'Israel-Hammas' spam attack

Mumbai: RSA Fraud Action Research Lab discovered that the "Cease-Fire
Trojan Attack" which was being delivered via e-mail that has now been spammed to
as many as 80,000 people per hour. The scam exemplifies the adeptness of
fraudsters, who are able to engineer the attacks with near real-time response to
breaking news. It also underscores the opportunistic nature of fraud purveyors
who increasingly prey upon public interest and/or concern regarding national or
global events of broad importance, such as the recent global economic crisis or
the US presidential election.

The fraudster's e-mail refers to recent news regarding the ceasefire in the
Israel-Hamas conflict, and contains a link to a fake CNN.com website and
mentions that the visitor can see 'graphic' images. The fake website produces a
fake Adobe Flash pop-up requesting that a new version of the software be
downloaded in order to see the 'graphic' images. Instead of downloading Adobe
software, the fraudster's fake CNN.com website installs a Trojan with an 'SSL
stealer' that infects a computer and steals information from it.

"The Cease-Fire Trojan Attack shows how fraudsters are deploying their
readily available and advanced technological methods to quickly engineer attacks
in response to very timely news, heartlessly and quickly preying upon public
interest and/or concern for national or global events of broad importance. The
RSA FraudAction Research Lab has been able to find this particular attack and is
working to shut it down. We encourage users to remain vigilant to all
communications that they receive as this is an increasingly effective method of
criminally driven social engineering-running through orthogonal channels to
reach infected users' personal and financial information," said Sam Curry,
VP-Product Management and Strategy at RSA, The Security Division of EMC.