-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
G'day all,
We are seeing a decent trojan spam out using Facebook as the hook. The
emails all differ slightly but possess the same characteristics. Eg:
From: "Facebook presentment"
Subject: Facebook announcement: Great looking girl having fun (Last rated
by Bradford Collins)
Messages from Your Friends on Facebook, April 01, 2009
You have 1 friend requests - Personal Message:
Watch the video titled "Drunk Charlize is dancing striptease on my
Birthday Party, March 28, 2009! We're absolutely shocked!".
Proceed to view full message:
hxxp://facebook.shared.id-etsmrnhy5e.subject.876panel. com/home.htm?/identification/authentication=0616n9m12
Added 16 minutes ago. Message ID: FB-06nnzbrxizjrzvr
2009 Facebook community, Message Center.
Multiple domains are being used all following a naming scheme of
[3-5 digit number]panel.com
Eg:
2349panel. com
43553panel. com
654panel. com
876panel. com
987panel. com
Is anyone else seeing a decent run of this?
Just trying to work out how widespread it is as we are preparing to do an
alert on it.
Apologies if you see this across a few lists - looking for any feedback
on numbers on this (and it is all appreciated).
Best regards,
- -- Matthew McGlashan --
Coordination Centre Team Leader | Hotline: +61 7 3365 4417
Australian Computer Emergency Response Team | Direct: +61 7 3365 7924
(AusCERT) | Fax: +61 7 3365 7031
The University of Queensland | WWW: www.auscert.org.au
Qld 4072 Australia | Email: auscert(a)auscert.org.au
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (FreeBSD)
Comment: http://www.auscert.org.au/render.html?it=1967
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFJ1BXZNVH5XJJInbgRAvMqAJ0cqNWqI3riSyf5Tq9lGzxO9C6xegCcCpl0
KzfS5kwPQpBMNU4TfhQuqDo=
=zKz3
-----END PGP SIGNATURE-----
