WHAT NEXT? - imagedino.info MSN SPIM

Please change your password if you entered your user name and password into the imagedino.info website.

I have been following the imagedino.info saga since yesterday when I received a link to the site from a contact. Ever since then I have been trying to figure out what the point of this "attack" was. It seems pretty harmless and it also seems to be a rather basic attack, but I did some digging and found this article from Trend that seems to be rather similar form of attack.

The article indicates that once you have entered your user name and password into the form your login details are sent to an email box. The owner of that email box can then use your email account to send out spam mails or malware. This is obviously not a good thing, as it will annoy the daylights out of all your friends and possible infect their machines if your account is used to send out malware!

imagedino.info has Google Analytics
I noticed that if you view the source of the page it has Google Analytics embedded in it! What on earth are these guys doing? Is it some security research project by some students that got into the wild?

Get Firefox 3 to block
Also note that Mozilla Firefox 3 now blocks that domain. I would recommend that if you are using internet explorer rather upgrade to Firefox 3. It has some really good security features that block websites like these once they are identified. This is very usefull if you expect someone else to use your computer that also uses MSN. It will prevent them from being part of this whole attack.

What is SPIM?
I noticed that a lot of people where referring to the messages sent as SPIM. according to wiktionary.org : "SPIM is Unsolicited commercial messages sent via an instant messaging system"

SOLUTION - imagedino.info MSN Phishing

CHANGE YOUR PASSWORD AS SOON AS POSSIBLE IF YOU ARE SENDING OUT LINKS imagedino.info to all of your MSN contacts.

It would appear as the the MSN phishing outbreak is nothing more than phishing. After running several scans on his computer my "infected friend" found no viruses or malware. After changing his MSN password the messages seemed to stop. (Also verified by Gregg. See link found http://www.avertlabs.com/research/blog/index.php/2008/06/10/now-be-a-good-victim-and-enter-your-login-credentials-in-the-form/)

Lets hope this is just a single vector attack as now these punks have managed to get all the email addresses and msn information of most of the contacts. I would watch out for the next week or so for any suspect looking emails that arrive in your MSN account email address.

imagedino.info MSN Phishing

I recently received a message from a contact in MSN that had a link in it to the domain imagedino.info. It looked suspect, but I thought I might as well see what is going on.
When I followed the link it took me to a rather suspicious login screen that asked me to logon using my MSN Account.
I would suggest that no one do this as this is more than likely a phishing website that will use your account details for no good.
The link was http://.imagedino.info/
Please block this on your proxy server is you have a proxy.
DO NOT ENTER YOUR MSN USERNAME AND PASSWORD IN THIS FORM.
If you have entered your username and password into this form:

• please change your MSN password as soon as possible.
  
• I am not sure if the page downloads anything malicious onto your computer. I would suggest updating your anti-virus and running a full system scan.
  You can get AVG Anti-virus for free from here.
  
• Also try using something like spybot search and destroy
  

Screenshot of the website.

The moral debate

I read an article on news24.com that says:

One in three information technology professionals abuses administrative passwords to access confidential data such as colleagues' salary details, personal e-mails or board-meeting minutes, according to a survey.
http://www.news24.com/News24/Technology/News/0,,2-13-1443_2343432,00.html

This is a pretty concerning statistic. We (Netowrk Admins) all know that we can access anything in our organisation, but it is our moral responsability not to do so. I know that I can get my hands on any information that I want, any time, from anywhere, but I choose not to as it is not right.
The problem with network administrators is that their role is often missunderstood and that management does not have a clue that they have access to this information. The other problem is that IT administrators are also mostly the implementers of the file security on the networks and that we hold the Administrator rights which allow us to access any information.
It is a double edged sword, we need access to the files to assist when something goes wrong, but we should not be able to see the contents of certain files.