SecureResearch

Holiday Season Phishing Scams and Malware Campaigns

Original release date: December 2, 2011 at 1:23 pm
Last revised: December 2, 2011 at 1:23 pm

As the winter holidays are quickly approaching, US-CERT is
republishing this entry to increase awareness.

In the past, US-CERT has received reports of an increased number of
phishing scams and malware campaigns that take advantage of the winter
holidays and holiday shopping season. US-CERT reminds users to remain
cautious when receiving unsolicited email messages that could be part
of a potential phishing scam or malware campaign.

These phishing scams and malware campaigns may include but are not
limited to the following:
* electronic greeting cards that may contain malware
* requests for charitable contributions that may be phishing scams
and may originate from illegitimate sources claiming to be
charities
* screensavers or other forms of media that may contain malware
* credit card applications that may be phishing scams or identity
theft attempts
* online shopping advertisements that may be phishing scams or
identity theft attempts from bogus retailers

US-CERT encourages users and administrators to use caution when
encountering these types of email messages and take the following
preventative measures to protect themselves from phishing scams and
malware campaigns:
* Do not follow unsolicited web links in email messages.
* Use caution when opening email attachments. Refer to the Using
Caution with Email Attachments Cyber Security Tip for more
information on safely handling email attachments.
* Maintain up-to-date antivirus software.
* Review the Federal Trade Commission’s Charity Checklist.
* Verify charity authenticity through a trusted contact number.
Trusted contact information can be found on the Better Business
Bureau National Charity Report Index.
* Refer to the Recognizing and Avoiding Email Scams (pdf) document
for more information on avoiding email scams.
* Refer to the Avoiding Social Engineering and Phishing Attacks
Cyber Security Tip for more information on social engineering
attacks.
* Refer to the Shopping Safely Online Cyber Security Tip for more
information on online shopping safety.

Relevant Url(s):

====
This entry is available at

http://www.us-cert.gov/current/index.html#holiday_season_phishing_scams_and

Adobe has released a security advisory to alert users of a

vulnerability that affects Adobe Flex SDK. This vulnerability affects
Adobe Flex SDK 4.5.1 and earlier 4.X and 3.6 and earlier 3.X for
Windows, Macintosh, and Linux operating systems. Exploitation of this
vulnerability may allow an attacker to perform a cross-site scripting
attack within the Adobe Flex SDK application.

US-CERT encourages users and administrators to review the Adobe
Security Bulletin and apply any necessary updates to mitigate the
risk.

Relevant Url(s):

====
This entry is available at

http://www.us-cert.gov/current/index.html#adobe_releases_security_advisory_for9

This Internet Crime Complaint Center (IC3) has posted an article an avoiding fraud durring the holiday shopping season. Here are some of the tips:

• Do not respond to unsolicited (spam) e-mail.
• Do not click on links contained within an unsolicited e-mail.
• Be cautious of e-mail claiming to contain pictures in attached files, as the files may contain viruses. Only open attachments from known senders. Always run a virus scan on attachment before opening.
• Avoid filling out forms contained in e-mail messages that ask for personal information.
• Always compare the link in the e-mail to the web address link you are directed to and determine if they match.
• Log on directly to the official Web site for the business identified in the e-mail, instead of “linking” to it from an unsolicited e-mail. If the e-mail appears to be from your bank, credit card issuer, or other company you deal with frequently, your statements or official correspondence from the business will provide the proper contact information.
• Contact the actual business that supposedly sent the e-mail to verify that the e-mail is genuine.
• If you are requested to act quickly or there is an emergency, it may be a scam. Fraudsters create a sense of urgency to get you to act impulsively.
• If you receive a request for personal information from a business or financial institution, always look up the main contact information for the requesting company on an independent source (phone book, trusted internet directory, legitimate billing statement, etc.) and use that contact information to verify the legitimacy of the request.
• Remember if it looks too good to be true, it probably is.

Read more at: http://www.ic3.gov/media/2011/111121.aspx

Google Releases Chrome 15.0.874.121

Original release date: November 17, 2011 at 2:23 pm
Last revised: November 17, 2011 at 2:23 pm

Google has released Chrome 15.0.874.121 for Linux, Mac, Windows, and
Chrome Frame to address a vulnerability. This vulnerability allows an
attacker to execute arbitrary code.

US-CERT encourages users and administrators to review the Google
Chrome Releases blog entry and update to Chrome 15.0.874.121.

Relevant Url(s):

====
This entry is available at

http://www.us-cert.gov/current/index.html#google_releases_chrome_15_02