Obama-related E-mails Still Popular Among Spammers

Security researchers warned in the end of 3rd week of January 2009 that some sites claiming the President-elect Barack Obama would decline from his oath taking formalities on January 20, 2009 were delivering exploit code. This exploit is believed to be designed by the same hackers who were behind the infamous Storm Trojan.

Researchers at various security firms like MX Logic Inc., Trend Micro Inc., and F-Secure state that spam scams are executed to cheat end-users into visiting malicious websites hosting new versions of the 'Waledec' malware.

According to Sam Masiello, Vice President of Information Security at MX Logic, spam mails are being distributed with headlines like, "Who will be our president now?" "End-time for USA," and "Haven't you heard latest news about our president-elect?"

Other hoax baits that spammers are using in their messages are "Obama doesn't want anymore to be a president" and "Barack Obama abandoned sinking ship". These messages reportedly have just one line with phrases consisting of a small number of words followed by a web link leading to a site that looks like barackobama.com.

Clicking on the link that asks the user to read further about the story results in the download of a .exe file. This executable file is a new edition of the Waledec virus, said security investigators at F-Secure and Trend Micro.

According to a posting on the security blog of MX Logic by Masiello on January 16, 2009, since it has often been observed that in such instances detection by antiviruses are very low; therefore, users need to be aware of the current tactic, as reported by COMPUTERWORLD on January 18, 2009.

MX Logic further said that it tracked the origin of about 4,000 fraudulent Obama e-mails every single hour on January 17, 2009.

Interestingly, the new Obama-related spam outbreak is occurring despite a report from security provider McAfee in the 3rd week of January 2009 that the rate of spam is down 40% from its peak in November 2008 before the rogue McColo ISP's takedown.

Related article: Open SSL Flaw Invites Forgery

» SPAMfighter News - 2/4/2009