620)
        But what about someone who setup the service initially some months ago and has since moved on and is busy with several other projects, that someone might give the mail a cursory glance and the forward it to the less experienced team/individual currently operating as caretaker for the service. He/she/they might decide to just blindly go ahead either because they are less experienced, they assume the person that forwarded the note to them checked it, or they are numbskull button-pushers employed by the lowest bidding IT outsourcing outfit, or some combination of the above - at which point the ne'er-do-wells have an in...
      • by w0mprat (1317953)

        Seconded. Why in the world would anyone with a quarter of a clue look at

        We are pleased to announce the go-live date for a new Data Center, scheduled to go live on April 19, 2010. Please update your firewall rules to allow SMTP traffic on port 25 from the following IP address ranges:213.199.180.128/26 (213.199.180.129 - 213.199.180.190)94.245.120.64/26 (94.245.120.65 - 94.245.120.126)

        and think "Hey, I better do this right away."?

        An firm worth it's salt with have a change process with the firewall, which would catch out anything like this. Mr "Hey, I better do this right away" Admin should not have the access and authority to do this kind of thing on the fly... or the organization had another thing coming.

        • by h4rr4r (612664)

          The change process should be the admins. Anything else gets business morons involved and they are the ones who think opening stuff for whole /26s is ok.
          If the admins fuckup fire them.

        • An firm worth it's salt with have a change process with the firewall

          It's nice to pretend.
          Any anything worth its anything will eschew formal safety obstacles to get the job done. 99.99999% of the time nothing goes wrong.

      • You'd be surprised how many idiots are admins.

        I remember late last year a competitor ISP emailed me about us trying to transfer a domain to our service (a customer was moving service). Anyway, this numbfuck (the DNS admin) didn't know what to do to allow the transfer to proceed, so he emailed me the admin login and password to their entire DNS administration system so I could do it myself.... (I think I just ruptured my spleen again laughing so hard as I remember).

        happy sigh, good times.

    • by GPLDAN (732269) on Tuesday March 02, 2010 @05:34PM (#31336044)
      You run a SONICWALL and you HAVEN'T thrown it in the trash yet?


      (We still run a ES6000. I feel your pain.)
      • by dave562 (969951)

        That ES6000 is an email security appliance and not a firewall. Sonicwall firewalls are decent devices. I can only comment on them in the typical SMB deployment, but I've seen one handle 500 users on a DS3 connection without a problem. That included full IDS/IPS and gateway anti-virus on the connections.

        If you need email security, why aren't you using Postini? They're ridiculously cheap for standard anti-spam / anti-virus filtering on your SMTP streams. We're paying about $4 per user for 125 users.

        • That ES6000 is an email security appliance and not a firewall. Sonicwall firewalls are decent devices. I can only comment on them in the typical SMB deployment, but I've seen one handle 500 users on a DS3 connection without a problem.

          SonicWALL firewalls are decent devices in a small business or corporate settings...compared to PUNCHING YOURSELF IN THE BALLS REPEATEDLY.

          Seriously. Support for OpenVPN? Nope
          RIP, OSPF, or BGP routing over a VPN link? Nope.
          Mesh offices together with IPSEC VPNs? Have money to burn on more VPN licenses? Oh and hopefully you don't mind manually tweaking routes in all the remote offices whenever you add a new subnet somewhere.
          Uptime? Hopefully you don't mind rebooting occasionally when you do somethin

          • Ok--wow. I totally screwed up the formatting at the end of that comment. There's no stipulation that competent mail admins preview before posting is there?
    • by xzvf (924443) on Tuesday March 02, 2010 @05:48PM (#31336288)
      It is hard to concentrate on multiple tasks at once. While a good sysadmin won't fall for this on the best days, an overworked one will occasionally just do stuff that looks right. If you want real security, any change should require two people (who don't know each other in physically different locations) to implement, an approved change control document that identifies the change and reason for it, and an auditor that goes follows behind the change to make sure it doesn't open any holes. I'm going for funny on this.........
      • by nurb432 (527695)

        I disagree, if you do something via an unsolicited EMAIL then you are a fool. It has nothing to do with being overworked. Its common sense.

        Now, if they call you on the phone, and give you real verifiable meat, then i can see bad things happening. But even then, id want to call them back to verify if things sounded the least bit strange.

        • by TheLink (130905)
          No excuse in that case.

          But what if all the attacker needs is for you to click on the link in the email?

          e.g. overworked admin gets an email that appears to be from "That idiot ISP who keeps sending me announcements via http/pdf/msword links".

          Admin clicks on link, gets pwned without knowing.

          If the admin has html email enabled (just to be able to read instructions from bosses )the whole message could be a link too, so you could still accidentally click on the payload even if you know it is suspicious (e.g. mis
      • While a good sysadmin won't fall for this on the best days, an overworked one will occasionally just do stuff that looks right.

        I am sorry, but if this "looks right" to you, even on your worst day after down two quarts of gin, then you really have no business being a sysadmin. Open your mailserver to large blocks of random IP addresses? Tell me, if you got something that looked like it was from your bank that told you to leave a large pile of cash sitting outside your front door, would you do it? Even if

      • by GaryOlson (737642)
        Not everyone has a backup admin for these tasks. Whose infinite budget are you using for this extra manpower?
      • by Cramer (69040)

        Actually, having been an overworked admin, the overworked admin would see "April 19" and say, "I don't need to worry about that for awhile" and promptly drop it in the calendar for April 16 (friday) or 19 (monday). And get right back to whatever. Plus, the message tells you exactly where to go to see the complete list of addresses that's supposed to be used, so that's where I'd go for the "complete list" instead of some random email. (plus, I have scripts that generate firewall configurations... copy, pas

    • by SatanicPuppy (611928) * <Satanicpuppy&gmail,com> on Tuesday March 02, 2010 @06:01PM (#31336454) Journal

      Exactly. I'm just going to open up some port, or change my mail settings because some schmuck sends me an email?

      I changed an IP address on a single server and it ended up being 6 hours on the phone with corporate VPN jockeys and contractor VPN jockeys and failover tunnel configuration, and the WAN guys, and the next day I had to put in another hour because a different business unit on an outsourced customer service portal had missed that we were moving the server, and they had to get set up as well.

      Firewall/Server changes from an ISP over email? Right.

    • Re: (Score:3, Interesting)

      by mjwx (966435)

      I've actually gotten into arguments with known, real providers that insisted they needed access to my network to work properly

      I hear you, I tend to get this from internal staff.

      Developer: I need ports 10,000 to 65,000 opened on the firewall to all IP's so I can run $APPLICATION_OF_THE_DAY.
      Me: No, you don't. I'm not opening up a security hole in our firewall for something you don't need.
      Dev storms off in a huff.
      Phone rings 5 minutes later.
      Head Dev: Jeff needs ports 10,000 to 65,000 open on the f

    • Amen, I open ports for stuff that I know, first hand, verified face to face only. This is more like phishing for id10t's than anything else. Besides I like our ISP the only thing they ask for is a check. Otherwise they do what they are supposed to and that keeps us both happy.
  • ...about the Tiger Team in the Patch entry of the Jargon Lexicon: http://www.catb.org/~esr/jargon/html/P/patch.html [catb.org]
  • Show of hands, who else did a whois on those IPs and noticed they're registered to Microsoft in Ireland and Great Britain? I get enough crap from Microsoft, why would I want to let more in?
    • Re: (Score:2, Interesting)

      by Anonymous Coward

      (*hand up*)

      Made me wonder why the spear-fishee didn't check the "legit" addresses in the attack email. My first thought was "What, an admin that doesn't know whois?"

      Repeat after me: Anybody can get your name and other personal info. If you're not on Facebook, someone else is and they've already given your personals up for you on your behalf. We are officially in the "John Anderton" age. Beer commercials will address you by name. It doesn't mean jack.

      Get used to the future. Numb your response to being person

      • by Nikker (749551)
        Getting your name and occupation isn't really that difficult. Find a company, search for email addresses, send some out to people in other departments looking for a contact in your department, bonus points for getting someone who knows what contractors / vendors you deal with. Send an email to your email address quoting said vendors, throw in a back splash and header graphic and you might have the guy's attention. I personally don't think many admins will open ports and white list ip blocks but that does
  • by aardwolf64 (160070) on Tuesday March 02, 2010 @05:37PM (#31336124) Homepage

    I have one of those e-mails in my inbox right now... Supposedly from 1and1.com. It looks legitimate enough, but when hovering over the links with my mouse, I get some not very nice links... some of which go to Denmark.

  • by GNUALMAFUERTE (697061) <almafuerte@nOsPAM.gmail.com> on Tuesday March 02, 2010 @05:40PM (#31336166)

    I've been a Unix sysadmin all my life.

    I've worked in the IT departments of non-tech related companies (or at least companies where the servers I maintained where not the actual service being provided by the company). I've worked on the Hosting industry (Where the servers I maintained where the core of the business), in software factories, and other industries. For the last 8 years, I've worked on telephony. I'm currently on charge of the whole operation of a small telco (When I got here, they were cisco+oracle+asp based, and I migrated the whole thing to Asterisk+MySQL+Perl.

    I would never, EVER, fall for such a thing. Actually, I keep fighting with my providers over this crap. Even the big guys send updates in plain motherfucking email. Carriers set up and bring down POPs for inbound calls and signalling/media gateways all the time. They insist on notifying us of such additions on plain email.

    I'm not going to whitelist on my firewall and add to my sip.conf as a peer/user/friend an IP I got in some random email!.

    You want to notify me: Sign your fucking messages! They are fucking Verizon, and the bastards refuse to just sign their freaking email messages. So, what I do is, I have a template explaining the dangers of notifying of such changes in plain email. I reply to every mail I get with that template, and then call my account manager or whoever I have to in order to confirm the information.

    Level 3 (Now owned by Verizon too), Verizon, British Telecom, Global Crosing, and other HUGE players on this industry, all do the same stupid shit. And all this guys are fucking Tier 1!
    Believe it or not, some other small Telcos seem to be more conscious about this stuff. VoipJet, for example (a small A-Z IAX-only route), sends all the notifications signed and they provide a link to the notice on their website where you can double check the information.

    So, the blame here goes to BOTH the stupid Admins that just do whatever they get told over email, and to the companies that get them used to accept unauthenticated communications.

    • Yeah I am not in your league but I did colocate in a building with some fairly strong physical security. Access was to be arranged 24 hours in advance by email. The thing was the email was unsecured, nothing was cryptographically signed so when they got a request from me they had no real way to check that it was really from me.

      • Re: (Score:2, Interesting)

        by GNUALMAFUERTE (697061)

        Totally. That crap happens all the time. That's why any serious facility will have security outsourced to a company that is held legally responsible for the physical access to said facility.

        Short story:

        Once, I had my servers at iPlan (large ISP in Argentina, they have 2 HUGE datacenters in Buenos Aires). One weekend, a server went down and I was out of town. So I sent a friend to take care of it. I called the NOC to authorize him. They said they could only take my authorization in written form. So, I emaile

    • by bunratty (545641)

      I've been a Unix sysadmin all my life.

      Whoa! You were literally born a sysadmin!

      • I've been a Unix sysadmin all my life.

        Whoa! You were literally born a sysadmin!

        He was born with the music of cooling fans in his ears.

      • I thought sysadmins were forged from the fires of Mount Doom?
    • by symes (835608)

      You want to notify me: Sign your fucking messages! They are fucking Verizon, and the bastards refuse to just sign their freaking email messages. So, what I do is, I have a template explaining the dangers of notifying of such changes in plain email... some other small Telcos seem to be more conscious about this stuff. VoipJet, for example (a small A-Z IAX-only route), sends all the notifications signed and they provide a link to the notice on their website where you can double check the information

      This. It makes sense on a lot of levels.

    • by gad_zuki! (70830) on Tuesday March 02, 2010 @06:10PM (#31336592)

      >I've been a Unix sysadmin all my life.

      Why arent you in school? Your kindergarten teacher called.

      Mom, I have to go work!! We lost a drive in the array.

      Oh, ok. Dont forget your GI Joe lunchbox.

    • Re: (Score:3, Funny)

      by bigredradio (631970)

      I would never, EVER, fall for such a thing.

      WOW! You win one internets!

    • Re: (Score:2, Funny)

      by CrashandDie (1114135)

      I've been a Unix sysadmin all my life.

      And looking at how many times you've used "I", it shows.

      • That's because English is my third language. It's a way more structured and tough language than my native Spanish. Since I've learn english by myself, and never took any formal education in the engishn Language, my use of it is mostly technical. So, yes, sometimes I sound like a freaking compiler speaking. Deal with it.

    • For users in the UK, Andrews and Arnold sign all messages with a PGP signature.

      I'm gutted that I'm 4km away from the exchange where I live now.
  • I've seen admin-problem in so many places. Both in Linux and Windows-environments. In Linux, people seem to add their ssh key so you can logon to pretty much every computer in your network. Well I sure hope you have control over every .sh file you might run. In Windows, it's very easy to add your normal user account to the Domain Admins group, thus you should really be careful on what you run from your account.

    Heads up. Use a separate account for your admin privileges!

    • by Qzukk (229616) on Tuesday March 02, 2010 @06:47PM (#31337220) Journal

      In Linux, people seem to add their ssh key so you can logon to pretty much every computer in your network.

      Spreading your public key around like that isn't a big deal. It's when the user removes the password from the private key so he never has to type anything to log in, THAT's the real bad one.

      • Is there a way to make SSH require both a key AND a password?

      • by JimBowen (885772)

        You don't have to remove the passphrase to log in non-interactively. You just have to be using a ssh-agent such as keychain.
        And many people (including me) do..

  • I got one today (Score:2, Informative)

    by Anonymous Coward

    Posted anonymously. Public company. You get it.

    Anyhow, I've got one from un-named webhost today. (Hint, they were one of the companies that got hit when Google got slammed)

    Whoever it was, they new my name, and IP addresses that we host some sites on. The ploy was for me to open up all ports to my site to establish a trust to a range they've provided for "enhanced security analysis" thats now "part of their package" as well as email content filtering.

    1. I host Exchange in house. (Even though I hate it)
    2.

  • by rlthomps-1 (545290) on Tuesday March 02, 2010 @05:44PM (#31336226) Homepage

    The emails, containing no obvious malicious links, are fooling even the savviest of users into opening up holes in their company's network defenses.

    I think by definition, you are not the savviest of users if you fall victim to a phishing attack.

    • by bsDaemon (87307) on Tuesday March 02, 2010 @05:58PM (#31336416)
      I once cleared a mail queue of about 50k email messages... just looping through all the IDs and nuking them in Exim (large i/o issue on the server at the time, and i determined it all to be mail related). When someone questioned me on that, I responded with "there haven't been fifty-thousand legitimate emails in the whole history of the internet."

      Moral of the story: question everything that comes over the wire, especially these days. Any insane requests such as the ones described in the article ought to be verified either in person or on the telephone, with you initiating the contact to a trusted source, otherwise you're pretty much just asking for trouble.
    • Re: (Score:1, Offtopic)

      by catmistake (814204)

      The emails, containing no obvious malicious links, are fooling even the savviest of users into opening up holes in their company's network defenses.

      I think by definition, you are not the savviest of users if you fall victim to a phishing attack.

      Totally. ROFLMFAO stupid admins! We have a few Fail Administrators down in Fail Engineering, too. It's a Fail shop, so most things are Fail, and they hold their own as far as providing job security for the rest of us that just can't seem to get our heads around Fail. Well, I don't wAnna toot my own horn here but last week I wrote a Fail script... but it half worked.

  • savvy? (Score:1, Informative)

    by Anonymous Coward

    An admin who would "[open] up mail servers to enable spam relaying, to disable ... host-based firewalls, and ... open up unprotected network shares" is not savvy. Any admin who does not guard his or her network with the viciousness of a mother lion guarding the den containing her young, even from the actions of his own coworkers, vendors, and business partners, is worthless. These people are the first and last defense in corporate security.

  • The way I figure it, you can't be dumb enough to open up ports on your firewall without so much as calling the company to verify if it's legit AND have the technical skill to do the port forwarding at the same time.

    • The way I figure it, you can't be dumb enough to open up ports on your firewall without so much as calling the company to verify if it's legit AND have the technical skill to do the port forwarding at the same time.

      Clicky clicky...

  • Did we learn nothing from "ogg"?

    Please use terminology that doesn't evince giggles from the general public.

  • Circa Blackhat 2007 (Score:4, Informative)

    by Spyder (15137) on Tuesday March 02, 2010 @06:14PM (#31336644)
    Targeting the admins for access was one of the major points in HD Moore and Valsmith's talk [blackhat.com](PDF) from Blackhat US 2007.
  • by Anonymous Coward
    Some people will click anything... including admins.

    But sometimes user education does work.. kind of. Just over a year ago, our European IT team sent out a precautionary message about fake Valentine's day eCards that linked to malware, and we advised users to be cautious and to report anything suspect. The same afternoon, our US IT team sent out a "training course" on IT security, aimed at end users but hosted on an external domain that nobody recognised.. in fact, almost exactly the sort of thing we had w

  • by Anonymous Coward

    The sample email in the article is actually a genuine service announcement, with the name of the (very large) email gateway provider removed. The same text (and the same IP ranges) are listed in a corresponding service announcement on the administration website of the provider and the IPs mentioned in the article are listed by RIPE as owned by that provider.

  • I hate to say it, but there are a hell of a lot of "sysadmins" out there who couldn't admin their way out of a paper bag. I've cleared up the mess left behind by one or two.

    Not only do I believe these attacks will have a certain degree of success, I also believe the consequences for the sysadmins who fall for them won't be that severe. If they're stupid enough to fall for them I'd be astonished if they're running a tight enough ship for anyone to notice one more hole.

    • Heck, even the admin mentioned in TFA is said to have suspected the scam immediately, and got confirmation 10 minutes later when he received another identical mail. Wow if 10 minutes went by and he still hadn't confirmed that it was a scam, he was either really busy, didn't care, or CISSP doesn't mean a whole lot. You get a mail like that, you look at the headers right away. In almost all cases that will give you the confirmation you need.

  • by Anonymous Coward
    My boss got one, he's convinced it's legit, and I'm being insubordinate by not immediately complying. I tried showing him this story but he refuses to believe it. It has the right logo and everything. So we opened the ports. Is there any way I can volunteer to blacklist my own site before this gets out of hand?
    • Is there any way I can volunteer to blacklist my own site before this gets out of hand?

      Yes! Simply give me your IP range, open up your firewall to the following /24, and I'll get started on that immediately.


      Off topic, but is the UI of /. becoming more slow and unresponsive all the time, or is it me?

  • I told my boss (not a techie by a long shot) about this. Her response was similar to MightyMartian's, only it started with "How could anyone be that stupid?"

    So yeah, we all get tired and get the stupid sometimes, but when even a suit can see it, you have to admit that falling for something like this is pretty darn stupid.

  • ... you need need a formal change management process with approval for security settings changes. And don't tell me that your shop is too small and you cant afford that. If you're too small stop doing IT. Now days IT issues have too much impact on people live to be done as a hobby. "We are too small" would not be enough of an excuse for a manufacturer for not doing safe cars/elevators/fridges/.... And that implies some sort of process and duty separation. IT is catching up the rest of the industry.
  • Over my dead body. If another sysadmin or an engineer asks me to poke a single pinhole to a single IP, we have a discussion about the implications. More often than not, we can avoid that whole mentality and pull rather than push from the server in question. If I got such a request from an outside source, you can bet the scrutiny over the issue would be 10x more intense. In a situation where somebody was to fall for something like this hook, line and sinker, I'd argue such a person shouldn't have administrat
    • by RMH101 (636144)
      so long as they're savvy enough to delete the logs when they realise how dumb they've been...

How many NASA managers does it take to screw in a lightbulb? "That's a known problem... don't worry about it."

Working...