Re: Pishing Warning, posible Ubuntu vulnerado. (OT)
El lun, 14-01-2013 a las 20:49 -0800, consultores escribió:
> Hola
>
> Que opinan de este Pishing?
>
> -----------------------------------------------------------------------------------------------------------------
>
> Return-Path: <concriad@prixeventos.com.br>
> Received: from hm1831-14.locaweb.com.br (hm1831-14.locaweb.com.br
> [189.126.112.34])
> by vcn.bc.ca (8.14.3/8.14.3/Debian-9.1ubuntu1) with ESMTP id
> r0ELEpRp018569;
> Mon, 14 Jan 2013 13:14:55 -0800
> Received: from mcbain0004.email.locaweb.com.br (189.126.112.85) by
> hm1831-34.locaweb.com.br (PowerMTA(TM) v3.5r15) id huhqku12li82; Mon, 14
> Jan 2013 19:14:50 -0200 (envelope-from <concriad@prixeventos.com.br>)
> Received: from moe0057.email.locaweb.com.br
> (moe0057.email.locaweb.com.br [10.50.0.55])
> by mcbain0004.email.locaweb.com.br (Postfix) with ESMTP id
> 191AF325454;
> Mon, 14 Jan 2013 19:14:50 -0200 (BRST)
> Received: from webmail.prixeventos.com.br (localhost [127.0.0.1])
> (Authenticated sender: concriad@prixeventos.com.br)
> by moe0057.email.locaweb.com.br (Postfix) with ESMTPA id A0A3C43A04E;
> Mon, 14 Jan 2013 19:14:49 -0200 (BRST)
> Received: from odJUNsuX7AHRWZKoYNzEi3R7PSDshdB9
> via nkzDdA/xW6ntaqR6WsGtBRh1yODMY7pt
> by webmail.prixeventos.com.br
> with HTTP (HTTP/1.1 POST); Mon, 14 Jan 2013 19:14:49 -0200
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="=_520230cbeefca374c4ac6d0c1840c610"
> Date: Mon, 14 Jan 2013 19:14:49 -0200
> From: Vcn Help Desk <concriad@prixeventos.com.br>
> To: undisclosed-recipients:;
> Subject: Dear account User
> Message-ID: <ce1ad610c72208470b3c663ca6887b70@prixeventos.com.br>
> X-Sender: concriad@prixeventos.com.br
> User-Agent: Webmail
> X-Virus-Scanned: clamav-milter 0.97.3 at mcbain0004
> X-Virus-Status: Clean
> X-CMAE-Verdict: spam
> X-CMAE-Score: 100
> X-CMAE-Analysis: v=2.0 cv=d4RCP2fE c=0 sm=1 p=o2LTiRUqVOEAK2GTSpkA:9
> a=ySJjIj7-7BwA:10 a=dRbcgU5TVaMA:10 a=XWcs22FYAAAA:8 a=194GbPS5w-gA:10
> a=r6hMHeq4AAAA:20 a=YTQz6G9IePgFrmd-xHwA:9 a=QEXdDO2ut3YA:10
> a=dE6T8MQBWsoDkfk8:21 a=DUuZ-bK8RqKK7BhN:21
> a=YWhIQGpoExg4hS7giMtD0g==:117
> X-DSPAM-Result: Innocent
> X-DSPAM-Processed: Mon Jan 14 13:15:00 2013
> X-DSPAM-Confidence: 0.6820
> X-DSPAM-Probability: 0.0000
> X-DSPAM-Signature: 2726,50f4755325481679260327
>
> ----------------------------------------------------------------------------------------------------------------------
>
> El cuerpo es:
>
> --
>
> Dear Account User
>
> A phish attempt, banned phrase or sensitive
> information was detected in a message sent to you
> and the original
> message has been quarantined. This message is a copy of the original
> with the
> content replaced with this text. The subject line and sender
> information has been unaltered from
> the original. Please you are to
> re-validate your xxxxxborrado por seguridadxxxx email address immediately.
> Click on the link
> below or copy and paste to validate your mail box. Fill and click on
> submit.
>
> https://docs.google.com/spreadsheet/viewform?formkey=dFJqN2dLWVJJTXlDS2xncEdCdFVMYnc6MQ
>
> Thanks.
> Help
> Desk
>
>
> !DSPAM:2726,50f4755325481679260327!
>
> -----------------------------------------------------------------------------
>
> Parecería que fue enviado desde un Ubuntu, no se si vulnerado!. Tambien se podria deducir, que
> se capturo un mensaje anterior, del usuario a quien le fue enviado, el formato es igual al que
> envia el Help real.
>
> Ojo:
> El enlace tiene sus animalitos.
>
> hasta luego.
>
>
>
>
>
en mi experiencia opino que mientras existan los usuarios, no importa
cuanto uno endurezca sus sistemas, estas cosas siempre van a seguir
pasando. Y es tan fácil como mandarles un mail de este tipo (incluso
pasados a "'"castellano"'" con traductor automático) pidiéndole las
contraseñas.
Yo estoy pensando seriamente empezar una exitosa carrera como inspector
de billeteras: http://www.youtube.com/watch?v=-WNq33Gksvs :P
Reply to: