imagedino.info MSN Phishing

I recently received a message from a contact in MSN that had a link in it to the domain imagedino.info. It looked suspect, but I thought I might as well see what is going on.
When I followed the link it took me to a rather suspicious login screen that asked me to logon using my MSN Account.
I would suggest that no one do this as this is more than likely a phishing website that will use your account details for no good.
The link was http://.imagedino.info/
Please block this on your proxy server is you have a proxy.
DO NOT ENTER YOUR MSN USERNAME AND PASSWORD IN THIS FORM.
If you have entered your username and password into this form:

• please change your MSN password as soon as possible.
  
• I am not sure if the page downloads anything malicious onto your computer. I would suggest updating your anti-virus and running a full system scan.
  You can get AVG Anti-virus for free from here.
  
• Also try using something like spybot search and destroy
  

Screenshot of the website.

The moral debate

I read an article on news24.com that says:

One in three information technology professionals abuses administrative passwords to access confidential data such as colleagues' salary details, personal e-mails or board-meeting minutes, according to a survey.
http://www.news24.com/News24/Technology/News/0,,2-13-1443_2343432,00.html

This is a pretty concerning statistic. We (Netowrk Admins) all know that we can access anything in our organisation, but it is our moral responsability not to do so. I know that I can get my hands on any information that I want, any time, from anywhere, but I choose not to as it is not right.
The problem with network administrators is that their role is often missunderstood and that management does not have a clue that they have access to this information. The other problem is that IT administrators are also mostly the implementers of the file security on the networks and that we hold the Administrator rights which allow us to access any information.
It is a double edged sword, we need access to the files to assist when something goes wrong, but we should not be able to see the contents of certain files.

Hack my Coffee?

This could be the funniest security vulnerability ever! I read about how a new coffee machine that can be hooked up to your computer has a buffer overflow vulnerability that can allow a hacker to take control of the application that controls the coffee machine on Trend Micro's Website.
Imagine waking up in the morning to the horror of getting black coffee without out sugar when you programmed your machine for white coffee with 2 sugars!

Oh what a crazy world we live in! :P

Photo courtesy PDPhoto.org

Facebook Phishing

I got an email from facebook that looked like a legit notification that one of my buddies have written on my wall. Except it was written in broken english:

"hello , howdy?? lisen i got a new friend here..shex kinda new here..maybe you can give her a lil tym so she can enjoy here?? not forcin u but u can chk out =)

It was followed by the following link:

http://www.facebook.com.profile.id.aymacc.2810ly6l.dortos.net/facebook/index.php?id=5aaz6677&auth=j5xp2&cyua=hwy9e1l821

It looks pretty legit at first glace, but if you take a close look you will notice that the domain is actially for dortos.net.
Whois information from whois.net

Now the thing that I found wierd was that when I logged into my profile on facebook I still got a notification about the wall post, but there was no post on my wall.

I cautiously opened the link to the fake profile and Firefox 3 Beta blocked it. (See screenshot)

I then decided to open the page up in IE8 and guess what. It looks identical to the facebook login screen. Except that it aint. (screenshot below)


This is a typical phishing attempt. I imagine that my buddy who sent the origional wall post recieved the same thing and his account was compromised. My personal information was then obtained through his profile and a wallpost was placed on my wall.

I am not sure exactly what is going on, but I recon there will be some information once the security researches around the world get a similar "phantom wall post".

I guess this is another reason to upgrade to Firefox 3 :P