CNN Gaza Spam Scam: Headlines Make Phishing Lines

Spam phishers are at it again, trying to turn headlines and media sources into phish bait. This time it was the Gaza crisis, with supposedly legitimate CNN mail guiding the gullible to Trojan-bearing malware sites.The latest round of urgent news update phishing scams -- reported by scurity firm RSA as e-mail guides to a Web site promising exclusive CNN reports and images from Gaza -- isn't likely to become as pervasive or widespread as last year's election-oriented spam campaign but should nonetheless raise some alarms -- and give you the chance to pass those alarms along to your employees and co-workers.

It's an important reminder, only slightly less so now that RSA has reported taking down the attack, which was launched from a Chinese domain.

Make these a part of your security/usage policy if they aren't already there. If you don't have a written, enforceable security/usage policy, get one, and then make these a part of it.

Here's how this one works (or tried to):

The bogus CNN/Gaza attack starts with a e-mail containing links that guide the unwary to a site that looks most CNN-ish... until (or unless)

Visitors are prompted to download an Adobe Acrobat update. What they get is a Trojan, one that immediately starts sniffing for SSL information -- secure site visit information that gives the crooks a map of your financial and secure transactional paths.

Simple enough -- and simple enough to fall for if you, and everybody in your business isn't on-guard all the time.

If you haven't had your regular -- monthly, at least -- reminder session with everyone in your company who uses a computer, now's the time to walk them through the basics:

1. Don't read unsolicited e-mail (I'd say don't read any non-business e-mail at work, but we all know how likely that is.)