Webmasters targeted in cPanel look-alike phish
Wanted: FTP credentials
Customer Success Testimonial: Recovery is Everything
Fraudsters are targeting webmasters in a massive phishing campaign that attempts to trick marks into giving up credentials needed to administer their sites.
The emails are sent to customers of some of the world's most widely used webhosts, including GoDaddy, Hostgator, Yahoo!, and 50Webs. Although the subject lines vary, they all purport to come from the hosting service. In all, admins from at least 90 different webhosts are being targeted.
"Due to the system maintenance, we kindly ask you to take a few minutes to confirm your FTP details," the emails state.
Those who take the bait are led to a website formatted to look like a page from cPanel, the widely used website administration program. Once a website's address and FTP credentials are entered, users are directed to their host's login page.
Over the past year, scammers have increasingly targeted administrators of legitimate websites. According to a review in the third quarter of this year by security firm Dasient, 5.8 million pages from 640,000 websites were infected with code designed to launch malware attacks on visitors. ScanSafe, a separate security firm, has been tracking a single infection known as Gumblar that's taken over at least 2,000 websites by stealing their administrator credentials.
The latest phishing campaign was uncovered by Gary Warner, the director of research in computer forensics at the University of Alabama at Birmingham. It's unclear if it has any relation to Gumblar or what exactly happens to a site whose admin has fallen for the scam. His report is here. ®
COMMENTS
Mr.
Yeah, just like the 419ers who always sign off with something like "like you, our faith in Jesus our saviour" etc. !!
Broken English
I see the dodgy emails are written in trademark 'Phishing Message English'.
How is it that in all these years, the muppets who run these scams haven't realised that they'd fool a lot more people if they understood some fundamentals of grammar?
Dear user of the hostgator.com? Yep, that sounds real...
Old news to me
As the IT manager for a web dev company, I get emails like this all the time. And they all get referred to the authorities for action. Since many of our clients have commercial sites which process credit card purchases, I am very aware of the unrelenting and varied attempts by these scumbags to get into our sites to milk the credit card details.
Thus I have in place a very strict security policy which, among other things, includes all IT staff never clicking on any link in any email - on pain of immediate termination. Nor is any related information ever to be given out over the phone, no matter who the caller claims to be (and we've had some good ones!). Nor is anyone other than staff permitted into the development area, not even staff family members. No slash card - no entry. And USB sticks are forbidden in there as well.
Access to our host is done only through designated machines (which are not used for any other purpose than transferring data to and from our websites) via SSL and the URL, usernames and passwords must be manually typed every time. We also clear and restore each site from a local read-only backup at the end of each day in case any of our server-side scripts are hacked (by whatever means known or unknown).
Any webmaster worth his degree will have similar policies and procedures in place, ESPECIALLY if you are running credit-card processing sites. Not doing so is courting disaster, because these scamming bastards WILL find you, and the smaller web dev companies are their favourite targets.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
